Configuring ZScaler Client Connector for Microsoft Windows 365 Cloud PCs

Microsoft Windows 365 provides a secure, cloud-delivered Desktop-as-a-Service (DaaS) solution, offering fully virtualized Windows desktops (Cloud PCs) accessible from any device. To enhance security and connectivity, integrating ZScaler Client Connector with Windows 365 ensures a robust Zero Trust framework and optimized performance.

This article explains how to deploy and configure ZScaler Client Connector for seamless integration with Windows 365 Cloud PCs.

Overview of Architecture Components

The integration of ZScaler Client Connector with Microsoft Windows 365 involves multiple components working together:

1. User Devices

• Devices like laptops, desktops, tablets, or mobile phones are used to access Cloud PCs.
• These devices run the ZScaler Client Connector to route all traffic through ZScaler’s secure infrastructure.

2. ZScaler Client Connector

• A lightweight agent installed on user devices or Cloud PCs.
• Routes traffic through ZScaler’s Secure Web Gateway (SWG) for inspection and enforcement of Zero Trust policies.
• Ensures secure and optimized connectivity to Cloud PCs and enterprise resources.

3. ZScaler Secure Web Gateway (SWG)

• A cloud-based service that inspects, filters, and enforces security policies on user and application traffic.
• Provides threat detection, malware protection, and content filtering.

4. Windows 365 Cloud PCs

• Virtual desktops hosted in Microsoft Azure, managed by Windows 365.
• Can operate in a Microsoft-hosted network (minimal configuration) or a self-managed network (greater customization).

5. Microsoft Azure Components

• Azure Virtual Network (VNet): Routes traffic between Cloud PCs, user devices, and enterprise applications.
• Azure Instance Metadata Service (IMDS): Facilitates Cloud PC health monitoring and service metadata access.

6. Enterprise Resources

• Includes corporate applications, on-premises servers, and SaaS platforms accessible through secure connections.

By routing all traffic through ZScaler before reaching these components, organizations maintain a secure and streamlined workflow.

Step-by-Step Configuration

1. Deploy a Windows 365 Provisioning Policy

• Configure Cloud PCs based on your organization’s network setup:
  • Microsoft-hosted network: A straightforward option with minimal setup.
  • Self-managed network: Offers more flexibility and control over network configurations.

Refer to Microsoft’s Windows 365 networking deployment options for guidance.

2. Install ZScaler Client Connector

Choose one of the following approaches to deploy the ZScaler Client Connector:

• Custom Image Deployment:
  • Install the ZScaler Client Connector on the image before provisioning Cloud PCs.
• Intune Deployment (Recommended):
  • Deploy the application through Microsoft Intune post-provisioning.
  • Works seamlessly with both custom and gallery images.

3. Configure VPN Gateway Bypasses

To avoid disruptions in RDP sessions and optimize connectivity, configure specific IP address bypasses:

• Add the following IP addresses to the VPN Gateway Bypass field in ZScaler Client Connector App Profiles:
  1. 168.63.129.16: For Cloud PC health monitoring.
  2. 169.254.169.254: Azure Instance Metadata Service (IMDS).
  3. WindowsVirtualDesktop Service Tag: Includes all IP addresses associated with RDP traffic.

Note: Obtain the updated list of IP addresses from the Microsoft Download Center and automate updates using a PowerShell script.

4. Configure Strict Enforcement Mode

• Use an app policy with the bypass rules in the POLICYTOKEN tag to ensure uninterrupted connectivity when strict enforcement is enabled.
• This prevents users from losing access to Cloud PCs during login/logout or service toggling.

Preventing Common Issues

Session Freezes

• If bypasses are not configured, users may experience RDP session freezes when:
  • Logging in or out of ZScaler Client Connector.
  • Toggling ZScaler Internet Access (ZIA) services.
  • Restarting the ZIA service.

Access Loss in Strict Enforcement Mode

• Failing to apply the correct bypass rules can result in access loss.
• To mitigate this, test policies thoroughly and maintain a snapshot of Cloud PCs for recovery.

Best Practices

1. Synchronize IP Updates
   • Regularly update IP address bypasses using a PowerShell script to fetch the latest gateway addresses.
2. Test Configurations
   • Perform rigorous testing in a non-production environment before deploying ZScaler configurations.
3. Monitor and Optimize Traffic
   • Use ZScaler analytics tools to monitor and optimize performance.
4. Enable Strict Enforcement Carefully
   • Gradually roll out strict enforcement policies to avoid disruptions.

Final Thought

Integrating ZScaler Client Connector with Windows 365 Cloud PCs strengthens security and optimizes connectivity. By routing all traffic through ZScaler’s global infrastructure and applying the recommended bypass configurations, organizations can deliver a seamless, secure experience for their users.