The Zscaler Microtunnel (M-Tunnel) is a fundamental component of the Zscaler Private Access (ZPA) architecture. Its primary purpose is to establish a secure, on-demand, end-to-end encrypted tunnel from a user's device to a specific internal (private) application. When a user requests access, ZPA dynamically creates an M-Tunnel that connects the Zscaler Client Connector (ZCC) on the user's device to the App Connector co-located with the application. This process ensures that users are never placed on the network and are granted direct, policy-based access only to the applications they are authorized to use, embodying a zero trust security model.

A. ZPA M-Tunnels are designed for user-to-application communication, not for direct peer-to-peer connections between Zscaler Client Connector (ZCC) clients.

B. M-Tunnels are for accessing private applications. Access to public SaaS applications like Microsoft 365 is typically secured through Zscaler Internet Access (ZIA).

C. Authentication is handled by an Identity Provider (IdP) like Azure AD before an M-Tunnel is established. The M-Tunnel is for application access post-authentication.

1. Zscaler Help Portal

"About Microtunnels": "When a user requests access to an application

ZPA establishes a secure

end-to-end encrypted tunnel

called a Microtunnel (M-Tunnel)

between the user's device and the application. The M-Tunnel ensures that the user has a direct

secure path to the application without ever being placed on the network."

2. Zscaler Help Portal

"Understanding Zscaler Private Access (ZPA)": "ZPA is a cloud service that provides secure

zero trust access to internal applications... ZPA uses inside-out connectivity to connect users to applications... This connection is established using a lightweight Zscaler software called Zscaler Client Connector on the user's device and App Connectors in the data center where the applications are hosted." The M-Tunnel is the mechanism for this connection.

3. Zscaler Help Portal

"About Zscaler Client Connector": "For ZPA

Zscaler Client Connector creates a secure

private microtunnel that connects the user's device directly to the apps they need

without having to connect to the network."