Overview

Product video
The Zscaler Private Access (ZPA) service enables organizations to provide access to internal applications and services while ensuring the security of their networks. ZPA is an easier to deploy, more cost-effective, and more secure alternative to VPNs. Unlike VPNs, which require users to connect to your network to access your enterprise applications, ZPA allows you to give users policy-based secure access only to the internal apps they need to get their work done. With ZPA, application access does not require network access.
While ZPA is for connecting users to an enterprise's internal applications, Zscaler Internet Access (ZIA) is for connecting users to public applications on the internet. To learn more about ZIA architecture, see About the ZIA Cloud Architecture.
Additionally, ZPA decouples applications from the physical network so you can provide seamless connectivity to private internal applications and assets whether they are in the cloud, the data center, or both. It also adjusts dynamically to network changes, so you can move your resources without impacting user access.
You can configure settings and policies on a central ZPA Admin Portal, which also feature dashboards where you can see your users and the apps they access, and monitor the health of your servers and resources. You can configure ZPA to automatically discover servers and applications when users request them, or you can configure them manually as well. You then define policies that specify which apps users or groups can use, and ZPA allows them to connect to those apps only. ZPA renders your applications invisible to all but the authorized users and unroutable to anyone.
Like all Zscaler offerings the ZPA service is based on Zscaler's global cloud platform. So, there is no requirement for additional hardware or upgrades to existing hardware.
Highlights
- Zscaler Client Connector: Installed on your users' devices, the Zscaler Client Connector connects to the ZPA cloud to enable granular, policy-based access to your organization's internal resource.
- App Connectors: Lightweight virtual machines (VM) that are installed in the data centers that host your servers and applications. They connect to ZPA Public Service Edges or ZPA Private Service Edges only to provide users access to applications in your data center, and do not accept inbound connections.
- Global Zscaler Cloud: Stitches all components together. The Central Authority (CA) provides a central location for software updates as well as policy and configuration settings. The ZPA Public Service Edges or ZPA Private Service Edges enforce user policies and provides secure transport to the App Connectors.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Vendor refund policy
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
For Release notes please access this link: https://help.zscaler.com/zpa/documentation-knowledgebase/release-notes/zpa-app-connector-release-notes
Additional details
Usage instructions
In order to acquire a license key for this product, please contact us via our web form here: https://www.zscaler.com/company/contact .
Once complete, you may access the User Interface of the Zscaler Cloud Portal by accessing this link here: https://admin.zscaler.net/ . If not completed prior, you will be promoted to create an Admin account for your Zscaler Cloud Portal.
Utilizing the login you created, you may now utilize the Zscaler Cloud Portal to access your Zscaler management console where you will be able to manage and deploy new products on AWS, or other locations.
For ZPA Connector AWS Deployment see the below:
Update the Security Group associated to the App Connector to temporarily allow inbound access on port 22, then complete the following steps to connect to the instance.
SSH access is required in order to configure the provisioning key for the App Connector. See instructions: https://help.zscaler.com/zpa/connector-deployment-guide-amazon-web-services#security
Log in to the App Connector console using your AWS Private Key (i.e., a .pem file).
SSH access is enabled by default on AWS App Connectors, so there is no need to enable the service manually.
Using a standard SSH client, enter the following command to connect to the AWS instance: ssh -i <AWS Private Key> admin@<App Connector Public Hostname or IP Address>
For example, the private key for the AWS instance is AWS.pem and the App Connector IP address is 35.160.130.25: ssh -i AWS.pem admin@35.160.130.25
Support
Vendor support
Zscaler global support is available around the clock, with dedicated customer support engineers providing personalized assistance to ensure that customers are getting the most value from our products. Our support engineers have significant experience in networking and security, working closely with operations, sales, and engineering teams to ensure rapid response and resolution.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Customer reviews
Zscaler Private Access: Stable, Secure VPN Alternative That Streamlines Daily Work
From a test automation perspective, it has made my daily work much smoother. I used to deal with random VPN drops right in the middle of running tests or calling internal APIs, which was frustrating. With ZPA, the connection is much more stable. Once I’m logged in, I can access staging environments and APIs without interruptions, which saves time especially during debugging and long test runs.
On the UI/UX side, I like that it’s not something I constantly have to think about. The client is simple and runs quietly in the background. From an admin perspective, the interface can feel a bit complex at first, but once you get used to it, managing access policies becomes more structured and predictable.
Another thing I appreciate is how it integrates with identity providers. Access is based on roles and context, so I don’t have to chase permissions all the time. It’s clear, controlled, and feels more secure without adding extra friction.
In terms of performance, it was actually better than I expected. Compared to VPN, latency feels lower, especially when running API-heavy automated tests. That directly impacts our efficiency.
From a pricing/ROI perspective, it makes sense if you consider the bigger picture. It’s not just about replacing VPN, but reducing downtime, improving security, and saving engineering time. Fewer connection issues alone have already paid back a lot for us.
Support has also been reliable in my experience. When we had configuration questions early on, responses were helpful and fairly quick, which made the onboarding process easier.
I haven’t deeply used any AI-driven features, but the platform’s policy-based intelligence and access control logic already feel quite advanced. It’s clear that decisions are not just static rules but based on context like user identity and device state.
Overall, it’s been a more stable, secure, and less frustrating way to access internal resources compared to traditional approaches.
From a day-to-day usage perspective, troubleshooting can sometimes be a bit difficult. When something doesn’t work, it’s not always immediately clear whether the issue is related to policies, identity provider integration, or network configuration. This can slow things down, especially when you're trying to quickly access an internal service during development or testing.
On the UI/UX side, while the end-user experience is simple, the admin interface can feel a bit overwhelming at first. There are many configuration layers, and it takes some time to fully understand how everything is connected.
Pricing could also be a consideration for smaller teams. While it delivers value in terms of security and stability, the cost might feel high if you're not fully utilizing all of its capabilities.
In terms of support, while generally helpful, response times can vary depending on the issue, and more complex cases may require some back-and-forth before getting fully resolved.
Lastly, while the platform has strong policy-based logic, I haven’t seen very visible or impactful AI-driven features in everyday use yet. Most of the intelligence still feels rule-based rather than adaptive.
Overall, none of these are deal-breakers, but they are things to consider, especially during the onboarding and early adoption phase.
ZPA solved this by removing the dependency on VPN and switching to a more targeted access model. Now, instead of connecting to the entire network, I can securely access only the specific applications I need. This has made a noticeable difference in both stability and security.
For my daily work in test automation, the biggest benefit has been consistency. I can run API tests, access internal tools, and debug issues without worrying about random disconnects. It’s especially helpful when running longer automation suites, where even a small interruption used to cause failures and waste time.
Another benefit is around access control. Permissions are clearly defined, so I don’t have to constantly request access or deal with unnecessary privileges. Everything feels more streamlined and controlled.
Overall, it has reduced a lot of the friction we used to have with remote access. Less time spent dealing with connection issues means more time actually focusing on testing and development, which has been a big win for productivity.
Seamless Always-On Zero Trust Access with Strong Global Performance
Secure Per‑App Access, But Less Control and Harder Troubleshooting
Old security assumes users inside the network are trusted. Modern reality proves that’s dangerous. Benefit to me for this reason:
Safer access
Simpler experience
More flexibility
Less risk of major breaches