IDENTITY & ACCESS / INTERACTIVE ARCHITECTURE

One login. Three control points.

Follow a user’s browser through Zscaler ZIA to Splunk Cloud, with Microsoft Entra providing SAML single sign-on.

Splunk Cloud search web UI IP allow list

Editable simulation only. Documentation addresses are placeholders. Model actual ZIA egress addresses used for your organisation, including permitted failover paths. The client’s private IP and Entra server IP are not the source of the browser ACS POST.

Browser-mediated sign-in & DNS resolution

Dashed boxes: platform boundariesGreen: active routeArrows: current message directionDashed blue links: DNS; double arrows: query / answer
DNS RESOLUTION · ILLUSTRATIVE SPLUNK-MANAGED AWS ENDPOINT DNS resolverZIA resolution context example.splunkcloud.comOriginal HTTPS / ACS hostname AWS-hosted Splunk endpointdemo-splunk-123.ap-southeast-2.elb.amazonaws.com · example A / AAAA192.0.2.40 / .41Example A values Query hostnameCNAME target lookupDestination IPsUSER / MANAGED ENDPOINTZSCALER CLOUDSPLUNK CLOUD PLATFORMMICROSOFT ENTRA TENANTForwardedweb trafficHTTPS / 443HTTPS / 443User browserRedirects · POST · cookiesTraffic forwarding assumed activeZscaler ZIAWeb policy · TLS handlingInternet & SaaS service edgeIP allow list · search-ui · HTTPS 443Splunk Web / SAML SPAssertion validation · role mappingexample.splunkcloud.com / saml/acsMicrosoft Entra / IdPAuthentication · Conditional AccessEnterprise application · SAML claims1 · Hostname request2 · DNS lookup / answer

DNS resolves the Splunk hostname through the illustrative AWS CNAME to destination IPs. HTTPS Host, TLS SNI and ACS retain the original Splunk hostname; the IP allow list checks the source ZIA egress IP. SAML trust is configured between Entra and Splunk. In this standard browser SSO flow, the signed response travels via the browser; there is no direct runtime Entra → Splunk assertion delivery.

Standalone POC · Synthetic values only · No credentials collected or network requests made · v8