u/Interesting_Pomelo32

Question for Zscaler ZPA users.

We are a company of 8k ZPA users, and trying to figure out the best practices for how we create persona's or groupings for our users.

We started with a 3rd party consultant who recommended we use SCIM attributes, which worked to an extent, but in a large corporation the simple attributes (organization,division) broke them up, but not enough granularity to get to a least privilege concept. We added additional attributes which gave us more granularity, but then the inevitable happened. A HR re-org, changed a bunch of the SCIM attributes completely messing up our access policies.

Anyone in a big corporation, what has worked well for you, or what would you recommend for new customers planning a ZPA deployment?