A Custom Connector is designed with the principle of least privilege. It lets administrators authorize only the minimal set of scopes/credentials that the Zscaler service needs to scan a specific SaaS tenant, thereby reducing security risk.

B. Temporary credentials are not a core design goal; the connector uses permanent OAuth/ service-account credentials with restricted scopes.

C. Custom connectors are tenant-specific, not intended for broad, multi-tenant access.

D. Granting full-administrator credentials is specifically discouraged; least-privilege access is recommended.

1. Zscaler SaaS Security API Help, “Creating a Custom Connector – Required OAuth Scopes,” §Prerequisites, para 2 (https://help.zscaler.com/ssm/custom-connectors).

2. Zscaler CASB Admin Guide, “Principle of Least Privilege for SaaS Connectors,” p. 12.

3. Zscaler Security Cloud Architecture Whitepaper, “Minimizing Credential Exposure,” p. 18.