This guide will instruct you how to enroll Zscaler Private Access using a Schaeffler device (e.g. Laptop).
Quick Start Guide

This guide will give you insights about how to use the new RAS system to access e.g. Citrix:
Quick Start Guide for externals

Quick start guide how to install the Zscaler Client Connector on a non-Schaeffler device:
How to install Zscaler Client Connector on non-Schaeffler devices.pdf


Download of the installation package for different kind of operating systems:

Windows:
Zscaler-windows-4.8.0.232-installer-x64.exe
Zscaler-windows-4.8.0.232-installer-x64.msi

Mac OS X:
Zscaler-osx-4.8.0.252-installer.pkg

Due to limitations and security requirements for the "direct connect" permission the access to web applications like Jira or Outlook, which are are using Microsoft EntraID for the authentication, are not possible to be accessed directly. Next to Jira a lot of other applications are using Microsoft for the authentication, all of those applications are not possible in combination with direct connect.

In case such kind of application are required you have to use a Citrix VDI system or a Citrix App like Microsoft Edge to access a web application.

1. Access the RAS portal (https://ras-portal.schaeffler.com/) to open Citrix HTML5 or Citrix Workspace

2. After you have authenticated at Citrix you can open a Citrix VDI ("Desktops") or Microsoft Edge from the "Apps" menu.

3. In a new tab the Citrix App will be opened as a embedded app in the browser (browser in browser in this case).

You can connect now to all web applications which are using Microsoft EntraID for authentication in this embedded browser.

For example:
https://outlook.office.com
https://jira.schaeffler.com

Due to limitations and security requirements for the "direct connect" permission there is no possibility anymore to exchange files directly between a non-Schaeffler and a Schaeffler system.

In case you need to have a option to exchange files between a non-Schaeffler device and a Schaeffler device you have to use Sharepoint Online in combination with a Microsoft Teams Guest account.

Requirements:

• Teams Guest account
• Teams Team / Sharepoint Online

The Teams Guest account need to be requested from a Schaeffler employee. This guest account will not replace the external Schaeffler account with which the login to the remote access system will be done.

This guide will give you insights about how to add partner tenant:
How to add partner tenant

Please follow this documentation in regards of registering and using the multifactor authentication from Microsoft:
MFA_Enduser_Guide_EN_RAS_Portal_Version.pdf

Affected UseCase:
accessing Citrix HTML5 from non-Schaeffler devices

If you will be prompted with this error message:
1. Open your current browser and clear the cache and cookies

2. In adition you should allow browser and site permision for https://rgw-vdi.schaeffler.com

This could be done In browser -> Open Settings-Cookies and site permission-Allow : Microphone, Notifications, Pop-ups and redirects for https://rgw-vdi.schaeffler.com)

Affected UseCase:
accessing Citrix HTML5 from non-Schaeffler devices

If you will be prompted with this error message:
1.Open your current browser and clear the cache and cookies

2.In adition you should allow browser and site permision for https://rgw-vdi.schaeffler.com

This could be done In browser -> Open Settings-Cookies and site permission-Allow : Microphone, Notifications, Pop-ups and redirects for https://rgw-vdi.schaeffler.com)

Note:
In case this step will not solve your problem, you need to contact your local IT team to check if there is any firewall or proxy configuration on your side which may block our rgw-vdi.schaeffler.com access for port 443.

Affected UseCase:
users which do have the permission to work from non-Schaeffler devices to access e.g. Citrix HTML5 or Citrix Workspace

If you will be prompted with this error message a security check within the authentication will fail. This problem will mostly happen with Web Applications. Due to security guidelines the access to Schaeffler services is only allowed from Schaeffler devices (like a Citrix VDI). The embedded security check will validate the system configuration for the "Hybrid Joined" status which will determine a system as Schaeffler system or non-Schaeffler system.

This security check can only be executed within Microsoft Applications. If you access a web application with e.g. the web browser Mozilla Firefox or Google Chrome, the security check can not be executed and therefore the access will be blocked.

In this case please make sure to use Microsoft Edge web browser from a Schaeffler device.



Hint: if you are permitted for a "direct connection" you are also not allowed to access Schaeffler web applications directly from a non-Schaeffler device. This need to be done using Microsoft Edge over Citrix HTML5 or Citrix Workplace.

Affected UseCase:
users which do have permission for any of the remote access services

This message could be displayed within the authentication process of any of the available remote access services (in a web browser or also in the Zscaler Client Connector). As part of the authentication a multifactor authentication ("MFA") is required for strong security. The remote access services rely on the Microsoft authentication capabilities.

In case of this message you have not configured a MFA option for your account. A MFA option could be a text message, phone call or the Microsoft Authenticator App. Please follow the instructions of the message to setup a MFA option and to continue with the authentication.

Affected UseCase:
users which do have permission to use a kind of a Citrix connection or Desktop VPN

This error message could have two different root causes:

1) You are not allowed to access a remote access service from a non-Schaeffler device
In case you should have the permission to use e.g. Citrix HTML5 from a non-Schaeffler device and you will be prompted with this message, you are missing a permission group. Please request the correct permission via the Schaeffler servicedesk or your internal Schaeffler IT contact (keyword "ZPA noCBA permission group").

2) You have tried to authenticate from a Schaeffler device with username and password instead of Smartcard / virtual certificate
Within the authentication process to access Schaeffler resources e.g. using the Zscaler Client Connector you will be prompted to login with your username. Please make sure to use at this login prompt your Smartcard / virtual certificate.



If you don`t have a Smartcard / virtual certificate, please get in touch with the servicedesk.

If you see a "This Connection is Untrusted" error or similar, please install the Schaeffler Chain Certificates to ensure a secure connection.

Download Schaeffler Chain Certificates