LICENSEWARE
Contribute

Zscaler Private Access licensing

From the LICENSEWARE WikiLast edited 9 ReferencesCited

This article is about licensing Zscaler Private Access (ZPA), including seats, ZPA Monthly Traffic, Privileged Remote Access systems, B2B and clientless access, and ZPA China Premium. For the vendor overview, see Zscaler licensing. It is not legal advice.

On This Page

Zscaler Private Access (ZPA) is Zscaler’s zero trust network access service. It connects users to private applications in data centres and public clouds without placing them on the network. Zscaler describes it as a SaaS product “that is licensed in various ways”.[1] Its primary metric is the seat, a subscription license for an individual authorized user. Seats are counted as unique individual users of ZPA over the previous rolling 90-day period.[1] A fair use policy compares average ZPA Monthly Traffic with a cloud-wide average.[1] ZPA also defines System (a Privileged Remote Access target), Site (Zero Trust SD-WAN) and Workload metrics, and ZPA China Premium is licensed by bandwidth.[1][5] ZPA is sold as a standalone platform and inside the Zscaler bundles. The data sheet gives the part numbers.[2]

Editions

The ZPA data sheet sets out four ways to buy private access.[2]

Option Part number App Segments Private access users Add-ons listed in the data sheet 
Zscaler Essentials Platform ZS-ESS-PLATFORM 10 1 user per 20 subscribed users (minimum 500 subscribed users) No VPN Service Edges or Business Continuity Cloud[2] 
ZPA Clientless Platform ZPA-CLIENTLESS-PLATFORM 20 Browser-based access for unmanaged devices Additional guest user licences are bought under this part number[2] 
Zscaler Private Access Platform ZS-ZPA-PLATFORM 20 Standalone ZPA VPN Service Edges (minimum 50 users); Business Continuity Cloud (minimum 500 users)[2] 
Zscaler Platform ZS-PLATFORM 20 Private Access for all users[4] VPN Service Edges (minimum 50 users); Business Continuity Cloud (minimum 500 users)[2] 

In every option, App Connectors are listed as “As many as required, up to system max”.[2] The Pricing and Plans page describes the Essentials entitlement as ZPA “for 5% of users”.[4] The ZIA and ZPA data sheets express it as 1 user per 20 subscribed users with a minimum of 500 subscribed users.[2][9] The Pricing and Plans page also lists a Private Access add-on with unlimited App Segments, AppProtection, ZPA for legacy apps (VoIP, server-to-client), ZPA Business Continuity and the ZPA Clientless Platform.[4] The ZPA for legacy apps add-on includes a VPN Service Edge entitlement that scales with user count, with three VPN Service Edges at 500 users or more.[4] Catalog proof: Essentials Platform limited to 10 App Segments; other ZPA options 20, Essentials Platform includes ZPA for 1 user per 20 subscribed users, Several products are sold standalone without a platform bundle.

Metrics

Zscaler name Catalog row Zscaler definition 
Seat Seat A subscription license for an individual authorized user, counted as unique individual users of ZPA over the previous rolling 90-day period[1] 
ZPA Monthly Traffic ZPA Monthly Traffic The total amount of traffic uploaded and downloaded via ZPA in a calendar month, measured in GB[1] 
System System Each system is equivalent to an RDP, SSH, VNC or RealVNC target that enables Privileged Remote Access (PRA)[1] 
Site Site A subscription for a site or location that enables Zero Trust SD-WAN[1] 
Workload Workload A unique domain name, an IP address, or a set of IP addresses[1] 
Light Customer User Light Customer User A Seat designated as a light or occasional user[6] 
Bandwidth Bandwidth (China Premium) Data processed by ZPA in a Zscaler Premium Data Center in China, in Mbps[5] 

Counting / floors

Rolling 90-day seat count (undated, retrieved 2026-09-26). ZPA seats are the unique individual users of ZPA over the previous rolling 90 days.[1] Under the EUSA, anyone the customer authorizes to use the service is an Authorized User, including contractors and other third parties.[8] Unlike ZIA, the ZPA article sets no cap on endpoints per seat.[1] Catalog proof: ZPA seats counted as unique users over a rolling 90-day period.

Fair use (undated, retrieved 2026-09-26). Average monthly traffic across all purchased seats “should be less than two times the cloud-wide average (currently 3 GB per seat per month)” plus any additional bandwidth entitlement. Traffic above that level requires a subscription for additional entitlements.[1] On current figures, the threshold is an average of 6 GB per purchased seat per month. Heavy use such as file-share synchronisation, backups or application-to-application flows over ZPA counts against it. Catalog proof: ZPA fair use: average monthly traffic below twice the cloud-wide average.

Light Customer Users (last updated 2025-08-15). Each ZPA Light Customer User has an allowance of 0.5 GB of monthly traffic. The same process as for ZIA applies above 10%: investigate, then reduce traffic, buy more, or upgrade, with invoicing possible after 90 days.[6] Catalog proof: Light Customer User allowances and remediation after 10% overage.

Per-seat add-ons (undated, retrieved 2026-09-26). Browser Isolation (Zero Trust Browser) and Source IP Anchoring are subscribed per seat, with a maximum aggregate amount of ZPA Monthly Traffic across all seats. ZPA B2B Federation, used for partner access, is also subscribed per seat.[1] Partner users reached through B2B therefore need seats. Catalog proof: Browser Isolation, SIPA and ZPA B2B Federation are subscribed per seat.

Privileged Remote Access (data sheet undated, retrieved 2026-09-26). PRA pricing “is based on the number of unique OT and IT systems (RDP, SSH, or VNC targets) secured”.[3] Standard PRA is limited to 10 target systems per ZPA tenant.[3] For every 10 PRA systems, the entitlement includes one pair of App Connectors. The fair use limit is 10 GB of data per system per month, pooled across the tenant.[3] The Pricing and Plans page describes Standard PRA as included with platform purchases of more than 500 users, with up to 1 GB of monthly data pooled across all systems.[4] It describes PRA Advanced as subscribed by number of systems, with emergency access for up to 100 users “not counted towards platform user count”.[4] Catalog proof: PRA systems include App Connectors and a pooled 10 GB per system fair use.

Compliance review (undated, retrieved 2026-09-26). Zscaler periodically reviews the number of seats, sites and workloads and the amount of monthly traffic to ensure license compliance.[1] Under the EUSA, usage above the Order must be purchased promptly.[8] Catalog proof: Usage above purchased quantities must be purchased promptly.

Virtualization & partitioning

ZPA App Connectors are virtual machines or containers deployed by the customer. They are not a licence metric: the data sheet allows as many as required up to the system maximum.[2] For the ZPA availability SLA to apply, at least two App Connectors are required at each customer site. If ZPA Private Service Edges are subscribed, at least two of those are required as well.[7] Applications that are unavailable because of a Private Service Edge in the customer’s network, which Zscaler does not control, are Excluded Applications for the SLA.[7] Server and workload traffic is licensed under the Workload metric, a unique domain name, IP address or set of IP addresses.[1]

Cloud / BYOL

ZPA is delivered from Zscaler’s cloud. It has no BYOL model. ZPA China Premium is licensed by purchased bandwidth. Five-minute receive and transmit samples from each Premium Data Center in China are sorted, the 95th percentile is taken, the larger of the two directions is used, and the results are summed across data centres.[5] Bursting above purchased bandwidth is allowed for up to 5% of the month, “approximately 36 hours” in a 30-day month. The peak may not exceed 130% of the purchased bandwidth, and the availability agreement does not apply beyond those limits.[5] Catalog proof: ZPA China Premium: 95th percentile billing allows about 36 hours of burst.

Programs

Out of scope

  • ZPA list prices and the legacy ZPA Business, Transformation and Unlimited editions. The PRA data sheet still names these editions, but no current edition comparison was retrieved.[3]
  • ZPA for Government (FedRAMP) data sheets and terms.
  • AppProtection, Deception and data protection feature details, beyond their listing as add-ons.

Catalog rows

Catalog rows for this article, grouped by table.

References

  1. ZPA Licensing and Fair UseZscaler Help Portal (help.zscaler.com). License Types; Fair Use Policy. Undated.Retrieved 2026-09-26.
  2. Zscaler Private Access data sheetMultiple Options to get Started table, p.8. ©2025, undated.Retrieved 2026-09-26.
  3. Zscaler Privileged Remote Access data sheetLicensing section. Undated.Retrieved 2026-09-26.
  4. Pricing and PlansAdd-ons 02 Private Access; 06 Privileged Remote Access. Undated.Retrieved 2026-09-26.
  5. ZPA China Premium Service Licensing and Fair UseZscaler Help Portal. Undated.Retrieved 2026-09-26.
  6. Zscaler Light Users Product SheetsZPA Light Customer User allowance.Effective 2025-08-15. Retrieved 2026-09-26.
  7. Service Level Agreements and Support Service§1.4 Excluded Applications; §2.1; ZPA Service Availability Agreement.Effective 2026-09-21. Retrieved 2026-09-26.
  8. End User Subscription Agreement§1 Authorized User; §4.2.Effective 2026-08-01. Retrieved 2026-09-26.
  9. Zscaler Internet Access data sheetPrivate Access (ZPA) row. ©2026, undated.Retrieved 2026-09-26.

See also

Esc