An administrator is provisioning new App Connectors in Microsoft Azure.

Option B addresses a documented App Connector prerequisite. App Connectors establish outbound TLS connections to ZPA infrastructure and validate the ZPA service through certificate pinning. An inline device that intercepts TLS substitutes its own certificate, causing certificate validation and registration to fail. Zscaler’s App Connector deployment prerequisites explicitly state that all inline or man-in-the-middle TLS interception must be disabled because the service enforces certificate pinning. The App Connector deployment guide repeats the same requirement. The Azure egress policy therefore needs a narrowly scoped inspection bypass for required ZPA destinations. A fixed NAT address is not the remedy for a certificate-pinning failure. Disabling health checks would reduce operational visibility and does not repair registration. Delaying scale-set activity or waiting for DNS TTL expiration also leaves TLS interception in the connection path.

================