zia-check-user-url-access

ZIA: Check User URL Access

Keywords

can user access, is url blocked, why blocked, url access check, user access, policy evaluation, url allowed, access denied, troubleshoot access, blocked site, user policy

Overview

Determine whether a specific user (or group/department) can access a given URL by evaluating all applicable ZIA policies in priority order. This skill simulates the policy evaluation engine by checking URL category classification, then walking through URL filtering, SSL inspection, DLP, and firewall rules to produce a definitive access verdict with full reasoning.

Use this skill when: An administrator asks whether a user can access a specific URL, why a URL is being blocked, or needs to understand which policy rules affect access for a specific user.

---

Workflow

Follow this 6-step process to evaluate user URL access.

Step 1: Identify the User and URL

Collect from the administrator:

• URL to check (e.g., "chat.openai.com", "github.com")
• User identifier -- username, email, group name, or department

Look up the user:

get_zia_users(search="<username_or_email>")
```text

Note the user's:

- User ID
- Department (ID and name)
- Groups (IDs and names)

If the admin specified a group or department instead:

```text
get_zia_user_groups(search="<group_name>")
get_zia_user_departments(search="<department_name>")
```text

---

### Step 2: Classify the URL

```text
zia_url_lookup(urls=["<url>"])
```text

This returns:

- `urlClassifications` -- the category(ies) the URL belongs to
- `urlClassificationsWithSecurityAlert` -- whether there are security alerts

Note all categories returned. A URL can belong to multiple categories.

#### Example

```text
URL: chat.openai.com
Categories: AI/ML Applications, Technology
Security Alert: None
```text

---

### Step 3: Evaluate URL Filtering Rules

```text
zia_list_url_filtering_rules()
```text

Walk through rules in **order** (lowest order number = highest priority). For each rule, check if it matches: