--- title: "Configuring ScreenMeet in Zscaler" slug: "configuring-screenmeet-in-zscaler" updated: 2026-11-02T15:36:52Z published: 2026-11-02T15:36:52Z canonical: "docs.screenmeet.com/configuring-screenmeet-in-zscaler" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.screenmeet.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring ScreenMeet in Zscaler ### Overview This article lists the Zscaler Internet Access (ZIA) and Zscaler Client Connector (ZCC) policies that typically need configured for ScreenMeet sessions to connect reliably. It is intended for network and security administrators who manage Zscaler for agents, end users, or unattended endpoints. ScreenMeet uses WebRTC for screen sharing and remote control. Media traffic prefers UDP 443 and falls back to TCP 443. The ScreenMeet client uses certificate pinning, so Zscaler SSL inspection of ScreenMeet traffic causes certificate warnings and prevents Beam unattended sessions from connecting. Apply these settings to your Zscaler-protected device that participates in a session: the agent's device, the end user's device, and any Beam unattended endpoint. --- ### Prerequisites - A ZIA administrator account with permission to edit URL Categories, SSL Inspection, URL & Cloud App Control, and Firewall Control policies. - A Zscaler Client Connector administrator account with permission to edit App Profiles, Forwarding Profiles, and Application Bypass (if you deploy ZCC). - The ScreenMeet hostnames: `*.screenmeet.com` and `*.scrn.mt`. - The ScreenMeet static IP list from the [ScreenMeet Firewall Configuration / Whitelisting](https://docs.screenmeet.com/docs/firewall-white-list) article, if you use IP-based rules. Zscaler These recommendations reflect what we’ve seen work across customer environments. Review them against your organization’s policies, and adjust as needed for your setup. Menu paths in this article follow the ZIA Admin Portal. Labels can differ slightly between the classic portal and the unified Zscaler Admin Portal. If a path does not match, search the portal for the policy name. --- ### Configuration Summary | Zscaler Area | Required Setting | Impact If Missing | | --- | --- | --- | | Custom URL Category | Category containing `.screenmeet.com` and `.scrn.mt` | Policies below cannot target ScreenMeet | | SSL Inspection | `Do Not Inspect` for the ScreenMeet category | Certificate warnings; Beam unattended does not connect | | URL & Cloud App Control | Allow the ScreenMeet category above any remote access block | ScreenMeet pages or client downloads are blocked | | Firewall Filtering | Allow TCP and UDP 443 to ScreenMeet, above any QUIC or UDP 443 block | Media falls back to TCP; slow connect, low frame rate | | Client Connector | Bypass ScreenMeet from the Zscaler tunnel (recommended) | Added latency from double encapsulation of media | --- ### Step 1: Create a ScreenMeet Custom URL Category Create one custom URL category so every ZIA policy references the same ScreenMeet destinations. 1. In the ZIA Admin Portal, go to **Administration** > **URL Categories**. 2. Click **Add URL Category**. 3. Enter `ScreenMeet` in the **Name** field. 4. In the **Custom URLs** field, add the following entries. The leading period matches all subdomains. - `.screenmeet.com` - `.scrn.mt` 5. Click **Save**. --- ### Step 2: Exempt ScreenMeet from SSL Inspection ScreenMeet pins its certificates. Zscaler cannot inspect pinned traffic, and Zscaler recommends exempting pinned applications from SSL inspection. 1. Go to **Policy** > **SSL Inspection**. 2. Click **Add SSL Inspection Rule**. 3. Enter `ScreenMeet - Do Not Inspect` in the **Rule Name** field. 4. Set **Rule Order** so this rule is evaluated before any rule with the `Inspect` action. 5. Under **Criteria**, set **URL Categories** to `ScreenMeet`. Leave user, group, and location criteria empty so the rule applies to everyone. 6. Under **Action**, select `Do Not Inspect`, then select `Evaluate Other Policies`. 7. Click **Save**. Beam Unattended Access Beam unattended sessions do not connect while SSL inspection is active on ScreenMeet traffic. This exemption is required for Beam to work. --- ### Step 3: Allow ScreenMeet in URL and Cloud App Control Many organizations block the remote access tools category. Confirm that ScreenMeet is not caught by that block. 1. Run a URL lookup for `screenmeet.com` in the ZIA Admin Portal to see how Zscaler categorizes it. 2. Go to **Policy** > **URL & Cloud App Control** > **URL Filtering Policy**. 3. Click **Add URL Filtering Rule**. 4. Enter `ScreenMeet - Allow` in the **Rule Name** field. 5. Set **URL Categories** to `ScreenMeet` and **Action** to `Allow`. 6. Set **Rule Order** above any rule that blocks or cautions remote access tools, uncategorized sites, or file downloads. 7. Click **Save**. 8. If ScreenMeet appears in the **Cloud App Control Policy** tab under a category your organization blocks, add an `Allow` rule for ScreenMeet in that category above the block rule. File Type Control If File Type Control blocks executable downloads, end users cannot download the ScreenMeet support client. Add an allow rule for the `ScreenMeet` URL category above the executable block. --- ### Step 4: Allow TCP and UDP 443 in Firewall Filtering When the ZIA firewall is enabled, the default Firewall Filtering rule blocks traffic that no higher rule allows. Many organizations also block UDP 443 to disable QUIC, which also blocks ScreenMeet's preferred WebRTC media path. #### Create a UDP 443 Network Service 1. Go to **Administration** > **Network Services**. 2. Click **Add Network Service**. 3. Enter `ScreenMeet-UDP-443` in the **Name** field. 4. Enter `443` in **UDP Destination Ports**. 5. Click **Save**. #### Create the Firewall Allow Rule 1. Go to **Policy** > **Firewall Control**. 2. Click **Add Firewall Filtering Rule**. 3. Enter `ScreenMeet - Allow 443` in the **Rule Name** field. 4. Set **Rule Order** above any rule that blocks QUIC, UDP 443, or non-web traffic. 5. On the **Services** tab, add `HTTPS` and `ScreenMeet-UDP-443` to **Network Services**. 6. On the **Destination** tab, add `*.screenmeet.com` and `*.scrn.mt` to **IP Address or Wildcard FQDN**. If your policy requires IP-based rules, create a destination IP group containing the ScreenMeet static IPs and select it instead. 7. Set **Action** to `Allow`. 8. Click **Save**. Dynamic IP Addresses ScreenMeet uses both static and dynamic infrastructure. Prefer FQDN-based rules to avoid disruptions. IP-based rules can miss dynamic endpoints and must be updated when the dynamic IP changes. --- ### Step 5: Bypass ScreenMeet in Zscaler Client Connector With Z-Tunnel 2.0, Client Connector tunnels all ports and protocols, including ScreenMeet UDP media, to the Zscaler cloud. Bypassing ScreenMeet sends media directly to ScreenMeet and avoids added latency. Choose the options that match your platforms and forwarding mode. Bypassed Traffic and Local Firewalls Bypassed traffic leaves the device directly and is not evaluated by ZIA policies. Your local or perimeter firewall must still allow TCP and UDP 443 to ScreenMeet, as described in the ScreenMeet firewall article. #### Option A: Process-Based Bypass (Windows, Recommended) A process-based bypass follows the ScreenMeet client regardless of which IP addresses it connects to. This applies to the ScreenMeet Remote Support and Beam clients, not to browser-based sessions. 1. In the Client Connector App Profile for Windows, enable **Install WFP Driver**. Process-based bypass requires this driver. 2. Go to **Infrastructure** > **Common Resources** > **Application** > **Process Based**. 3. Click **Add Application**. 4. Enter `ScreenMeet` in the **Name** field. 5. In **Path**, add `**\ScreenMeetSupport.exe`. Press **Enter** after the entry. 6. Click **Save**. 7. Open the Windows App Profile and select `ScreenMeet` under **Process-Based Application Bypass**. 8. Click **Save**. #### Option B: Destination Exclusions (Windows and macOS) 1. Open the Client Connector App Profile for the platform. 2. In **Destination Exclusions**, add each ScreenMeet static IP address. Optionally append `:443` to limit the exclusion to port 443. 3. Click **Save**. #### Option C: PAC File Bypass for Web Traffic If your forwarding profile sends web traffic through the Client Connector listening proxy or uses Z-Tunnel 1.0, add a domain bypass to the App Profile PAC file. Place it before the default return statement. ```javascript if (dnsDomainIs(host, ".screenmeet.com") || dnsDomainIs(host, ".scrn.mt")) {    return "DIRECT"; } ``` If you use a Z-Tunnel 2.0 forwarding profile PAC file, return the Z-Tunnel 2.0 bypass statement documented by Zscaler, typically `PROXY ${ZAPP_TUNNEL2_BYPASS}`, for the same domains. --- ### Step 6: Activate Changes ZIA policy changes do not take effect until they are activated. Click **Activate** in the ZIA Admin Portal after completing Steps 1 through 4. Client Connector profile changes apply when devices next update their policy. --- ### Verification 1. In the ZIA Admin Portal, open **Web Insights** logs and filter for `screenmeet.com`. Confirm the transactions show as not SSL inspected and allowed. 2. Open **Firewall Insights** logs and confirm UDP 443 traffic to ScreenMeet is allowed, not blocked by a QUIC or default rule. 3. Run the [ScreenMeet WebRTC Test Tool](https://integration.screenmeet.com/webrtctest/index.html). Confirm UDP candidates connect and no certificate or pinning errors appear. A TCP-only result means UDP 443 is still blocked. 4. Start an attended session. The end user must not see an SSL warning when the ScreenMeet window opens. 5. If you use Beam, start an unattended session to a test endpoint and confirm it connects. Isolating Zscaler as the Cause If sessions still fail, temporarily disable Client Connector on a test device and retry. If the session succeeds, Zscaler is still intercepting or blocking ScreenMeet traffic. Include the WebRTC Test Tool results and session IDs when you contact ScreenMeet support. ---