Zscaler - Secure Web Gateway & Cloud App Control

What Is a Secure Web Gateway

The logical grouping of components that delivers web-related security capabilities is commonly known as a secure web gateway. Per Gartner's definition, a secure web gateway must at minimum include URL filtering, malicious code detection, and application controls for popular web-based applications, with DLP increasingly included as well. In Zscaler Internet Access (ZIA), these capabilities live under Internet Access > Policy and the platform's Data Security tools.

Signing In and Locating Cloud App Control

Access to ZIA now starts at the unified Zscaler Cloud Portal, console.zscaler.com. Sign-in is a two-step flow through the Zscaler Authentication Service (formerly ZIdentity): enter a username or email and select Next, then enter a password and select Verify. The service supports MFA and enterprise identity provider integration, replacing the older per-organization admin URL and local password.

Navigation follows a hamburger-menu pattern: click the three horizontal lines in the top-left corner, choose a top-level product area, then a specific feature page. Cloud App Control is reached via Data Security > Configuration > SaaS/Cloud App Policy. Changes still follow the familiar Save and Activate model — Save stores the change locally, Activate pushes it out to the edges that enforce it.

Cloud App Control Overview

Cloud App Control gives granular control over how users consume popular cloud applications. Rules are evaluated in order, stopping at the first match, and cloud app rules take priority over URL Filtering rules — a match cascades into URL filtering only if explicitly enabled. Applications are organized into categories (file sharing, human resources, social networking, instant messaging, and more), simplifying rules covering similar apps. An unclear category can be looked up under Administration > Access Control > Cloud Applications, or via the URL lookup tool.

Configuring a Rule

Consider a requirement to block all users from a chat application such as Google Chat. After confirming its category (Instant Messaging), an administrator adds a new rule, selects that category, names the rule, and searches for the app. The rule can apply to all users or be scoped by group, location, or device type, with an optional expiration window. Actions vary by capability — allowing Google Chat, for instance, exposes separate controls for messaging versus file transfer, or access limited by time or bandwidth. Selecting Block fully restricts the app; HTTPS traffic shows a block page only when SSL inspection is enabled, otherwise the browser simply errors. Blocking Google Chat this way also blocks the equivalent capability inside Gmail.

Rules can also be more granular than a simple allow/block: a Social Networking rule for Facebook could set viewing to allow and posting to block, so a user who tries to post instead gets an application-specific failure message while browsing continues normally. Block and notification messages can be branded under Administration > Access Control > End User Notifications, including a company logo and custom wording.

Caution and Isolation Actions

Two further actions round out Cloud App Control rules. Caution warns that a site may violate policy but still lets the user proceed; it requires selecting applicable user agents, with its message customizable in the same notification area.

Isolate routes matching traffic into an isolated remote browser: the endpoint receives only a pixel-based stream of the page, so no active content reaches the device. The rule requires an isolation profile, and isolated sessions show a Zscaler indicator confirming isolation (users may need to re-authenticate, since the session originates elsewhere). Isolation profiles are managed under Zero Trust Browser > Isolation Profile & Banner. A related Smart Isolate option under Internet Access > Policy > Secure Browsing uses AI models to auto-route likely-malicious traffic into isolation, alongside a Browsing Control option restricting which browsers and plugins may reach the internet.

Monitoring Cloud App Activity

All secure web gateway traffic, including Cloud App Control activity, is visible in Web Insights log reports, filterable by user, cloud application, and policy action — confirming when a caution or isolate action fired, or when a user attempted a blocked action such as posting. Logs also show connection location (a 'Road Warrior' entry indicates a user connecting via the Zscaler Client Connector) and flag traffic routed through isolation.

Conclusion

Cloud App Control extends the secure web gateway model with precise, per-application control — from outright blocking to granular restrictions, cautioning, and full browser isolation. Combined with URL filtering, malicious code detection, and DLP, it completes the capabilities Gartner defines for a secure web gateway, all managed from the unified ZIA console.