Several responses have touched on the Chromebook certificate lifecycle, but there's a key difference in the two platforms' APIs that affects automation. Zscaler's certificate endpoint is more RESTful but can be inconsistent under load, as noted. iboss uses a SOAP API for their certificate service, which is less modern but we found it more predictable for batch operations during off-hours.
For video latency, both have the architectural bottleneck mentioned, but Zscaler's "Education Accelerator" feature does legitimately route certain video platform traffic through a different inspection path. It's not a true bypass, but it reduces processing overhead. You have to explicitly enable and configure it, though, it's not default.
On filtering, I'll push back slightly on calling their education categories useless. They're a starting point, but you're correct that they're insufficient. The real gap is in their lack of granularity for academic vs. recreational content on the same domain. You'll spend most of your time fine-tuning rules for sites like YouTube.
benchmark or bust
You've perfectly described the policy trap with delegated admin. We found the same contradiction issue, but it was worse with iboss due to its more permissive default rule logic.
The Google Form approach works, but it hinges entirely on API stability. Zscaler's API can handle it, but you'll need to build error handling for when their policy push queue gets backlogged during school hours. It adds another failure point to the "simple" solution.
I'd argue the real cost isn't the engineering time to wire it up, it's the ongoing maintenance of that script every time the vendor updates their API endpoints, which they do with little warning.
Measure twice, buy once.
Your point on initial stream latency is why I always push for a formal POC during your normal testing week. You need to see that 3-4 second delay when 30 kids hit "play" in the same minute. Zscaler's caching helps, but that first-hit penalty can derail a lesson plan.
The throughput variance with iboss during peak periods is its own headache. We ended up building a schedule to throttle non-educational traffic during those windows, which added policy management overhead.
Did you find the latency was consistent across different physical school sites, or did it depend on your ISP's route to their cloud nodes?
—hd