get_zpa_scim_group(search="<group_name>")```text
Note both the SCIM group ID (used as `rhs`) and the Identity Provider ID (used as `lhs`).
**For SAML attributes:**
```textget_zpa_saml_attribute(search="<attribute_name>")```text
Note the SAML attribute ID (used as `lhs`). The `rhs` is the value to match (e.g., an email address or group name string).
**For SCIM attributes:**
```textget_zpa_scim_attribute(search="<attribute_name>")```text
**For segment groups (APP_GROUP):**
```textzpa_list_segment_groups()```text
**For posture profiles:**
```textget_zpa_posture_profile(search="<profile_name>")```text
Note the `posture_udid` value (used as `lhs`).
**For trusted networks:**
```textget_zpa_trusted_network(search="<network_name>")```text
Note the `network_id` value (used as `lhs`).
---
### Step 3: Build the Conditions Payload
Conditions use a list of dictionaries. Each dictionary represents one condition block with an `operator` and `operands`. **Separate condition blocks for each object type.**
**Format:**
```json[ { "operator": "OR", "operands": [ { "object_type": "<OBJECT_TYPE>", "values": ["<id1>", "<id2>"] } ] }, { "operator": "OR", "operands": [ { "object_type": "<OBJECT_TYPE>", "entry_values": [ {"lhs": "<lhs_value>", "rhs": "<rhs_value>"} ] } ] }]```text
**Rules:**
- Each condition block contains **one object type only**- Multiple condition blocks are **ANDed** together (all must match)- Within a block, multiple `entry_values` or multiple `values` are **ORed** (any can match)- Value-based types (`APP`, `APP_GROUP`, `CLIENT_TYPE`, etc.) use `values`- Entry-based types (`SAML`, `SCIM_GROUP`, `PLATFORM`, etc.) use `entry_values`
---
### Step 4: Create the Rule
```textzpa_create_access_policy_rule( name="<rule_name>", action_type="ALLOW", description="<description>", conditions=<conditions_payload>, app_connector_group_ids=["<optional_connector_group_ids>"], app_server_group_ids=["<optional_server_group_ids>"])```text
---
### Step 5: Verify
```textzpa_get_access_policy_rule(rule_id="<returned_rule_id>")```text
---
## Ready-to-Use Examples
### Example 1: Allow SCIM Groups to Access a Segment Group
Allow members of "Engineering" or "DevOps" SCIM groups to access an application segment group.
**Step 1: Look up IDs**
```textget_zpa_scim_group(search="Engineering")get_zpa_scim_group(search="DevOps")zpa_list_segment_groups()```text
**Step 2: Create rule**
```textzpa_create_access_policy_rule( name="Allow Engineering and DevOps", action_type="ALLOW", description="Grants Engineering and DevOps teams access to internal apps", conditions=[ { "operator": "OR", "operands": [ { "object_type": "APP_GROUP", "values": ["<segment_group_id>"] } ] }, { "operator": "OR", "operands": [ { "object_type": "SCIM_GROUP", "entry_values": [ {"lhs": "<idp_id>", "rhs": "<engineering_scim_group_id>"}, {"lhs": "<idp_id>", "rhs": "<devops_scim_group_id>"} ] } ] } ])```text
**Logic:** User must be in the segment group's apps AND be a member of Engineering OR DevOps.
---
### Example 2: Allow SAML Users with Platform Restriction
Allow specific SAML-identified users, but only from macOS and Windows devices.
**Step 1: Look up SAML attribute**
```textget_zpa_saml_attribute(search="Email_Users")```text
**Step 2: Create rule**
```textzpa_create_access_policy_rule( name="Allow Specific Users on Mac/Windows", action_type="ALLOW", conditions=[ { "operator": "OR", "operands": [ { "object_type": "SAML", "entry_values": [ {"lhs": "<saml_email_attribute_id>", "rhs": "[email protected]"}, {"lhs": "<saml_email_attribute_id>", "rhs": "[email protected]"} ] } ] }, { "operator": "OR", "operands": [ { "object_type": "PLATFORM", "entry_values": [ {"lhs": "mac", "rhs": "true"}, {"lhs": "windows", "rhs": "true"} ] } ] } ])```text
**Logic:** User must match a SAML email AND be on macOS OR Windows.
---
### Example 3: Country-Based Access Restriction
Allow access only from the United States and Canada.
```textzpa_create_access_policy_rule( name="US and Canada Only", action_type="ALLOW", description="Restrict access to US and Canadian locations", conditions=[ { "operator": "OR", "operands": [ { "object_type": "APP_GROUP", "values": ["<segment_group_id>"] } ] }, { "operator": "OR", "operands": [ { "object_type": "COUNTRY_CODE", "entry_values": [ {"lhs": "US", "rhs": "true"}, {"lhs": "CA", "rhs": "true"} ] } ] } ])```text
---
### Example 4: Posture-Based Access with Risk Factor
Allow access only from devices that pass a posture check and have a ZIA risk score of LOW or below.
**Step 1: Look up posture profile**
```textget_zpa_posture_profile(search="CrowdStrike_ZTA")```text
**Step 2: Create rule**
```textzpa_create_access_policy_rule( name="Posture and Risk Check", action_type="ALLOW", conditions=[ { "operator": "OR", "operands": [ { "object_type": "POSTURE", "entry_values": [ {"lhs": "<posture_udid>", "rhs": "true"} ] } ] }, { "operator": "OR", "operands": [ { "object_type": "RISK_FACTOR_TYPE", "entry_values": [ {"lhs": "ZIA", "rhs": "UNKNOWN"}, {"lhs": "ZIA", "rhs": "LOW"} ] } ] } ])```text
**Logic:** Device must pass posture check AND have a ZIA risk score of UNKNOWN or LOW.
---
### Example 5: Combined SCIM + SAML + Platform + Country
A comprehensive rule combining identity, device, and location conditions.
```textzpa_create_access_policy_rule( name="Comprehensive Access Rule", action_type="ALLOW", description="Engineering team, Mac/Linux only, from US/CA", conditions=[ { "operator": "OR", "operands": [ { "object_type": "APP_GROUP", "values": ["<segment_group_id>"] } ] }, { "operator": "OR", "operands": [ { "object_type": "SCIM_GROUP", "entry_values": [ {"lhs": "<idp_id>", "rhs": "<engineering_group_id>"} ] }, { "object_type": "SAML", "entry_values": [ {"lhs": "<saml_email_attr_id>", "rhs": "[email protected]"} ] } ] }, { "operator": "OR", "operands": [ { "object_type": "PLATFORM", "entry_values": [ {"lhs": "mac", "rhs": "true"}, {"lhs": "linux", "rhs": "true"} ] } ] }, { "operator": "OR", "operands": [ { "object_type": "COUNTRY_CODE", "entry_values": [ {"lhs": "US", "rhs": "true"}, {"lhs": "CA", "rhs": "true"} ] } ] } ])```text
**Logic:** Must access apps in the segment group AND (be in Engineering SCIM group OR be <[email protected]>) AND (be on macOS OR Linux) AND (be in US OR Canada).
---
### Example 6: Deny Rule
Block access from specific platforms.
```textzpa_create_access_policy_rule( name="Deny Android and iOS", action_type="DENY", description="Block mobile device access to sensitive applications", conditions=[ { "operator": "OR", "operands": [ { "object_type": "APP_GROUP", "values": ["<sensitive_apps_segment_group_id>"] } ] }, { "operator": "OR", "operands": [ { "object_type": "PLATFORM", "entry_values": [ {"lhs": "android", "rhs": "true"}, {"lhs": "ios", "rhs": "true"} ] } ] } ])```text
---
## Edge Cases
### No Conditions (Global Rule)
A rule with no conditions applies to all users and all applications:
```textzpa_create_access_policy_rule( name="Default Allow All", action_type="ALLOW", conditions=[])```text
### Mixing SAML and SCIM in the Same Condition Block
SAML and SCIM_GROUP operands can share a condition block since they are identity types. They are ORed within the block:
```json{ "operator": "OR", "operands": [ { "object_type": "SAML", "entry_values": [{"lhs": "<saml_attr_id>", "rhs": "[email protected]"}] }, { "object_type": "SCIM_GROUP", "entry_values": [{"lhs": "<idp_id>", "rhs": "<scim_group_id>"}] } ]}```text
### Trusted Network Condition
```json{ "operator": "OR", "operands": [ { "object_type": "TRUSTED_NETWORK", "entry_values": [{"lhs": "<network_id>", "rhs": "true"}] } ]}```text
---
## Quick Reference
**Tools used:**
- `get_zpa_scim_group(search)` -- look up SCIM group IDs- `get_zpa_saml_attribute(search)` -- look up SAML attribute IDs- `get_zpa_scim_attribute(search)` -- look up SCIM attribute IDs- `get_zpa_posture_profile(search)` -- look up posture profile UDIDs- `get_zpa_trusted_network(search)` -- look up trusted network IDs- `zpa_list_segment_groups()` -- look up segment group IDs- `zpa_create_access_policy_rule(name, action_type, conditions, ...)` -- create the rule- `zpa_get_access_policy_rule(rule_id)` -- verify the rule
**Condition logic:**
- Multiple condition blocks = AND (all must match)- Multiple entry_values within a block = OR (any can match)- Separate condition blocks per object type
**Actions:** `ALLOW`, `DENY`, `REQUIRE_APPROVAL`
