Multi-IdP for ZIA

Can anyone confirm if ZIA supports multi-IdP? Our current configuration is with SAML using ADFS IdP with SAML Auto-Provisioning. We are transitioning to Azure AD with SCIM-Based Provisioning.

However, wanted to know if using on-prem ADFS IdP for user authentication and Azure AD for SCIM provisioning of users/groups is a supported configuration.

Hi Raj,

as of today this is not a supported configuration. Multi-IDP is available for ZPA but not fir ZIA. We may add it in the future.

Kind regards,

Steffen

Thanks for confirming.

Hi @Raj909 -

Actually what you asking for is possible with ZIA. It’s true that authenticating against two different SAML IDPs is not currently possible with ZIA. However it is possible to use one IDP for authentication and a different IDP (such as LDAP/SCIM) for provisioning in the same ZIA account.

In your case ADFS for SAML Auth, AzureAD for SCIM provisioning

Be mindful that the NameID used for SAML auth must match the NameID provisioned by SCIM for this to work. Also be aware that if you leave ADFS auto-provisioning as enabled it will overwrite SCIM provisioned attributes which could lead to duplication or unnecessary userDB writes.

Certainly would recommend testing in a non-prod / Beta environment first before rolling out into prod. Work with your Zscaler team to get a non-prod / Beta account if you don’t have one already.

Hi Nick,

Thanks for your response and confirming that it is possible. We have a beta cloud where Azure AD / SCIM configuration is setup already. We’ll test out this new configuration before moving to prod.

Appreciate it.

Successfully confirmed this is working in our Beta cloud. Thanks

Is it a seamless transition when changing the SAML IdP from ADFS auto-provisioning to SCIM auto-provisioning? We have users and groups in the directory so just curious about any duplicates being generated or any other potential pitfalls to be aware of.

Hi,
I understand that the original thread was about ADFS/Azure/SAML.

Would work Kerberos Authentication with two differed DC/KDC?

Best regards
Andreas