Adding the exact FQDN and TCP/UDP port won't be sufficient. During SAP transaction there are other services that are being access suchas kerberos since there will an authenticating service requests between trusted hosts across an untrusted network.
We recommend to take a packet capture from Zscaler Client Connector while the user is trying to access the application that is having the issue.
After exporting the logs > Open ZSATunnel > Filter: not zpn domain
