zscaler/zscaler-mcp-server/create-timeout-policy-rule

Name: create-timeout-policy-rule
Author: zscaler

Claude Code and agent skill by zscaler/zscaler-mcp-server

Trust tier 2

community

LLM review pending

By zscaler
Integration
zscaler/zscaler-mcp-server
skills/zpa/create-timeout-policy-rule/SKILL.md
Updated 22 Sep 2026
Version 1.0.01 version recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

Create ZPA timeout policy rules that control session re-authentication and idle timeout behavior. Configures how long a user session remains active (reauth_timeout) and how long an idle session persists (reauth_idle_timeout) before requiring re-authentication. Supports conditions: APP, APP_GROUP, CLIENT_TYPE, SAML, SCIM, SCIM_GROUP, PLATFORM, and POSTURE. Use when an administrator asks: 'Set session timeout', 'Configure idle timeout', 'Require re-authentication after X hours', or 'Set different timeouts per app or user group.'

Install

npx vskill@latest install zscaler/zscaler-mcp-server/create-timeout-policy-rule

SKILL.md

ZPA: Create Timeout Policy Rule

Keywords

timeout policy, session timeout, idle timeout, reauth timeout, re-authentication, session expiry, idle disconnect, timeout rule, session duration, zpa timeout, reauth policy

Overview

Create ZPA timeout policy rules that define session re-authentication and idle timeout behavior. Timeout policies control how long a user's authenticated session remains valid and how long an idle connection persists before requiring re-authentication. Different applications and user groups can have different timeout values.

Use this skill when: An administrator asks to configure session timeouts, set idle disconnect timers, require re-authentication after a specific period, or apply different timeout rules to different applications or user groups.

Timeout Parameters

`reauth_timeout` (Session Timeout)

How long a user session remains valid before requiring re-authentication, regardless of activity.

Value Format	Examples	Description
`<number> Minutes`	`"30 Minutes"`, `"60 Minutes"`	Session expires after N minutes
`<number> Hours`	`"4 Hours"`, `"8 Hours"`	Session expires after N hours
`<number> Days`	`"1 Days"`, `"10 Days"`, `"30 Days"`	Session expires after N days
`Never`	`"Never"`	Session never expires (not recommended for sensitive apps)

Minimum: 10 minutes. Default: "172800" (seconds, i.e., 2 days).

`reauth_idle_timeout` (Idle Timeout)

How long an idle (inactive) connection persists before the session is terminated.

Value Format	Examples	Description
`<number> Minutes`	`"10 Minutes"`, `"30 Minutes"`	Idle session expires after N minutes
`<number> Hours`	`"1 Hours"`, `"2 Hours"`	Idle session expires after N hours
`<number> Days`	`"1 Days"`	Idle session expires after N days
`Never`	`"Never"`	Idle sessions never expire

Minimum: 10 minutes. Default: "600" (seconds, i.e., 10 minutes).

Action

The only supported action is RE_AUTH -- when the timeout is reached, the user must re-authenticate.

Baseline Values (recommended)

Reference: ZPA Baseline Recommendations v1.0 §Timeout Policies Recommendations.

Authentication timeout (`reauth_timeout`)

Profile	Value	Rationale
Default — high-security environment	`"24 Hours"`	Daily MFA / SSO revalidation.
Default — convenience-focused	`"3 Days"` to `"7 Days"`	Lower friction for low-risk tenants.
Service accounts (documented exception)	`"30 Days"` or `"Never"`	Only with explicit security exception and inventory tracking.

Apply a single global authentication-timeout rule and add narrow per-group exceptions only when justified.

Idle timeout (`reauth_idle_timeout`) — per app class

App class	Value	Why
Non-sensitive apps	`"15 Minutes"` to `"30 Minutes"`	Frees connector resources, low security risk.
Sensitive apps (Finance, HR, regulated)	`"10 Minutes"` to `"15 Minutes"`	Tighter idle window for crown-jewel apps.
Long-lived sessions (RDP, SSH, DB)	`"30 Minutes"` to `"60 Minutes"`	Avoids dropping interactive shells mid-session.
Background services / API agents / monitoring	`"Never"`	Disable idle so automated clients don't reconnect on every poll.

Anti-pattern: Avoid reauth_idle_timeout below "10 Minutes" — causes constant tunnel reconnects and poor user experience.

Condition Object Types

Timeout policies support a subset of condition types.

Value-Based (use `values`)

Object Type	Description	Values
`APP`	Application segments	Application segment IDs
`APP_GROUP`	Segment groups	Segment group IDs
`CLIENT_TYPE`	Client connector type	`zpn_client_type_zapp`, `zpn_client_type_exporter`, `zpn_client_type_browser_isolation`, `zpn_client_type_ip_anchoring`, `zpn_client_type_edge_connector`, `zpn_client_type_branch_connector`, `zpn_client_type_zapp_partner`

Entry-Values Based (use `entry_values` with `lhs`/`rhs`)

Object Type	LHS	RHS
`SAML`	SAML attribute ID	Attribute value to match
`SCIM`	SCIM attribute header ID	Attribute value to match
`SCIM_GROUP`	Identity Provider ID	SCIM group ID
`PLATFORM`	`linux`, `android`, `ios`, `mac`, `windows`	`"true"` or `"false"`
`POSTURE`	Posture profile `posture_udid`	`"true"` or `"false"`

Workflow

Step 1: Gather Requirements

Ask the administrator:

Required:

Rule name
Session timeout value (e.g., "8 Hours", "30 Days", "Never")
Idle timeout value (e.g., "30 Minutes", "1 Hours", "Never")

Optional:

Description
Which applications or segment groups to scope to
Which users/groups this applies to
Platform restrictions
Posture requirements

Common scenarios:

"Sessions should expire after 8 hours for all apps" -> global timeout rule
"Sensitive apps should have a 30-minute idle timeout" -> scoped to APP_GROUP
"Contractors should re-authenticate every 4 hours" -> scoped to SCIM_GROUP
"Mobile devices should have shorter timeouts" -> scoped to PLATFORM

Step 2: Look Up Required IDs

For application scoping:

text

zpa_list_segment_groups()
zpa_list_application_segments()

For identity conditions:

text

get_zpa_scim_group(search="<group_name>")
get_zpa_saml_attribute(search="<attribute_name>")

For posture profiles:

text

get_zpa_posture_profile(search="<profile_name>")

Step 3: Create the Rule

text

zpa_create_timeout_policy_rule(
  name="<rule_name>",
  action_type="RE_AUTH",
  reauth_timeout="<session_timeout>",
  reauth_idle_timeout="<idle_timeout>",
  description="<description>",
  conditions=<conditions_payload>
)

Step 4: Verify

text

zpa_get_timeout_policy_rule(rule_id="<returned_rule_id>")

Ready-to-Use Examples

Example 1: Standard Timeout for a Segment Group

Set 8-hour session timeout and 30-minute idle timeout for internal applications.

Step 1: Find the segment group

text

zpa_list_segment_groups()

Step 2: Create rule

text

zpa_create_timeout_policy_rule(
  name="Standard Timeout - Internal Apps",
  action_type="RE_AUTH",
  reauth_timeout="8 Hours",
  reauth_idle_timeout="30 Minutes",
  description="Standard session and idle timeouts for internal applications",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "APP_GROUP",
          "values": ["<internal_apps_segment_group_id>"]
        }
      ]
    }
  ]
)

Example 2: Strict Timeout for Sensitive Applications

Short session timeout (4 hours) and aggressive idle timeout (10 minutes) for sensitive apps.

text

zpa_create_timeout_policy_rule(
  name="Strict Timeout - Sensitive Apps",
  action_type="RE_AUTH",
  reauth_timeout="4 Hours",
  reauth_idle_timeout="10 Minutes",
  description="Short timeouts for sensitive/high-security applications",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "APP_GROUP",
          "values": ["<sensitive_apps_segment_group_id>"]
        }
      ]
    }
  ]
)

Example 3: Contractor-Specific Timeout

Contractors must re-authenticate every 4 hours with a 15-minute idle timeout.

Step 1: Look up contractor group

text

get_zpa_scim_group(search="Contractors")

Step 2: Create rule

text

zpa_create_timeout_policy_rule(
  name="Contractor Timeout",
  action_type="RE_AUTH",
  reauth_timeout="4 Hours",
  reauth_idle_timeout="15 Minutes",
  description="Shorter session for contractor accounts",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "SCIM_GROUP",
          "entry_values": [
            {"lhs": "<idp_id>", "rhs": "<contractors_scim_group_id>"}
          ]
        }
      ]
    }
  ]
)

Example 4: Long Timeout with SAML + Segment Group

Allow a 10-day session for specific SAML-identified users on a specific segment group.

Step 1: Look up IDs

text

get_zpa_saml_attribute(search="Email_Users")
zpa_list_segment_groups()

Step 2: Create rule

text

zpa_create_timeout_policy_rule(
  name="Extended Timeout - VIP Users",
  action_type="RE_AUTH",
  reauth_timeout="10 Days",
  reauth_idle_timeout="1 Hours",
  description="Extended session for VIP users accessing standard apps",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "APP_GROUP",
          "values": ["<segment_group_id>"]
        }
      ]
    },
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "SAML",
          "entry_values": [
            {"lhs": "<saml_email_attr_id>", "rhs": "vip1@company.com"},
            {"lhs": "<saml_email_attr_id>", "rhs": "vip2@company.com"}
          ]
        }
      ]
    }
  ]
)

Logic: User must be accessing apps in the segment group AND have a matching SAML email.

Example 5: Platform-Specific Timeout

Mobile devices (Android/iOS) get shorter timeouts than desktops.

Mobile rule (stricter):

text

zpa_create_timeout_policy_rule(
  name="Mobile Timeout - Short",
  action_type="RE_AUTH",
  reauth_timeout="4 Hours",
  reauth_idle_timeout="15 Minutes",
  description="Shorter timeouts for mobile devices",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "PLATFORM",
          "entry_values": [
            {"lhs": "android", "rhs": "true"},
            {"lhs": "ios", "rhs": "true"}
          ]
        }
      ]
    }
  ]
)

Desktop rule (more relaxed):

text

zpa_create_timeout_policy_rule(
  name="Desktop Timeout - Standard",
  action_type="RE_AUTH",
  reauth_timeout="10 Days",
  reauth_idle_timeout="1 Hours",
  description="Standard timeouts for desktop devices",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "PLATFORM",
          "entry_values": [
            {"lhs": "mac", "rhs": "true"},
            {"lhs": "windows", "rhs": "true"},
            {"lhs": "linux", "rhs": "true"}
          ]
        }
      ]
    }
  ]
)

Example 6: Posture-Based Timeout

Devices that pass a posture check get a longer timeout; non-compliant devices get a shorter one.

Step 1: Look up posture profile

text

get_zpa_posture_profile(search="CrowdStrike_ZTA")

Compliant devices (longer timeout):

text

zpa_create_timeout_policy_rule(
  name="Compliant Device Timeout",
  action_type="RE_AUTH",
  reauth_timeout="30 Days",
  reauth_idle_timeout="2 Hours",
  description="Extended timeout for posture-compliant devices",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "POSTURE",
          "entry_values": [
            {"lhs": "<posture_udid>", "rhs": "true"}
          ]
        }
      ]
    }
  ]
)

Non-compliant devices (shorter timeout):

text

zpa_create_timeout_policy_rule(
  name="Non-Compliant Device Timeout",
  action_type="RE_AUTH",
  reauth_timeout="1 Hours",
  reauth_idle_timeout="10 Minutes",
  description="Aggressive timeout for non-compliant devices",
  conditions=[
    {
      "operator": "OR",
      "operands": [
        {
          "object_type": "POSTURE",
          "entry_values": [
            {"lhs": "<posture_udid>", "rhs": "false"}
          ]
        }
      ]
    }
  ]
)

Example 7: Combined Conditions -- Group + App + Platform

Engineering team accessing sensitive apps from Linux gets a specific timeout.

This is the start of the file. Read the full SKILL.md on GitHub.

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingskills/zpa/create-timeout-policy-rule/SKILL.md

Popularity

Repository stars: 39
Repository forks: 18
7-day trend score: 18

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/zscaler/zscaler-mcp-server/create-timeout-policy-rule/badge)](https://verified-skill.com/skills/zscaler/zscaler-mcp-server/create-timeout-policy-rule)

Something wrong with this skill or its page? Tell us.

Install

SKILL.md

ZPA: Create Timeout Policy Rule

Keywords

Overview

Timeout Parameters

reauth_timeout (Session Timeout)

reauth_idle_timeout (Idle Timeout)

Action

Baseline Values (recommended)

Authentication timeout (reauth_timeout)

Idle timeout (reauth_idle_timeout) — per app class

Condition Object Types

Value-Based (use values)

Entry-Values Based (use entry_values with lhs/rhs)

Workflow

Step 1: Gather Requirements

Step 2: Look Up Required IDs

Step 3: Create the Rule

Step 4: Verify

Ready-to-Use Examples

Example 1: Standard Timeout for a Segment Group

Example 2: Strict Timeout for Sensitive Applications

Example 3: Contractor-Specific Timeout

Example 4: Long Timeout with SAML + Segment Group

Example 5: Platform-Specific Timeout

Example 6: Posture-Based Timeout

Example 7: Combined Conditions -- Group + App + Platform

Security

Quality evaluation

Source

Popularity

Works with

`reauth_timeout` (Session Timeout)

`reauth_idle_timeout` (Idle Timeout)

Authentication timeout (`reauth_timeout`)

Idle timeout (`reauth_idle_timeout`) — per app class

Value-Based (use `values`)

Entry-Values Based (use `entry_values` with `lhs`/`rhs`)