--- title: Enrolling Ivanti Secure Access Client slug: ps/help/en_us/nsa/22x/nsa-zta/ag/1010 docTags: createdAt: 2026-07-22T14:00:51.158Z --- - [Introduction](docId\:xlYYRE32DuERIDPt7Y8Ep) - [Enrolling a Windows Device](docId\:xlYYRE32DuERIDPt7Y8Ep) - [Enrolling a macOS Device](docId\:xlYYRE32DuERIDPt7Y8Ep) - [Enrolling a Linux Device](docId\:xlYYRE32DuERIDPt7Y8Ep) - [Enrolling an iOS Device](docId\:xlYYRE32DuERIDPt7Y8Ep) - [Enrolling an Android Device](docId\:xlYYRE32DuERIDPt7Y8Ep) ## Introduction After you have created the required configuration for your *Ivanti Neurons for Zero Trust Access* (*nZTA*) service, you can begin to enroll your end user devices. To see which devices have been enrolled, and to perform certain actions on enrolled devices, use the **Insights > Devices** page. For more details, see [tadmin\_enrol\_client.html#Viewing](docId\:xlYYRE32DuERIDPt7Y8Ep)[Viewing Currently Enrolled User Devices](docId:9pR-GUBlUQ_Ko0B6yMLkA). To configure settings that control and restrict the functionality available in Ivanti Secure Access Client when a user enrolls their device with the Controller, use the **Global Device Preferences** tab in the **Secure Access > Manage Devices **page. For more details, see [Setting Global Device Preferences](docId:_nvGswHhwlgHDsmRPBWyz). :::hint{type="info" indent="1"} For security reasons, only the authorized user account used to enroll a device is subsequently permitted to sign-in to *nZTA* on that device. ::: The following desktop and mobile device types are supported: - *Ivanti Secure Access Client* on Windows OS desktop, see [Enrolling a Windows Desktop Device](docId\:xlYYRE32DuERIDPt7Y8Ep). - *Ivanti Secure Access Client* on macOS desktop, see [Enrolling a macOS Desktop Device](docId\:xlYYRE32DuERIDPt7Y8Ep). - *Ivanti Secure Access Client* on Linux desktop, see [Enrolling a Linux Desktop Device](docId\:xlYYRE32DuERIDPt7Y8Ep). - *Ivanti Secure Access Client* on iOS mobile device, see [Enrolling an iOS Mobile Device](docId\:xlYYRE32DuERIDPt7Y8Ep). - *Ivanti Secure Access Client* on Android mobile device, see [Enrolling an Android Mobile Device](docId\:xlYYRE32DuERIDPt7Y8Ep). The table below summarizes feature support for each device type: | Feature | iOS | Android | macOS | Windows | Linux | | ----------------------------------------------- | --- | ------- | ----- | ------- | ------------------------------------------------------------------------ | | On-Demand Connection | Yes | Yes | Yes | Yes | No | | End User Portal | No | No | Yes | Yes | Yes (SSO,RDP,SSH not supported) | | SAML Auto Sign-in & Single Logout (SLO) | No | No | Yes | Yes | Yes | | Automatic *Ivanti Secure Access Client* Upgrade | Yes | Yes | Yes | Yes | No | | Browser-Based Enrollment | No | No | Yes | Yes | No | | Dynamic Policy/CARTA | No | No | Yes | Yes | Yes (CARTA message is not supported) | | Device Policy | Yes | Yes | Yes | Yes | Yes (limited to support for File, Port number, and Process policy types) | | FQDN/IP based Application | Yes | Yes | Yes | Yes | Yes (Split DNS is not supported) | | Client Disconnect | Yes | Yes | Yes | Yes | Yes | | Log Upload | Yes | Yes | Yes | Yes | No | | *nZTA* Client Settings | No | No | Yes | Yes | No | | CNAME FQDN App | Yes | Yes | Yes | Yes | No | | Application Discovery Default Gateway | Yes | Yes | Yes | Yes | No | | GSLB Support | Yes | Yes | Yes | Yes | No | | Customer PKI support (BYOC) | No | No | Yes | Yes | No | | Multiple sign-in URL support | Yes | Yes | Yes | Yes | Yes | After a device is enrolled with *nZTA*, requests from each application are handled by the Gateway referenced in the secure access policy for the application. A default Gateway can also be configured on the *Controller*, which handles requests from all applications that are not referenced by a secure access policy, see [Application Discovery with Ivanti Secure Access Client](docId\:xlYYRE32DuERIDPt7Y8Ep). ## Enrolling a Windows Device Before you start this process, you must have an Windows sign-in URL for *nZTA*, based on the tenant FQDN provided by the *Ivanti* DevOps/Support organization. :::hint{type="info"} If you have an existing *Ivanti Secure Access Client* installed, you must first uninstall it before beginning the *nZTA* enrollment process. ::: :::hint{type="info"} The Domain Admin must also ensure that Windows desktop machines can successfully connect to the Windows domain by updating the Trusted Root CA Certificates on all machines, see [Enabling Trusted Root CA Certificate on Windows Domain](docId\:xlYYRE32DuERIDPt7Y8Ep). ::: To enroll a Windows desktop device: 1. Log into your Windows desktop. 2. Start a browser session. 3. In your browser, enter the *nZTA* enrollment URL into your address bar. For example, "https\://tenant1.mycompany.com/login/" or "https\://tenant1.mycompany.com/login/saleslogin/". A login page appears. 4. Provide your credentials to access *nZTA* enrollment. The launcher page appears, for example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/gtAUtjZdKFAqIb5UDZPEI_launcherdownloadwindows.png" alt="nZTA Launcher (Windows)" position="flex-start" size="80" width="1258" height="912" initialPath="img/launcher_download_windows.png" githubPath="img/launcher_download_windows.png" showCaption="false"} *nZTA* Launcher (Windows) 5. Click **Download** and save the application launcher *PulseSecureAppLauncher.msi* file locally. :::hint{type="info"} A "HERE" hyperlink is displayed in the browser. This is required *after* the launcher has installed. ::: 1. Run the downloaded file to install the launcher. 2. Confirm the completion of the launcher installation. 3. In the browser, click the "HERE" hyperlink to continue with the enrollment. A browser dialog requests confirmation to start the launcher app. 4. Click **Open Pulse Secure Application Launcher**. The launcher starts. 5. Accept any certificate warnings. A progress bar indicates installation status. 6. Accept that the *PulseSetupClientOCX.exe* file can make changes to your device. 7. Accept that the *PulseSetupClientOCX64.exe* file can make changes to your device. 8. Accept that the *Pulse Secure Component Manager* Installer application can make changes to your device. *Ivanti Secure Access Client* then downloads. 9. Accept that the *Pulse Secure Component Manager* can make changes to your device. *Ivanti Secure Access Client* then installs and starts, and reports on a number of tasks: - *Enrolling the User*. - *Fetching and Importing Client Certificates*. You must confirm any certificate requests. - *Fetching and Importing CA Certificates*. You must confirm any certificate requests. - *Launching the Windows Edge/Webview2 browser*. In a typical enrollment, upon successful authentication to the Controller, *Ivanti Secure Access Client* automatically shows the end-user portal applications page through a Windows Edge/Webview2 browser. This feature is supported with ISAC client version 22.6R1. Onboarding is then complete. *Ivanti Secure Access Client* appears as a task in the Windows task bar. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/GWx-B8ar38iiIqkEY7Q4X_launchertaskbarwindows.png" alt="Ivanti Secure Access Client Task in Taskbar (Windows)" position="flex-start" size="32" width="316" height="62" initialPath="img/launcher_taskbar_windows.png" githubPath="img/launcher_taskbar_windows.png" showCaption="false"} *Ivanti Secure Access Client* Task in Taskbar (Windows) 15. When the *Controller* requests a certificate from the client, accept the request. 16. Log into the *Controller* using your *Ivanti Neurons for Zero Trust Access* service user credentials. The compliance of the device is checked. 17. (Optional) If your sign-in authentication policy is configured for Multi-Factor Authentication, you might be required to complete a TOTP (Time-based One Time Password) secondary authentication step each time you sign in. For a first time login, the user is presented with a TOTP registration page: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/WcCe1So1KT33cLwc1AsRs_clienttotpreg.png" alt="First-time login TOTP registration" position="flex-start" size="80" width="1430" height="809" initialPath="img/client_totp_reg.png" githubPath="img/client_totp_reg.png" showCaption="false"} First-time login TOTP registration Use this page to add your user details to an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator. If you do not yet have such a two-factor authenticator app installed, do that now. Scan the QR code, or enter the provided text, to add the user details to your authenticator app. Then, store the generated backup codes in a secure location for future retrieval of a lost account. Finally, enter the token code generated by the authenticator app into the box provided, then select **Sign In**. :::hint{type="info"} For future sign-in attempts, the TOTP challenge dialog appears without the registration details or backup codes. As before, you provide the generated token code from your authenticator app into the box provided and select **Sign In**. ::: When *Ivanti Secure Access Client* connects, it is minimised to the taskbar. 18. Open *Ivanti Secure Access Client* from the taskbar. *Ivanti Secure Access Client* appears. It shows the active connection to the *Controller* and presents a **Connect** button to access assigned applications and resources. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/aIvTG2v0RuByUYbf8hwAN_pulsesecureclientstartwindows.png" alt="Ivanti Secure Access Client (Windows)" position="flex-start" size="80" width="936" height="576" initialPath="img/pulse_secure_client_start_windows.png" githubPath="img/pulse_secure_client_start_windows.png" showCaption="false"} *Ivanti Secure Access Client* (Windows) :::hint{type="info"} To learn more about how *Ivanti Secure Access Client* maintains a connection with the *Controller*, and how user sessions are validated with your *nZTA Gateway*s, see [Introduction](docId\:LOWTLfGQBiadNKrcw9BlV). ::: 19. In a typical enrollment, upon successful authentication to the *Controller*, *Ivanti Secure Access Client* automatically shows the end-user portal applications page through an embedded browser. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/I8p91WwiEXCACl-knH_8Y_resourceswindows.png" position="flex-start" size="80" width="1422" height="561" initialPath="img/resources_windows.png" githubPath="img/resources_windows.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} Assigned Applications and Resources (Windows) ::: After the *nZTA* end-user portal applications page appears, click any displayed resource to launch that item in your default system browser. To re-show the end-user portal at a future time, use the **ZTA** button in the *Ivanti Secure Access Client* *nZTA* connection. :::hint{type="info"} When you launch an SSO (Single Sign-on) application from the end-user portal for the first time in a session, *nZTA* presents a pop-up dialog requesting the user to select a certificate with which to authenticate this device with the *Controller*. This is a one-time activity at the beginning of a session, and all further SSO application accesses (to any SSO application) re-use the same certificate. ::: :::hint{type="info"} If a default Gateway is configured on the *Controller*, and *nZTA* is the only active connection, the default Gateway handles all requests for unlisted applications from your Windows device. Refer to [Using Application Discovery with Ivanti Secure Access Client](docId\:xlYYRE32DuERIDPt7Y8Ep). ::: ### Enabling Trusted Root CA Certificate on Windows Domain To ensure that Windows desktop machines can successfully connect to the Windows domain, each machine must update its Trusted Root CA Certificates. *Ivanti* recommends that the Domain Admin configures the Public Key Policies on the Group Policy Object and publishes it to all connected Windows desktops. To add certificates to the Trusted Root Certification Authorities store for a Windows domain: 1. Access the Windows domain server and log in. :::hint{type="info"} *Domain Admins* is the minimum group membership required to complete this procedure. ::: 1. Open the **Server Manager**. 2. Under **Features Summary**, click **Add Features**. 3. Select the **Group Policy Management** check box. 4. Click **Next**. 5. Click **Install**. 6. Wait until the **Installation Results** page shows that the installation of the **Group Policy Management Console** was successful. 7. Click **Close**. 8. Click **Start**, click **Administrative Tools** and then click **Group Policy Management**. The **Group Policy Management Console** appears. 9. In the console tree, double-click to expand *Group Policy Objects* in the forest and domain that contains the *Default Domain Policy* GPO. 10. Right-click the *Default Domain Policy* object, and then click **Edit**. 11. In the **Group Policy Management Console**, select *Computer Configuration > Windows Settings > Security Settings > Public Key Policies*. 12. Right-click the *Trusted Root Certification Authorities* store. 13. Click **Import** and follow the steps in the **Certificate Import Wizard** to import the certificates. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/RCPjKNy4ZMO0yZYr-tYrp_windowsdomaincertificateenable.png" position="flex-start" size="80" width="2334" height="1420" initialPath="img/windows_domain_certificate_enable.png" githubPath="img/windows_domain_certificate_enable.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} Enabling Trusted Root CA Certificate ::: When each Windows desktop machine next connects, the required Trusted Root CA Certificate installs automatically on the machine. ## Enrolling a macOS Device Before you start this process, you must have a sign-in URL for *nZTA*, based on the tenant FQDN provided by the *Ivanti* DevOps/Support organization. :::hint{type="info" indent="1"} If you have an existing *Ivanti Secure Access Client* installed, you must first uninstall it before beginning the *nZTA* enrollment process. ::: To enroll a macOS desktop device: 1. Log into your macOS desktop. 2. Start a browser session. 3. In your browser, enter the *nZTA* sign-in URL into your address bar. For example, A login page appears. - Custom: "https\://tenant1.mycompany.com/login/\/". - Default: "https\://tenant1.mycompany.com/login/enroll" 4. Provide your credentials to access *nZTA* enrollment. The launcher page appears, for example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/HpOd-2hYDi16GyPWUOlhy_launcherdownloadmacos.png" alt="nZTA Launcher macOS" position="flex-start" size="80" width="1258" height="912" initialPath="img/launcher_download_macos.png" githubPath="img/launcher_download_macos.png" showCaption="false"} *nZTA* Launcher macOS 5. Click **Download** and save the application launcher PulseSecureAppLauncher.dmg file locally. :::hint{type="info"} A "HERE" hyperlink is displayed in the browser. This is required after the launcher has installed. ::: 1. Click the downloaded file. The downloaded file opens, and a folder appears that contains the *PulseSecureAppLauncher.mpkg* file. 2. Double click the *PulseSecureAppLauncher.mpkg* file. 3. Click **Continue** when the install starts. 4. Wait until the install completes. 5. In the browser, click the "HERE" hyperlink to continue with the enrollment. A browser dialog requests confirmation to start the launcher app. 6. Click **Open PulseApplicationLauncher**. The launcher starts. 7. Confirm that you want to **Open** the application. 8. Confirm that you want the client to contact the *Controller*. *Ivanti Secure Access Client* then downloads and installs. 9. Enter your macOS device credentials. *Ivanti Secure Access Client* then installs and starts. The *nZTA* connection starts automatically. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/sHWiISjFu4tKP5Jl86JSL_macosclient.png" alt="macOS Ivanti Secure Access Client" position="flex-start" size="73" width="731" height="668" initialPath="img/macos_client.png" githubPath="img/macos_client.png" showCaption="false"} macOS *Ivanti Secure Access Client* :::hint{type="info"} To learn more about how *Ivanti Secure Access Client* maintains a connection with the *Controller*, and how user sessions are validated with your *nZTA Gateway*s, see [Introduction](docId\:LOWTLfGQBiadNKrcw9BlV). ::: *Ivanti Secure Access Client* appears as an icon in the macOS system tray. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/a7Zl1QwDZEFqgNIXJbmwP_macostask.png" alt="Ivanti Secure Access Client in the System Tray (indicated)" position="flex-start" size="42" width="420" height="32" initialPath="img/macos_task.png" githubPath="img/macos_task.png" showCaption="false"} *Ivanti Secure Access Client* in the System Tray (indicated) The connection activity reports on a number of tasks: :::Paragraph{listStyleType="disc" indent="2"} *Enrolling the User*. ::: :::Paragraph{listStyleType="disc" indent="2"} *Fetching and Importing Client Certificates*. You must confirm any certificate requests. ::: :::Paragraph{listStyleType="disc" indent="2"} *Fetching and Importing CA Certificates*. You must confirm any certificate requests. ::: :::Paragraph{listStyleType="disc" indent="2"} *Installing the CEF (Chromium Embedded Framework) browser*. This is an embedded browser used by *Ivanti Secure Access Client* for SAML-based login and to display the *nZTA* end-user portal applications page. ::: Onboarding is then complete. 15. In a typical enrollment, upon successful authentication to the *Controller*, *Ivanti Secure Access Client* automatically signs in the user. 16. (Optional) If your sign-in authentication policy is configured for Multi-Factor Authentication, you might be required to complete a TOTP (Time-based One Time Password) secondary authentication step each time you sign in. For a first time login, the user is presented with a TOTP registration page: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/WcCe1So1KT33cLwc1AsRs_clienttotpreg.png" alt="First-time login TOTP registration" position="flex-start" size="80" width="1430" height="809" initialPath="img/client_totp_reg.png" githubPath="img/client_totp_reg.png" showCaption="false"} First-time login TOTP registration Use this page to add your user details to an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator. If you do not yet have such a two-factor authenticator app installed, do that now. Scan the QR code, or enter the provided text, to add the user details to your authenticator app. Then, store the generated backup codes in a secure location for future retrieval of a lost account. Finally, enter the token code generated by the authenticator app into the box provided, then select **Sign In**. :::hint{type="info"} For future sign-in attempts, the TOTP challenge dialog appears without the registration details or backup codes. As before, you provide the generated token code from your authenticator app into the box provided and select **Sign In**. ::: When *Ivanti Secure Access Client* connects, it is minimised to the taskbar. 17. Accept the request to access the private key. 18. Accept the request to present a certificate for access to browser-based resources. :::Paragraph{indent="1"} The *nZTA* end-user portal applications page appears. For example: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/6UmQ4lA8OhDJDIQrjCBmN_resourcesmacos.png" position="flex-start" size="80" width="1422" height="561" initialPath="img/resources_macos.png" githubPath="img/resources_macos.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} Assigned Applications and Resources ::: After the *nZTA* end-user portal applications page appears, click any displayed resource to launch that item in your default system browser. To re-show the end-user portal at a future time, click the **ZTA** button in the *Ivanti Secure Access Client* *nZTA* connection. :::hint{type="info"} When you launch an SSO (Single Sign-on) application from the end-user portal for the first time in a session, *nZTA* presents a pop-up dialog requesting the user to select a certificate with which to authenticate this device with the *Controller*. This is a one-time activity at the beginning of a session, and all further SSO application accesses (to any SSO application) re-use the same certificate. ::: :::hint{type="info"} If a default Gateway is configured on the *Controller*, and *nZTA* is the only active connection, the default Gateway will handle all requests for unlisted applications from the macOS desktop device. Refer to [Using Application Discovery with Ivanti Secure Access Client](docId\:xlYYRE32DuERIDPt7Y8Ep). ::: ## Enrolling a Linux Device :::hint{type="info" indent="1"} Browser-based enrollment is not supported for *Ivanti Secure Access Client* on Linux devices. Follow the instructions in this section to enroll the device by creating a *nZTA* connection through the *Ivanti Secure Access Client* application. To see the full feature support list for Linux devices, see [Introduction](docId\:xlYYRE32DuERIDPt7Y8Ep). ::: Before you start this process, you must have: - A Linux sign-in URL for *nZTA*, based on the tenant FQDN provided by the *Ivanti* DevOps/Support organization. - The download location URL for your required installation package, as provided by the *Ivanti* DevOps/Support organization. If you have an existing *Ivanti Secure Access Client* installed, you must first uninstall it before beginning the *nZTA* enrollment process. *Ivanti Secure Access Client* is fully supported for use with *nZTA* on the following Linux variants: - Ubuntu, see [Enrolling on Ubuntu or Debian](docId\:xlYYRE32DuERIDPt7Y8Ep). While not fully supported, the following Linux variants are considered compatible: - Debian, see [Enrolling on Ubuntu or Debian](docId\:xlYYRE32DuERIDPt7Y8Ep). - Fedora, see [Enrolling on Fedora or CentOS/RHEL](docId\:xlYYRE32DuERIDPt7Y8Ep). - Centos/RHEL, see [Enrolling on Fedora or CentOS/RHEL](docId\:xlYYRE32DuERIDPt7Y8Ep). To learn more, contact your support representative. ### Enrolling on Ubuntu or Debian This section describes the installation of a *Ivanti Secure Access Client* Linux variants on either Ubuntu or Debian. If you want to install on either Fedora or CentOS/RHEL operating systems, refer to [Enrolling on Fedora or CentOS/RHEL](docId\:xlYYRE32DuERIDPt7Y8Ep). To enroll a Linux desktop device on Ubuntu or Debian: 1. Log into your Linux device. 2. Obtain the required *Ivanti Secure Access Client* for Linux installation package and download it to your Linux device. To obtain the installation package, contact your support representative. 3. Start a command line interface (CLI) terminal session. 4. If not already installed, install the prerequisite packages `nss3-tools` and `net-tools`. Make sure your package manager availability list is up to date, then run the following command for each package in turn: Repeat this step for each prerequisite package. ```javascript sudo apt-get install ``` 1. Start the *Ivanti Secure Access Client* for Linux package installation at the prompt: The installation process reports back to the session. For example, for Ubuntu: ```javascript Selecting previously unselected package pulsesecure. (Reading database ... xxxxxx files and directories currently installed.) Preparing to unpack pulsesecure_9.1.R11_amd64.deb ... Unpacking pulsesecure (9.1.R11) ... Setting up pulsesecure (9.1.R11) ... Created symlink /etc/systemd/system/multi-user.target.wants/pulsesecure.service → /lib/systemd/system/pulsesecure.service. Processing triggers for desktop-file-utils (0.24-1ubuntu3) ... Processing triggers for gnome-menus (3.36.0-1ubuntu1) ... Processing triggers for mime-support (3.64ubuntu1) ... Processing triggers for dbus (1.12.16-2ubuntu2.1) ... Processing triggers for man-db (2.9.1-1) ... ``` ```javascript sudo dpkg -i ``` 1. Start the client. To do this, either start the *PulseUI* app from the **Activities** bar, or use the following from the command line: The client appears: ```javascript /opt/pulsesecure/bin/pulseUI ``` ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/4EvAhNml9DlQo862QUKZp_pulsesecureclientztaubuntustart.png" alt="nZTA Ubuntu/Debian Linux Client" position="flex-start" size="61" width="608" height="526" initialPath="img/pulse_secure_client_zta_ubuntu_start.png" githubPath="img/pulse_secure_client_zta_ubuntu_start.png" showCaption="false"} *nZTA* Ubuntu/Debian Linux Client 7. Add the required connection. To do this: - Click the *plus* icon in the client toolbar. The **Add Connection** dialog appears. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/JRLN-v02u6upo9pTQDZ9p_pulsesecureclientztaubuntuadd.png" alt="nZTA Linux Add Connection" position="flex-start" size="67" width="673" height="348" initialPath="img/pulse_secure_client_zta_ubuntu_add.png" githubPath="img/pulse_secure_client_zta_ubuntu_add.png" showCaption="false"} *nZTA* Linux Add Connection :::Paragraph{listStyleType="disc" indent="2"} For **Type**, select *nZTA Connection*. ::: :::Paragraph{listStyleType="disc" indent="2"} For **Name**, enter a suitably identifying name for the connection. ::: :::Paragraph{listStyleType="disc" indent="2"} For **Server URL**, enter the Linux sign-in URL provided by the *Ivanti* DevOps/Support organization. For example, ::: - Custom: "https\://tenant1.mycompany.com/login/\/". - Default: "https\://tenant1.mycompany.com/login/enroll" - Click **Add** to add the connection and close the dialog. :::Paragraph{indent="1"} The new connection is added to the list of connections. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/BZLqbaBeNt8q4S0JEnNqi_pulsesecureclientztaubuntudisconnected.png" alt="nZTA Linux ZTA Connection" position="flex-start" size="61" width="608" height="526" initialPath="img/pulse_secure_client_zta_ubuntu_disconnected.png" githubPath="img/pulse_secure_client_zta_ubuntu_disconnected.png" showCaption="false" indent="1"} :::Paragraph{indent="2"} ::: :::Paragraph{indent="1"} *nZTA* Linux nZTA Connection ::: 8. For the *Ivanti Neurons for Zero Trust Access* connection, click **Connect**. A login dialog appears. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/piCnvqLp30uCQfVU_gOPI_pulsesecureclientztaubuntucreds.png" alt="nZTA Linux ZTA Credentials" position="flex-start" size="80" width="936" height="402" initialPath="img/pulse_secure_client_zta_ubuntu_creds.png" githubPath="img/pulse_secure_client_zta_ubuntu_creds.png" showCaption="false"} *nZTA* Linux nZTA Credentials 9. Enter your controller credentials and click **Connect**. A connection activity dialog reports a number of tasks: - *Enrolling the user*. - *Fetching and Importing of Client Certificates*. You must confirm any certificate requests. - *Fetching and Importing of CA Certificates*. You must confirm any certificate requests. - *Installing the CEF (Chromium Embedded Framework) browser*. This is an embedded browser used by *Ivanti Secure Access Client* for SAML-based login and to display the *nZTA* end-user portal applications page. - *Completion of the connection*. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/VgOB9_UUCS5gzhz47t5qc_pulsesecureclientztaubuntusuccess.png" alt="nZTA Linux ZTA Connection Success" position="flex-start" size="54" width="544" height="222" initialPath="img/pulse_secure_client_zta_ubuntu_success.png" githubPath="img/pulse_secure_client_zta_ubuntu_success.png" showCaption="false"} :::Paragraph{indent="2"} *nZTA* Linux ZTA Connection Success ::: 2. Click **OK **to connect to *nZTA*. When this completes, the connection updates. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/I7sej7sGdMp-0NyPePRTo_pulsesecureclientztaubuntuconnected.png" alt="nZTA Linux ZTA Connected" position="flex-start" size="72" width="719" height="598" initialPath="img/pulse_secure_client_zta_ubuntu_connected.png" githubPath="img/pulse_secure_client_zta_ubuntu_connected.png" showCaption="false" indent="1"} Onboarding is then complete. :::Paragraph{indent="1"} *nZTA* Linux ZTA Connected ::: :::hint{type="info"} To learn more about how *Ivanti Secure Access Client* maintains a connection with the *Controller*, and how user sessions are validated with your *nZTA Gateway*s, see [Introduction](docId\:LOWTLfGQBiadNKrcw9BlV). ::: 11. (Optional) If your sign-in authentication policy is configured for Multi-Factor Authentication, you might be required to complete a TOTP (Time-based One Time Password) secondary authentication step each time you sign in. For a first time login, the user is presented with a TOTP registration page: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/WcCe1So1KT33cLwc1AsRs_clienttotpreg.png" alt="First-time login TOTP registration" position="flex-start" size="80" width="1430" height="809" initialPath="img/client_totp_reg.png" githubPath="img/client_totp_reg.png" showCaption="false"} First-time login TOTP registration Use this page to add your user details to an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator. If you do not yet have such a two-factor authenticator app installed, do that now. Scan the QR code, or enter the provided text, to add the user details to your authenticator app. Then, store the generated backup codes in a secure location for future retrieval of a lost account. Finally, enter the token code generated by the authenticator app into the box provided, then select **Sign In**. :::hint{type="info"} For future sign-in attempts, the TOTP challenge dialog appears without the registration details or backup codes. As before, you provide the generated token code from your authenticator app into the box provided and select **Sign In**. ::: 12. In a typical enrollment, upon successful authentication to the *Controller*, *Ivanti Secure Access Client* automatically shows the end-user portal applications page through an embedded browser. To re-show this portal at a future time, click the **ZTA** button in the *Ivanti Secure Access Client* *nZTA* connection. Alternatively, access your permitted applications from the Linux command line. 13. (Optional) To uninstall *Ivanti Secure Access Client* Linux variants, enter the following command at the prompt and provide a password: ```bash [sudo] password for : sudo apt-get purge pulsesecure ``` After the process completes successfully, the Linux client has been removed. :::hint{type="info"} *Ivanti Secure Access Client* Linux variants do not support the use of default gateways. ::: :::hint{type="info" indent="1"} Device rule types for *Ivanti Secure Access Client* Linux variants are limited to *File*, *Port*, and *Process*. For details of these device rule types, see [Creating Device Policy Rules](docId\:xlYYRE32DuERIDPt7Y8Ep). ::: ### Enrolling on Fedora or CentOS/RHEL This section describes the installation of *Ivanti Secure Access Client* Linux variants on either Fedora or CentOS/RHEL. If you want to install on either Ubuntu or Debian operating systems, refer to [Enrolling on Ubuntu or Debian](docId\:xlYYRE32DuERIDPt7Y8Ep). To enroll a Linux desktop device on Fedora or CentOS/RHEL: 1. Log into your Linux device. 2. Obtain the required *Ivanti Secure Access Client* for Linux installation package and download it to your Linux device. To obtain the installation package, contact your support representative. 3. Start a command line interface (CLI) terminal session. 4. If not already installed, install the prerequisite packages `nss3-tools` and `net-tools`. Make sure your package manager availability list is up to date, then run the following command for each package in turn: Repeat this step for each prerequisite package. ```javascript sudo yum install ``` 1. Start the *Ivanti Secure Access Client* for Linux package installation at the prompt: The installation process reports back to the session. For example, for Fedora: ```javascript Verifying... ################################# [100%] Preparing... ################################# [100%] Updating / installing... 1:pulsesecure-2:9.1-R11 ################################# [100%] rpm post../ Created symlink /etc/systemd/system/multi-user.target.wants/pulsesecure.service → /lib/systemd/system/pulsesecure.service. Created symlink /etc/systemd/system/pulsesecure.service → /lib/systemd/system/pulsesecure.service. ``` ```javascript sudo rpm -ivh ``` 1. Start the client. To do this, either start the *PulseUI* app from the **Activities** bar, or use the following from the command line: The client appears: ```javascript /opt/pulsesecure/bin/pulseUI ``` ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/4EvAhNml9DlQo862QUKZp_pulsesecureclientztaubuntustart.png" alt="nZTA Ubuntu/Debian Linux Client" position="flex-start" size="61" width="608" height="526" initialPath="img/pulse_secure_client_zta_ubuntu_start.png" githubPath="img/pulse_secure_client_zta_ubuntu_start.png" showCaption="false"} *nZTA* Ubuntu/Debian Linux Client 7. Add the required connection. To do this: - Click the *plus* icon in the client toolbar. :::Paragraph{indent="1"} The **Add Connection** dialog appears. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/JRLN-v02u6upo9pTQDZ9p_pulsesecureclientztaubuntuadd.png" alt="nZTA Linux Add Connection" position="flex-start" size="67" width="673" height="348" initialPath="img/pulse_secure_client_zta_ubuntu_add.png" githubPath="img/pulse_secure_client_zta_ubuntu_add.png" showCaption="false" indent="1"} :::Paragraph{indent="2"} ::: :::Paragraph{indent="1"} *nZTA* Linux Add Connection ::: :::Paragraph{listStyleType="disc" indent="2"} For **Type**, select *nZTA Connection*. ::: :::Paragraph{listStyleType="disc" indent="2"} For **Name**, enter a suitably-identifying name. ::: :::Paragraph{listStyleType="disc" indent="2"} For **Server URL**, enter the Linux sign-in URL provided by the *Ivanti* DevOps/Support organization. For example, ::: - Custom: “https\://tenant1.mycompany.com/login/\/” - Default: “https\://tenant1.mycompany.com/login/enroll” - Click **Add** to add the connection and close the dialog. :::Paragraph{indent="1"} The new connection is added to the list of connections. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/BZLqbaBeNt8q4S0JEnNqi_pulsesecureclientztaubuntudisconnected.png" alt="nZTA Linux ZTA Connection" position="flex-start" size="61" width="608" height="526" initialPath="img/pulse_secure_client_zta_ubuntu_disconnected.png" githubPath="img/pulse_secure_client_zta_ubuntu_disconnected.png" showCaption="false" indent="1"} :::Paragraph{indent="2"} ::: :::Paragraph{indent="1"} *nZTA* Linux nZTA Connection ::: 2. For the *Ivanti Neurons for Zero Trust Access* connection, click **Connect**. A login dialog appears. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/piCnvqLp30uCQfVU_gOPI_pulsesecureclientztaubuntucreds.png" alt="nZTA Linux ZTA Credentials" position="flex-start" size="80" width="936" height="402" initialPath="img/pulse_secure_client_zta_ubuntu_creds.png" githubPath="img/pulse_secure_client_zta_ubuntu_creds.png" showCaption="false"} *nZTA* Linux nZTA Credentials 9. Enter your controller credentials and click **Connect**. A connection activity dialog reports a number of tasks: - *Enrolling the user*. - *Fetching and Importing of Client Certificates*. You must confirm any certificate requests. - *Fetching and Importing of CA Certificates*. You must confirm any certificate requests. - *Installing the CEF (Chromium Embedded Framework) browser*. This is an embedded browser used by *Ivanti Secure Access Client* for SAML-based login and to display the *nZTA* end-user portal applications page. - *Completion of the connection*. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/VgOB9_UUCS5gzhz47t5qc_pulsesecureclientztaubuntusuccess.png" alt="nZTA Linux ZTA Connection Success" position="flex-start" size="54" width="544" height="222" initialPath="img/pulse_secure_client_zta_ubuntu_success.png" githubPath="img/pulse_secure_client_zta_ubuntu_success.png" showCaption="false"} :::Paragraph{indent="2"} *nZTA* Linux ZTA Connection Success ::: Onboarding is then complete. :::hint{type="info"} To learn more about how *Ivanti Secure Access Client* maintains a connection with the *Controller*, and how user sessions are validated with your *nZTA Gateway*s, see [Introduction](docId\:LOWTLfGQBiadNKrcw9BlV). ::: 10. (Optional) If your sign-in authentication policy is configured for Multi-Factor Authentication, you might be required to complete a TOTP (Time-based One Time Password) secondary authentication step each time you sign in. For a first time login, the user is presented with a TOTP registration page: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/WcCe1So1KT33cLwc1AsRs_clienttotpreg.png" alt="First-time login TOTP registration" position="flex-start" size="80" width="1430" height="809" initialPath="img/client_totp_reg.png" githubPath="img/client_totp_reg.png" showCaption="false"} First-time login TOTP registration Use this page to add your user details to an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator. If you do not yet have such a two-factor authenticator app installed, do that now. Scan the QR code, or enter the provided text, to add the user details to your authenticator app. Then, store the generated backup codes in a secure location for future retrieval of a lost account. Finally, enter the token code generated by the authenticator app into the box provided, then select **Sign In**. :::hint{type="info"} For future sign-in attempts, the TOTP challenge dialog appears without the registration details or backup codes. As before, you provide the generated token code from your authenticator app into the box provided and select **Sign In**. ::: 11. In a typical enrollment, upon successful authentication to the *Controller*, *Ivanti Secure Access Client* automatically shows the end-user portal applications page through an embedded browser. To re-show this portal at a future time, click the **ZTA** button in the *Ivanti Secure Access ClientnZTA* connection. Alternatively, access your permitted applications from the Linux command line. 12. (Optional) To uninstall *Ivanti Secure Access Client* Linux variants, enter the following command at the prompt and provide a password: ```bash sudo rpm -e pulsesecure [sudo] password for : ``` After the process completes successfully, the Linux client has been removed. :::hint{type="info"} *Ivanti Secure Access Client* Linux variants do not support the use of default gateways. ::: :::hint{type="info"} Device rule types for *Ivanti Secure Access Client* Linux variants are limited to *File*, *Port*, and *Process*. For details of these device rule types, see [Creating Device Policy Rules](docId\:xlYYRE32DuERIDPt7Y8Ep). ::: ## Enrolling an iOS Device :::hint{type="info"} Application discovery and the use of a default Gateway is not supported from iOS mobile devices. ::: :::hint{type="info"} For mobile devices, *Ivanti Neurons for Zero Trust Access* compliance requires iOS v12.0 or later. ::: Before you start this process, you must have an iOS sign-in URL for *nZTA*, based on the tenant FQDN provided by the *Ivanti* DevOps/Support organization. The procedure to enroll your iOS device differs depending on whether you have an existing *Ivanti Secure Access Client* app installed and configured with a connection to a classic VPN product. To enroll an iOS device that has a previous connection to a classic VPN product: 1. Start your iOS device and access its home page. 2. Locate and start the *Ivanti Secure Access Client* app. 3. In the main app menu, select **Enroll To ZTA**: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/NucjjFD9rPeQgVCDxOsgB_mobileappmainmenu.png" alt="The Ivanti Secure Access Client app menu" position="flex-start" size="37" width="366" height="796" initialPath="img/mobileappmainmenu.png" githubPath="img/mobileappmainmenu.png" showCaption="false"} The *Ivanti Secure Access Client* app menu The *Enroll with ZTA* screen appears. 4. The network type auto populates as Zero Trust Access. For Connection Name, specify a descriptive name for this connection. The name you specify appears in the Ivanti Secure Access Client interface. 5. For URL, specify the network that you want to connect to. Enter the nZTA controller URL as provided by the administrator. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/dsorlGybMFLSUXGLTfifY_enrollwithztaios.png" alt="Enter sign-in URL" position="flex-start" size="25" width="247" height="456" initialPath="img/enroll_with_zta_ios.png" githubPath="img/enroll_with_zta_ios.png" showCaption="false"} Enter sign-in URL 6. Click **Add** to save your new connection and the connection displays in the Home page. Click **Enroll** to add the connection and initiate a connection to the network. 7. To complete the enrollment procedure, [follow the remaining steps below](docId\:xlYYRE32DuERIDPt7Y8Ep) To enroll an iOS device with no previous *Ivanti Secure Access Client* installation: 1. Start your iOS device and access its home page. 2. Open the App Store application. 3. In the search function, enter "Ivanti Secure Access Client". ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3iNzyV99_whcKIxyyjdoM_iosisacsearch.png" alt="Searching the iOS App Store for Ivanti Secure Access Client" position="flex-start" size="38" width="384" height="820" initialPath="img/iosisacsearch.png" githubPath="img/iosisacsearch.png" showCaption="false"} Searching the iOS App Store for *Ivanti Secure Access Client* 4. From the search results, locate, download, and install the *Ivanti Secure Access Client* app. The *Ivanti Secure Access Client* app is installed on your device and added to the interface. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3vpINBO-r8b_RB89U6yj8_iconisac.png" alt="Ivanti Secure Access Client App Icon" position="flex-start" size="36" width="355" height="324" initialPath="img/icon_isac.png" githubPath="img/icon_isac.png" showCaption="false"} *Ivanti Secure Access Client* App Icon 5. Start the *Ivanti Secure Access Client* app. The welcome screen appears. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/9kDvjsHckjav60PMX-aKg_mobileappwelcomeios.png" alt="Ivanti Secure Access Client Welcome Screen" position="flex-start" size="80" width="828" height="1792" initialPath="img/mobileappwelcome_ios.png" githubPath="img/mobileappwelcome_ios.png" showCaption="false"} *Ivanti Secure Access Client* Welcome Screen 6. On the welcome screen, enter the *nZTA* sign-in URL provided in your invitation email. For example, - Custom: “https\://tenant1.mycompany.com/login/\/”. - Default: “https\://tenant1.mycompany.com/login/enroll” 7. Click **Connect**. 8. To complete the enrollment procedure, [follow the remaining steps below](docId\:xlYYRE32DuERIDPt7Y8Ep) For both of the previous iOS device procedures, continue with the following steps: 1. Perform any required authentication for enrolling. (Local or Azure AD credentials) The **Connections** screen appears. 2. Accept any request to download a VPN configuration from the *Controller*. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/hhzJdBaadgpZVAJihcjfR_iosdownloadvpn.png" alt="Adding VPN Configuration" position="flex-start" size="80" width="828" height="1792" initialPath="img/ios_download_vpn.png" githubPath="img/ios_download_vpn.png" showCaption="false"} Adding VPN Configuration After the *nZTA* profile is added to your Client configuration, the compliance of the device is checked. Then, session information is gathered and a VPN tunnel to the *Controller* is created automatically. This is indicated in the iOS status bar. The **Connections** screen shows the active *Controller* connection: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/mmn33SN2-D7Vwl4tzCxYd_iosconnected.png" alt="iOS Active nZTA Connection" position="flex-start" size="80" width="1242" height="2688" initialPath="img/ios_connected.png" githubPath="img/ios_connected.png" showCaption="false"} iOS Active *nZTA* Connection :::hint{type="info"} To learn more about how *Ivanti Secure Access Client* maintains a connection with the *Controller*, and how user sessions are validated with your *nZTA Gateway*s, see [Introduction](docId\:LOWTLfGQBiadNKrcw9BlV). ::: 3. (Optional) If your sign-in authentication policy is configured for Multi-Factor Authentication, you might be required to complete a TOTP (Time-based One Time Password) secondary authentication step each time you sign in. For a first time login, the user is presented with a TOTP registration page: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/wVn84sOQKi5NINbX11vnL_mobiletotpreg.png" alt="First-time sign in TOTP registration" position="flex-start" size="80" width="828" height="1792" initialPath="img/mobile_totp_reg.png" githubPath="img/mobile_totp_reg.png" showCaption="false"} First-time sign in TOTP registration Use this page to add your user details to an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator. If you do not yet have such a two-factor authenticator app installed, do that now. Scan the QR code, or enter the provided text, to add the user details to your authenticator app. Then, store the generated backup codes in a secure location for future retrieval of a lost account. Finally, enter the token code generated by the authenticator app into the box provided, then tap **Sign In**. :::hint{type="info"} For future sign-in attempts, the TOTP challenge dialog appears without the registration details or backup codes. As before, you provide the generated token code from your authenticator app into the box provided and select **Sign In**. ::: 4. (Optional) Tap the **Disconnect** button to manually disable the *nZTA* connection. This facility overrides the on-demand connection feature and prevents *Ivanti Secure Access Client* from connecting to the *Controller* or any *nZTA Gateway*s. By tapping this button, your *nZTA*-protected applications become inaccessible until the connection is restored. For more details, see [Disabling the nZTA Connection](docId\:xlYYRE32DuERIDPt7Y8Ep). 5. (Optional) Tap the connection to view the connectivity status. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/uqmum43wqM0ueJD3gKewA_iosconnectedstatus.png" position="flex-start" size="80" width="1242" height="2688" initialPath="img/ios_connected_status.png" githubPath="img/ios_connected_status.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} iOS Connectivity Status ::: To use a supported app, start the app as usual from the iOS interface, and enter any credentials if requested. ### Installing a Beta Release of the iOS Client Periodically, *Ivanti* might make available a pre-release *beta* version of *Ivanti Secure Access Client* for iOS for limited testing purposes. Beta releases of *Ivanti Secure Access Client* for iOS use the TestFlight package, a third-party app that enables users to download and test pre-GA packages of products. To learn more about TestFlight, see [https://testflight.apple.com/](https://testflight.apple.com/). Before you start, you must: - Have an iOS sign-in/enrollment URL for *nZTA*, as provided by the *Ivanti* DevOps/Support organization. - Install and register the TestFlight package from the Apple App Store. - Configure TestFlight to have access to the *Ivanti Secure Access Client* app, using information provided by the *Ivanti* DevOps/Support organization. To enroll a beta client on your iOS mobile device: 1. Locate and start the TestFlight app. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/mfgGAckObd2DrTvss5OC7_icontestflight.png" alt="TestFlight App Icon" position="flex-start" size="10" width="82" height="97" initialPath="img/icon_testflight.png" githubPath="img/icon_testflight.png" showCaption="false"} TestFlight App Icon 2. In the TestFlight app, select the *Ivanti Secure Access Client* app and install it. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/e7v0cD5mp1tSoYULPTmhR_iostestflightappinstall.png" alt="TestFlight Ivanti Secure Access Client App Install" position="flex-start" size="47" width="465" height="276" initialPath="img/ios_testflight_app_install.png" githubPath="img/ios_testflight_app_install.png" showCaption="false"} TestFlight *Ivanti Secure Access Client* App Install 3. After the app installs, it is added to the iOS interface. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3vpINBO-r8b_RB89U6yj8_iconisac.png" alt="Ivanti Secure Access Client App Icon" position="flex-start" size="36" width="355" height="324" initialPath="img/icon_isac.png" githubPath="img/icon_isac.png" showCaption="false"} *Ivanti Secure Access Client* App Icon 4. Continue to enroll the device using the standard iOS Client enrollment procedure. Start the *Ivanti Secure Access Client* app and [follow the remaining steps](docId\:xlYYRE32DuERIDPt7Y8Ep). ## Enrolling an Android Device :::hint{type="info"} Application discovery and the use of a default Gateway is not supported from Android devices. ::: :::hint{type="info"} For mobile devices, *Ivanti Neurons for Zero Trust Access* compliance requires Android v8.0 or later. ::: Before you start this process, you must: - Have an Android sign-in URL for *nZTA*, based on the tenant FQDN provided by the *Ivanti* DevOps/Support organization. - (For testing pre-GA/Beta *Ivanti Secure Access Client* packages only) Have an invitation email from your *Ivanti* representative that describes how to access pre-GA builds of the *Ivanti Secure Access Client* app from the Google Play store. The procedure to enroll your Android device differs depending on whether you have an existing *Ivanti Secure Access Client* app installed and configured with a connection to a classic VPN product. To enroll an Android device that has a previous connection to a classic VPN product: 1. Start your Android device and access its home page. 2. Locate and start the *Ivanti Secure Access Client* app. 3. In the main app menu, select **Enroll To ZTA**: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/NucjjFD9rPeQgVCDxOsgB_mobileappmainmenu.png" alt="The Ivanti Secure Access Client app menu" position="flex-start" size="37" width="366" height="796" initialPath="img/mobileappmainmenu.png" githubPath="img/mobileappmainmenu.png" showCaption="false"} The *Ivanti Secure Access Client* app menu The *Enroll with ZTA* screen appears. 4. The network type auto populates as Zero Trust Access. For Connection Name, specify a descriptive name for this connection. The name you specify appears in the Ivanti Secure Access Client interface. 5. For URL, specify the network that you want to connect to. Enter the nZTA controller URL as provided by the administrator. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/dsorlGybMFLSUXGLTfifY_enrollwithztaios.png" alt="Enter sign-in URL" position="flex-start" size="25" width="247" height="456" initialPath="img/enroll_with_zta_ios.png" githubPath="img/enroll_with_zta_ios.png" showCaption="false"} Enter sign-in URL 6. Click **Add** to save your new connection and the connection displays in the Home page. Click **Enroll** to add the connection and initiate a connection to the network. 7. To complete the enrollment procedure, [follow the remaining steps below](docId\:xlYYRE32DuERIDPt7Y8Ep). To enroll an Android device with no previous *Ivanti Secure Access Client* installation: 1. Start your Android device and access its home page. 2. Locate the *Ivanti Secure Access Client* app in the Google Play store and install it. :::hint{type="info"} If you are testing pre-GA/Beta builds of *Ivanti Secure Access Client* for Android, use the instructions provided in your invitation email to locate and download applicable pre-GA *Ivanti Secure Access Client* app builds in the Google Play store. ::: After the app installs, it is added to the Android interface. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/T5gKXlNkZb3Jt-4SnRLYD_iconpulsesecureandroid.png" alt="Ivanti Secure Access Client App Icon" position="flex-start" size="15" width="146" height="182" initialPath="img/icon_pulse_secure_android.png" githubPath="img/icon_pulse_secure_android.png" showCaption="false"} *Ivanti Secure Access Client* App Icon 3. Start the *Ivanti Secure Access Client* app. The welcome screen appears. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/0gEqg8P2oq_RqI2VeTqBR_mobileappwelcomeandroid.png" alt="Ivanti Secure Access Client Welcome Screen" position="flex-start" size="63" width="626" height="1326" initialPath="img/mobileappwelcome_android.png" githubPath="img/mobileappwelcome_android.png" showCaption="false"} Ivanti Secure Access Client Welcome Screen 4. Enter the corporate email or *nZTA* sign-in URL. For example, - Custom: “https\://tenant1.mycompany.com/login/\/”. - Default: “https\://tenant1.mycompany.com/login/enroll” 5. Click **Connect**. 6. To complete the enrollment procedure, [follow the remaining steps below](docId\:xlYYRE32DuERIDPt7Y8Ep). \_For both of the previous Android device procedures, continue with the following steps: 1. Perform any required authentication for enrolling. (Local or Azure AD credentials) :::hint{type="info"} When using Azure AD authentication during onboarding, if you select "No" at the "Stay Signed In" prompt, you must re-enter your AD credentials whenever the login page prompts. To avoid this, make sure you select *Yes* at the **Stay Signed In** page. ::: The compliance of the device is checked, session information is gathered, and a VPN tunnel to the *Controller* is created automatically. This is indicated by a key icon and a *Ivanti Secure Access Client* icon. The **Connections** screen shows the active *Controller* connection: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/v6o_qBjKKGb9e3vHZPbe1_androidconnected.png" alt="Android Active nZTA Connection" position="flex-start" size="80" width="855" height="634" initialPath="img/android_connected.png" githubPath="img/android_connected.png" showCaption="false"} Android Active *nZTA* Connection :::hint{type="info"} To learn more about how *Ivanti Secure Access Client* maintains a connection with the *Controller*, and how user sessions are validated with your *nZTA Gateway*s, see [Introduction](docId\:LOWTLfGQBiadNKrcw9BlV). ::: 2. (Optional) If your sign-in authentication policy is configured for Multi-Factor Authentication, you might be required to complete a TOTP (Time-based One Time Password) secondary authentication step each time you sign in. For a first time login, the user is presented with a TOTP registration page: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/wVn84sOQKi5NINbX11vnL_mobiletotpreg.png" alt="First-time sign in TOTP registration" position="flex-start" size="80" width="828" height="1792" initialPath="img/mobile_totp_reg.png" githubPath="img/mobile_totp_reg.png" showCaption="false"} First-time sign in TOTP registration Use this page to add your user details to an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator. If you do not yet have such a two-factor authenticator app installed, do that now. Scan the QR code, or enter the provided text, to add the user details to your authenticator app. Then, store the generated backup codes in a secure location for future retrieval of a lost account. Finally, enter the token code generated by the authenticator app into the box provided, then tap **Sign In**. :::hint{type="info"} For future sign-in attempts, the TOTP challenge dialog appears without the registration details or backup codes. As before, you provide the generated token code from your authenticator app into the box provided and select **Sign In**. ::: 3. (Optional) Tap the **Disconnect** button to manually disable the *nZTA* connection. This facility overrides the on-demand connection feature and prevents *Ivanti Secure Access Client* from connecting to the *Controller* or any *nZTA Gateway*s. By tapping this button, your *nZTA*-protected applications become inaccessible until the connection is restored. For more details, see [Disabling the nZTA Connection](docId\:xlYYRE32DuERIDPt7Y8Ep). 4. (Optional) Tap the connection to view the connectivity status. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/EDxFBSgrskStjLU7P8Y-J_androidconnectedstatus.png" alt="Android Connectivity Status" position="flex-start" size="38" width="382" height="771" initialPath="img/android_connected_status.png" githubPath="img/android_connected_status.png" showCaption="false"} Android Connectivity Status 5. (Optional) Tap the page to view the Gateway Status. For example: ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/ztK4J_kMz6EY7k444DUE0_androidconnectedvpnstatus.png" alt="Android Gateway Status" position="flex-start" size="36" width="364" height="769" initialPath="img/android_connected_vpn_status.png" githubPath="img/android_connected_vpn_status.png" showCaption="false" indent="1"} :::Paragraph{indent="1"} Android Gateway Status ::: 6. (Optional) Tap the left arrow to return to the **Connections** screen. To use a supported app, start the app as usual from the Android interface, and enter any credentials if requested.