Zscaler Client Connector one-time passwords: log out or turn off ZIA
When your app profile protects logging out of Zscaler Client Connector, or turning ZIA, ZPA or ZDX off, the user needs a password to do it. Rather than share a static password, an admin can give them a one-time password for that one device. Each device has its own set of codes, one per action, listed with the device in the Client Connector Portal.
Which code unlocks what
| Code | Lets the user | Typical reason |
|---|---|---|
| Logout | Log out of Client Connector | Signing in as a different user, re-enrolment, a stuck session |
| ZIA disable | Turn Internet Security off | Troubleshooting whether Zscaler is behind a site or app problem, a captive portal |
| ZPA disable / ZDX disable | Turn Private Access or Digital Experience off | Isolating a private app or monitoring issue |
| Exit | Quit Client Connector entirely | Rare: troubleshooting the client itself |
| Uninstall / Revert | Remove Client Connector, or roll it back a version | Reinstalls and bad upgrades |
| Anti-tampering disable | Turn off tamper protection | Very rare, and worth a second approval |
The codes only matter when your app profile asks for a password for that action. If it doesn't, the user can already do it without one.
Get a code from the Client Connector Portal
- Confirm who you're talking to. The person asking for a code to turn security off is exactly who an attacker would pretend to be.
- In the Client Connector Portal, open Enrolled Devices and search for the user.
- Pick the device they're actually using. Codes belong to one device, and users often have more than one enrolled.
- Open the device's details and read out the code for the action they need, and only that one.
- The user enters it in Client Connector: Logout for the logout code, or Turn Off on the Internet Security, Private Access or Digital Experience tab for a disable code.
Handle them like passwords
- Verify the caller. A ZIA disable code turns off web protection on that laptop. A helpdesk call is a classic social-engineering route to get it.
- Give the narrowest code. Turning ZIA off for a test is very different from an uninstall or anti-tampering code.
- Don't paste codes into tickets or chat channels. Ticket histories and channels are searchable for years.
- Agree when protection comes back. Ask the user to turn the service back on once the test is done, and check the device afterwards.
- Keep a record of who handed out which code, without the code itself.
How Zmate does this from Slack
/zmate otp user@company.com zia-off (or logout, zpa-off, zdx-off, exit, uninstall) finds the user's Client Connector device and returns just that code. If they have several devices, you pick one from a list. The code is shown only to you and isn't saved in Slack, and the channel gets a note saying who fetched which code for whom, without the code. Only Zmate admins can fetch codes. Codes that turn a service off come back straight away; the rest need your MFA code first.
FAQ
- Where do I find the Zscaler Client Connector logout password for a user?
- In the Client Connector Portal, open Enrolled Devices, find the user's device and open its details. The device's one-time passwords, including the logout code, are listed there. Your app profile may also set a static logout password, which is the same for every device it applies to.
- Is a Zscaler Client Connector one-time password the same on every device?
- No. One-time passwords belong to one enrolled device, so the code for a user's laptop won't work on their phone or on anyone else's machine. Look up the exact device the user is sitting at.
- Can I get a Zscaler Client Connector OTP without opening the portal?
- Yes. With Zmate, /zmate otp user@company.com zia-off returns the code in Slack, shown only to the admin who asked.