SurePath AI

Route GenAI traffic to SurePath AI using existing infrastructure. Choose SASE integration (Zscaler, Netskope, Cloudflare) for proxy chaining, or Proxy PAC URL deployment through MDM platforms (Intune, Jamf, Google Workspace, Rippling, Active Directory Group Policy). Includes PowerShell deployment scripts, PAC customization options, authentication methods, verification with ready.surepath.ai, and manual testing for POC.

Network integration

Explains SASE Forward-to-Proxy and Proxy PAC URL traffic flows with/without TLS inspection. Covers authentication methods (XAU, connector, user) and network endpoints with diagrams.

SurePath AI Traffic Flows

Describes PAC functionality: how it works, obtaining URL, addService/removeService customization, chaining, fail-open, unsupported agents, and services.json preview.

Overview of SurePath AI PAC Files

Describes verifying traffic interception using ready.surepath.ai with Certificate Trust and Network Configuration tests. Covers interpreting results and troubleshooting.

Verifying the SurePath AI integration

Technical reference for network integration mechanics. Covers PAC file behavior (customization, proxy chaining, fail-open handling), traffic flow comparisons for SASE vs Proxy PAC with and without TLS inspection, authentication methods (X-Authenticated-User header, connector-based, user-based), required endpoints and ports, plus verification troubleshooting with ready.surepath.ai.

Integration details

Describes Zscaler SASE integration via Forwarding Control and Tunnel 2.0. Covers custom URL category, X-Authenticated-User header, and root CA trust requirements.

Zscaler - Proxy chaining

Describes Netskope SASE integration via Forward-to-Proxy using custom URL category from public services catalog. Covers X-Authenticated-User header and root CA trust.

Netskope - Proxy chaining

Describes Cloudflare SASE integration using Secure Web Gateway DNS and HTTP policies. Covers the X-Authenticated-User header built from Cloudflare identity variables, the X-SP-Connector-ID header, catalog download, and verification.

Cloudflare - Secure Web Gateway

Palo Alto Prisma Access - Proxy chaining (Preview)

Step-by-step SASE integration guides for Zscaler (Forwarding Control policies and Tunnel 2.0 configuration), Netskope (Forward-to-Proxy with steering rules), and Cloudflare (Secure Web Gateway with DNS/HTTP policies and WARP client). All guides include custom URL category configuration, authentication header setup (X-Authenticated-User), root CA installation requirements, and verification testing procedures.

SASE

Describes MDM files: Windows PowerShell deployment and detection scripts (single/multi-user, email detection, SCCM/ConfigMgr support) and Apple profiles for JAMF/Intune. Covers ChatGPT certificate pinning, PAC URL parameters, and user identification.

Using SurePath AI Proxy PAC MDM files

Describes deploying proxy PAC URL and root CA to Windows via Intune using PowerShell or OMA-URI. Covers single/shared device modes, email identification, and verification.

Microsoft Intune - Distributing configuration for Windows

Describes deploying SurePath AI proxy PAC URL and root CA to macOS via Intune custom profiles. Covers email/UDID identification and verification.

Microsoft Intune - Distributing configuration for macOS

Describes deploying proxy PAC URL and root CA to Apple devices (macOS, iOS, iPadOS) via Jamf Pro profiles. Covers email/UDID identification and verification.

Jamf Pro - Distributing Configuration for Apple devices

Describes configuring Google Workspace user policy for proxy PAC URL and root CA on Chrome/ChromeOS. Covers limitations (iOS not supported, CA only for ChromeOS/Android).

Google Workspace - Distributing Configuration to Chrome and ChromeOS

Describes deploying proxy PAC URL and root CA to Windows via Rippling using PowerShell scripts (no native profiles). Covers Scripts tab deployment and verification.

Rippling - Distributing Configuration for Windows

Describes deploying proxy PAC URL and root CA to macOS via Rippling using Global HTTP Proxy and Certificate Root configs. Covers macOS library paths and verification.

Rippling - Distributing Configuration for MacOS

Describes distributing proxy PAC URL and root CA via AD Group Policy using PowerShell or manual GPO. Covers single/shared device modes, email identification, and verification.

Active Directory - Distributing Configuration for Windows

Deploy proxy configuration across managed devices using MDM platforms. Guides cover Intune (Windows/macOS with PowerShell), Active Directory Group Policy (domain-joined Windows), Jamf Pro (Apple configuration profiles), Google Workspace (Chrome/ChromeOS), and Rippling. Includes PowerShell deployment references with email-based user identification and Apple mobileconfig profile creation.

Proxy via MDM

Describes Chrome DoH setup on Windows for POC/pilot using doh.surepath.ai/dns-query. Covers Chrome config, root CA, and bypass limits. Not for production; use PAC or SASE.

Microsoft Windows Setup

Describes Chrome DoH setup on macOS for POC/pilot using doh.surepath.ai/dns-query. Covers Chrome config, root CA, and bypass limits. Not for production; use PAC or SASE.

Apple macOS Setup

Quick setup for POC and pilot testing using Chrome browser DNS-over-HTTPS on macOS or Windows. Provides rapid testing capability without MDM deployment. Not recommended for production environments; enterprise deployments should use Proxy PAC URL via MDM or SASE integration for proper management, policy enforcement, and updates.

DNS-Over-HTTPS (DOH) (POC only)

Quick manual installation of proxy PAC URL and root CA on macOS for testing/POC. Production deployments should use MDM (Intune, Jamf Pro, Rippling).

Manual Installation of PAC URL and Root CA on macOS (Testing Only)

Quick manual installation of proxy PAC URL and root CA on Windows for testing/POC. Production deployments should use MDM (Intune, AD Group Policy, Rippling).

Manual Installation of PAC URL and Root CA on Windows (Testing Only)

Manual installation procedures for quick testing or POC deployments on individual devices. Step-by-step guides for proxy PAC URL and root CA installation on macOS and Windows. Use only for pilot testing and evaluation; production deployments must use MDM platforms (Intune, Jamf Pro, Active Directory Group Policy, Rippling) for proper management, centralized updates, and policy enforcement.

Manual Installation (Testing Only)

No tickets or conversations found

Try selecting a different creation date range.

Tickets and conversations you've started through the messenger will appear here.

No tickets or conversations created by you

Try using different keywords or checking for typos.

Try selecting a different update date range.

Find answers and get help from Intercom Support and Community Experts

Conversations you've started through the messenger will appear here.

No conversations created by you

No conversations found

AI title

Title

This site employs cookies and other technologies that we and our third party vendors use to monitor and record personal information about you and your interactions with the site (including content viewed, cursor movements, screen recordings, and chat contents) for the purposes described in our Cookie Policy. By continuing to visit our site, you agree to our {websiteTermsLink}, {privacyPolicyLink} and {cookiePolicyLink}.

This site uses cookies and similar technologies ("cookies") as strictly necessary for site operation. We and our partners also would like to set additional cookies to enable site performance analytics, functionality, advertising and social media features. See our {cookiePolicyLink} for details. You can change your cookie preferences in our Cookie Settings.

We use cookies to make our site work and also for analytics and advertising purposes. You can enable or disable optional cookies as desired. See our {cookiePolicyLink} for more details.

Advertising cookies are set by our advertising partners to collect information about your use of the site, our communications, and other online services over time and with different browsers and devices. They use this information to show you ads online that they think will interest you and measure the ads' performance. Social media cookies are set by social media platforms to enable you to share content on those platforms, and are capable of tracking information about your activity across other online services for use as described in their privacy policies.

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

These cookies are necessary for the website to function and cannot be switched off in our systems.

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site.

You have the right to opt out of the sale of your personal information. See our {cookiePolicyLink} for more details about how we use your data.

Your Privacy Choices

We use cookies to enhance your experience. You can customize your cookie preferences below. See our {cookiePolicyLink} for more details.

Cookie Settings

Empty Help Center

Uh oh. That page doesn’t exist.

Home

Search results

Disappointed

Neutral

Smiley

Thinking...

Searching through sources...

Analyzing...

Tickets submitted through the messenger or by a support agent in your conversation will appear here.

No tickets created by you

No tickets found

Conversations and tickets in {topic}

Conversations and tickets in {topic} // {subtopic}

Volume, creators and topics for your company.

Insights

Top creators

AI topics

Track the progress of all tickets and conversations related to your company.

Customer Portal.

Track the progress of all tickets related to your company.

Tickets portal.

{assigneeName} needs more information from you

Tickets

No access to tickets portal

Search

Skip the search. Describe what you’re trying to do and get a grounded answer.

Browse articles and guides in this topic.

Create your workspace and invite the people you work with.

Set up your account

Build your first workflow and watch it run end to end.

Ship something

Connect the tools your team already uses to bring data in.

Connect your stack

A quick lap of the product so you know where everything lives.

{appName} in 60 seconds

This prototype demo is aware that you are reading “{title}”. It can point you back to the current article, but a production article-aware Fin contract is still follow-up work.

Prototype article-aware answer

Because you already asked about invitations, this prototype demo can add the follow-up: use the role selector before sending each invite to limit access to the teammate responsibilities.

Prototype role-limiting follow-up

This prototype demo suggests starting with your workspace profile, inviting the team members who need access, and then connecting the integrations you use.

Prototype getting-started answer

In this prototype demo, integrations are configured from workspace settings. Choose the integration, connect the account, and review the enabled permissions.

Prototype integrations answer

In this prototype demo, invite teammates from workspace settings, then choose the access each teammate needs before sending the invitation.

Prototype invite-team answer

This prototype demo does not have a scripted answer for that question yet. Try asking how to invite your team or open a source article. No production Fin API was called.

Prototype answer unavailable

I’ve got this page open. Ask me anything about it and I’ll answer from the docs.