I am looking to see if anyone has figured out a trick to isolate configmgr clients which are connecting to the configmgr site via ZPA tunnel. Cannot use IP address as it uses the clients current IP (home subnet, coffee shop etc). All machines connected to local network and connecting via ZPA show as intranet and in same AD site (due to the internal ZScaler connector routing the traffic internally). ZScaler support has not been much help so I am reaching out to see if anyone out here has found the magic ingredient to make this work
