When creating an installer package or using the command-line for installation, which Zscaler Client Connector...

The cloudName and userDomain installer options let Client Connector identify the correct Zscaler cloud and automatically route the user to the corporate SAML IdP. This removes user choice and reduces onboarding errors during first launch. Option C (--cloudName and --userDomain) is correct because those parameters provide cloud and domain discovery for SAML redirection.

Why the other options are incorrect:

A. --deviceToken and --strictEnforcement: deviceToken is used for device enrollment workflows, not for every SAML redirection or strict-enforcement scenario.

B. This is automatic when SAML is configured. No options are required: SAML provides browser-based federation by carrying signed assertions from the identity provider to the service provider.

D. --policyToken and --userDomain: userDomain tells Client Connector the user login domain so it can route enrollment toward the right IdP.