---
title: 🧩 How to Merge ZIA and ZPA Tenants in Zscaler + What to Expect for End Users
description: If your organization first deployed Zscaler Private Access (ZPA) and is now adding Zscaler Internet Access (ZIA), you’ll need to merge the tenants to enable unified management. This guide explains the merge process, user experience
---

[Skip to content](https://securedynamics.net/kb/how-to-merge-zia-and-zpa-tenants-in-zscaler#main-content)

English

Show submenu for translations

![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- Go to securedynamics.net

 Go to securedynamics.net

 Hello. How can we help you?

- There are no suggestions because the search field is empty.

1. [SecureDynamics Knowledge Base](https://securedynamics.net/kb?hsLang=en)
2. [Support](https://securedynamics.net/kb/support?hsLang=en)

# 🧩 How to Merge ZIA and ZPA Tenants in Zscaler + What to Expect for End Users

## If your organization first deployed Zscaler Private Access (ZPA) and is now adding Zscaler Internet Access (ZIA), you’ll need to merge the tenants to enable unified management. This guide explains the merge process, user experience

 

> ✅ **SecureDynamics provides white glove support** through this process.

---

#### 🧭 Overview: Why Merge ZIA and ZPA Tenants?

ZPA and ZIA are provisioned as **separate tenants** by default. Merging them:

- Enables **centralized policy and user management**
- Provides **unified logging and diagnostics**
- Streamlines **Client Connector behavior**
- Prevents duplicated user management and policy drift

---

#### 🔄 Step-by-Step: How to Merge ZIA and ZPA Tenants

### 1. Prepare Your Environment

Before initiating a merge, sync all **ZPA users into ZIA** to avoid post-merge auth errors.

**Example: SCIM with Azure AD**

1. In the **ZIA Admin Portal**:
   
     - Go to `Administration > Authentication > SCIM Configuration`
     - Enable SCIM provisioning
2. In **Azure AD**:
   
     - Go to `Enterprise Applications > Zscaler Internet Access`
     - Set Provisioning to **Automatic**
     - Assign users/groups already configured for ZPA
3. Test sync and confirm users appear under `ZIA > Administration > Users`

> For Okta or Ping: Follow [Zscaler’s SCIM provisioning guide](https://help.zscaler.com/).

### 2. Submit a Merge Request

- Open a **Support Case** with Zscaler
- Include:
  
    - ZIA and ZPA **tenant IDs**
    - Company name and contact info

### 3. Zscaler Performs the Merge

Zscaler’s Provisioning Team will:

- Validate tenant ownership
- Merge backend systems
- Sync users, roles, SSO, and profiles

### 4. Validate Access & Forwarding Profiles

Once notified:

- Log into **Mobile Admin Portal**
- Ensure both ZIA + ZPA are active
- Go to `Administration > Forwarding Profile`
- Set **ZIA Forwarding Action** to **“None”** for:
  
    - Trusted Network
    - VPN Trusted Network
    - Off Trusted Network

> This prevents ZIA policies from immediately impacting ZPA users post-merge.
> 
> ![Screenshot](https://securedynamics.net/hs-fs/hubfs/Screenshot.jpg?width=688&height=580&name=Screenshot.jpg)

### 5. Final Testing

- Validate ZIA functionality
- Confirm user sync
- Notify Zscaler Support of any issues

### 6. Begin ZIA Rollout

- Create a **new Forwarding Profile** for ZIA access
- Assign select groups for phased rollout
- Update your main profile once ready for full production use

---

#### 👥 What Users Will Experience

### 🔐 Authentication Prompt After Merge

When ZIA is introduced via ZCC after ZPA, users will typically be prompted to sign in again.

#### Why?

- Separate **SAML authentication flow**
- ZIA performs new **device fingerprint validation**
- Different **SSO configurations**

#### Common Scenarios:

- **Reauthentication required** in ZCC
- `42000` error for mismatched usernames
- Device fingerprint rejection (triggering `BRK_MT_AUTH_SAML_FINGER_PRINT_FAIL`)

> 🔁 **Ask users to log out and back into ZCC** after merge to avoid auth loops

---

#### ⚠️ Important Notes

| Consideration | Details |
| --- | --- |
| Merge Timeline | Usually takes **2–5 business days** |
| Policy Gaps | Review policies manually post-merge |
| End-User Impact | Minimal if ZIA Forwarding Action is set to “None” initially |
| Trusted Network Settings | Must be validated for ZIA profiles |

---

#### 📘 Additional Resources

- SCIM Provisioning for Zscaler
- [ZPA Authentication Errors](https://help.zscaler.com/client-connector/zscaler-client-connector-zpa-authentication-errors)

---

#### 💬 Need Help?

📨 [Submit a Ticket to SecureDynamics Support](https://cm360.securedynamics.net/support?hsLang=en)

- [FAQs](https://securedynamics.net/kb/faqs?hsLang=en)
- [Troubleshooting](https://securedynamics.net/kb/troubleshooting?hsLang=en#main-content)

    - [Client Connector Portal](https://securedynamics.net/kb/troubleshooting?hsLang=en#client-connector-portal)
    - [Zscaler Client Connector](https://securedynamics.net/kb/troubleshooting?hsLang=en#zscaler-client-connector)
- [Support](https://securedynamics.net/kb/support?hsLang=en)
- [SecureDynamics Internal](https://securedynamics.net/kb/securedynamics-internal?hsLang=en)
- [Licensing](https://securedynamics.net/kb/licensing?hsLang=en#main-content)

    - [ZIA Upgrades](https://securedynamics.net/kb/licensing?hsLang=en#zia-upgrades)
- [Education & Training](https://securedynamics.net/kb/education-training?hsLang=en)
- [Delivery Services](https://securedynamics.net/kb/delivery-services?hsLang=en)
- [Partner Help](https://securedynamics.net/kb/partner-help?hsLang=en)

[![SecureDynamics Zscaler Logo](https://securedynamics.net/hs-fs/hubfs/SecureDynamics%20Logo%20Dark-1.png?width=1250&height=296&name=SecureDynamics%20Logo%20Dark-1.png "SecureDynamics Zscaler Logo")](https://cm360.securedynamics.net?hsLang=en)

securedynamics.net Help Center

Copyright © 2026, SecureDynamics

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securedynamics.net/#organization",
  "@type" : "Organization",
  "address" : {
    "@type" : "PostalAddress",
    "addressCountry" : "US",
    "addressLocality" : "Santa Clara",
    "addressRegion" : "CA",
    "postalCode" : "95054",
    "streetAddress" : "5201 Great America Pkwy, Suite 320"
  },
  "logo" : {
    "@type" : "ImageObject",
    "url" : "https://securedynamics.net/hubfs/SecureDynamics%20Zscaler%20Logo-1.webp"
  },
  "name" : "SecureDynamics",
  "sameAs" : [ "https://www.linkedin.com/company/3626024/" ],
  "url" : "https://securedynamics.net/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securedynamics.net/#website",
  "@type" : "WebSite",
  "inLanguage" : "en-US",
  "name" : "SecureDynamics",
  "potentialAction" : {
    "@type" : "SearchAction",
    "query-input" : "required name=search_term_string",
    "target" : {
      "@type" : "EntryPoint",
      "urlTemplate" : "https://securedynamics.net/hs-search-results?q={search_term_string}"
    }
  },
  "publisher" : {
    "@id" : "https://securedynamics.net/#organization"
  },
  "url" : "https://securedynamics.net/"
}
```