Android is a supported operating system for the Zscaler App. Some Chrome OS devices support native Android applications, and in these instances, the Zscaler App can be installed and will forward traffic for other applications on that device. As the Android operating system running on these devices differs slightly from a real physical Android device, it’s recommended to test specific applications to ensure they can run in this environment.
There are roughly three categories of how Zscaler works on Chromebooks:
Early Chromebooks with no Android support
ZIA through PAC file only. Deploy a PAC to the browser, and users traffic will go through. Of course, unless it’s locked down the user can change/disable the proxy settings
Chromebooks with sandboxed Android support
Essentially running an Android emulator, but completely sandboxed from ChromeOS. Traffic generated in the Android VM was separated from ChromeOS traffic.
You can install Android Z App in this Android VM, but it will only capture traffic from Android apps, not Chrome OS apps.
Chromebooks with full Android support
Android app traffic is no longer separated from ChromeOS app traffic.
You can install Android Z App into Android, and Chrome OS browser traffic will flow through the VPN plugin we install. This means ZIA + ZPA will work for Chrome OS browser tabs as long as the Android Zscaler app is running.
In field testing of the integrated Android support, we’ve seen that it works for ZPA not only for web apps, but also for SSH and RDP…
Some useful resources and notes:
Google Play store / Android app support was introduced in Chrome OS starting in the developer channel with M53 (May 2016) for certain devices - see https://blog.google/products/chromebooks/the-google-play-store-coming-to/ - and in the stable channel starting with build 59 (June 2017).
Chrome OS only supports Android apps on specific hardware: https://www.chromium.org/chromium-os/chrome-os-systems-supporting-android-apps
Devices that are managed centrally can be configured to force install apps. This is all done via Google admin console. Managed devices may have policy set in Google admin console to either not allow installation of Android apps, or whitelist which apps can be installed. If you have supported hardware on the above list and do not see Google Play Store on the Chromebook, you need to configure the policy to allow it in the Google admin console.
For unmanaged devices, here are the instructions to enable Android app installation: https://support.google.com/chromebook/answer/7021273