I would suggest having the installer run as a "first login" kind of process.  We are just starting our deployment of Zscaler.  For our systems it will not be installed until after the normal setup process is complete.

I am looking for an EA that can determine if the user logged in vs just the app is installed to try and help with this, then scope it to enrollment older than 2 days.  No luck yet on the EA

@swapple Try this:  Someone just sent it to me.  Haven't tested yet.  

#!/bin/sh

# Get Current User
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name && ! /loginwindow/ { print $3 }' )

# Query and save the value; suppress any error message, if key not found.
checkZscaler=$(/usr/libexec/PlistBuddy -c 'print ":lZts"' /Users/$loggedInUser/Library/Preferences/com.zscaler.Zscaler.plist 2>/dev/null)

# Save the exit code, which indicates success v. failure
exitCode=$?

if (( exitCode == 0 ))
then
echo "<result>Authenticated</result>"
else
echo "<result>Not Authenticated</result>"
fi

I found this one as well...starting a ZScaler setup myself:

#!/bin/sh

#

# Jamf EA to determine Zscaler logged in status

# 

# For version 3.4 Logs are stored in /Library/Application Support/Zscaler

#

ztstatus=(/private/var/log/zscaler/ztstatus*)

if [[ -f "$ztstatus" ]]; then

  echo "<result>Logged Into Zscaler</result>"

else

  echo "<result>Not Logged Into Zscaler</result>"

fi

I also think based on limited testing that not having it install at enrollment might be a good idea.  If they don't sign in, they don't get anything - and I saw this when I had a recon run at the end of the install for ZScaler - I got SSH errors trying to run recon.

So I took that out of the policy and it seems to at least install OK, but having to login s*cks...

@scottb Thank you for this, I was able to get it to work with the 3.4 version, but for 2.1 neither path seems to have any ztstatus files.

@DBrowning I tried yours too, it always returns false.  Did you have to do any tweaks to it?

@ImAMacGuy - looks like only "3.6, 3.4, 3.2, 3.0" are supported in macOS.  It's working here on 3.6.0.53.

Zscaler Supported Versions 

yeah, the 3.x one is working, but we have a smaller subset of users on 10.13 that we are deploying to, but if there's no easy way to tweak, then so be it.  Just wasn't sure if anybody had an older version laying around.  

#!/bin/sh

#

# Jamf EA to determine Zscaler logged in status

# 

# For version 3.4 Logs are stored in /Library/Application Support/Zscaler

#

ztstatus=(/private/var/log/zscaler/ztstatus*)

if [[ -f "$ztstatus" ]]; then

  echo "<result>Logged Into Zscaler</result>"

else

  echo "<result>Not Logged Into Zscaler</result>"

fi

that folder is not appearing in some of our deployments where we know the user is logged in.

has anyone had success with curl? Seems macOS generic.

this seems a little over kill

Anyone find anything useful..