zpa-create-conditional-access-rule
Create a ZPA Access Policy rule that gates access to a private application on multiple combined checks: identity (SCIM group / SAML), one or more named device posture profiles (associated by UDID; ZPA does not introspect what each profile checks), platform reported by ZCC, country, and risk-score level. Use when an admin asks for 'conditional access', 'multi-check access rule', 'attach posture profile X and risk level low to this rule', or 'allow only if posture passes and risk is low' for a private application. For session-duration / re-auth requirements, see `zpa-create-session-duration-rule` (separate ZPA resource type).
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zpa/create-conditional-access-rule" into this agent's normal skills directory: use the OMGSkills MCP get_skill tool, install only the pinned_install commit and path, verify SKILL.md against pinned_install.skill_md_sha, and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zpa/create-conditional-access-rule ~/.claude/skills/zpa-create-conditional-access-ruleFrom README
ZPA: Create Conditional Access Rule (Multi-Check) Keywords conditional access, multi-check access rule, layered access rule, identity + posture + platform + risk, attach posture profile to rule, attach risk score to rule, secure remote access SSH, internal app conditional access How to talk to the admin (read this before you respond) The admin is asking a business question — "can you build this access rule?". Tool plumbing is internal optimization the admin does not care about. Plain language only. Translate tool output into the answer the admin wanted. Don't paste back JMESPath expressions, search keys, projections, validation errors, Pydantic messages, or SDK tuple shapes. Empty is authoritative — do not fan out retries. A zpalist call with search=" " is a server-side substring match on the resource's name field. An empty result means the resource does not exist by that name. Stop.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.