Create a ZPA Access Policy rule that gates access to a private application on multiple combined checks: identity (SCIM group / SAML), one or more named device posture profiles (associated by UDID; ZPA does not introspect what each profile checks), platform reported by ZCC, country, and risk-score level.
Install
npx skills add zscaler/zscaler-mcp-server --skill zpa-create-conditional-access-rulenpx skills add zscaler/zscaler-mcp-server --skill zpa-create-conditional-access-rule -a claude-code -gnpx skills add zscaler/zscaler-mcp-server --skill zpa-create-conditional-access-rule -a codex -ggemini skills install https://github.com/zscaler/zscaler-mcp-server.git --path skills/zpa/create-conditional-access-rulegh skill install zscaler/zscaler-mcp-server zpa-create-conditional-access-rulegit clone --depth 1 https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler__zscaler-mcp-server
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/zscaler__zscaler-mcp-server/skills/zpa/create-conditional-access-rule ~/.claude/skills/zpa-create-conditional-access-rule # Claude Code
cp -R /tmp/zscaler__zscaler-mcp-server/skills/zpa/create-conditional-access-rule ~/.agents/skills/zpa-create-conditional-access-rule # Codex, Cursor, Gemini CLI, Copilot, OpenCode