Private Access for ZTNA

ObjectiveThe current Private App Segment definition conflicts with what is described in the Netskope Knowledge Base article.When Publisher DNS is enabled, both IP and URL must be defined in the host configuration of a private app segment.Reference:https://docs.netskope.com/en/private-access-best-practices#idm46139539889184In docs.goskope.com, enabling Publisher DNS can still only use URL to define Private app, 2026/1/6 PrerequisiteThis issue generally applies to Netskope Private App Segments Definitions. ContextWe observed that in the current Netskope Private App Segment configuration, once Publisher DNS is enabled, users are unable to access a private application if only the private app URL is defined. Do You Know?This mechanism appears redundant. Once Publisher DNS is enabled, it is possible to configure a random port for the URL and then define a separate policy using the private IP with the correct port, since users can no longer access the URL using the originally defined port.Thi

There is a business need to have a desktop shortcut created to complete Re-authenticate Private Access.

Hi Teams, i’m try to find the CMD reference for publisher CLI to change the host name and username of default user on publisher ssh but cannot find in the knowledge KB from netskope. so i wonder is it possible to change the hostname of publisher and change the default username from ubuntu ?is they any issue if we change this parameter on publisher?i’m also need to change the same for cloud exchange server too.

WSL will work on windows , This info is not mentioned in netskope site (Windows Linux Subsystem)go to WSL settings change the networking mode to “ VirtioProxy” save it then run your commands , it should work In netskope tenant , you can see the logs refer to your laptop name . 

We have periodic reauthentication enabled for users, but on mobile devices, although a pop-up notification appears, users cannot view or be redirected to complete the  Periodical IdP Re-authentication to restore private app access.Is there any guidance available for this configuration?

What is currently supported to passthrough Phish-Resistant MFA methods like passkeys from unmanaged devices over Reverse proxy, universal reverse proxy and NPA browser access steering methods? We are moving to enforcing phish-resistanct MFA and need to understand what is supported and what has been tested. If this is not currently supported, is this on the roadmap or would this require the use of enterprise browser?  

Hi Team, Is it possible to integrate/ install AD agent so that we can apply client configuration based on OU. and Use Entra ID integration for SSO? Just for Sign-in.  Possible that we can use OU to provide access to private resources.? One way is to create groups and provide access to private resources and apply client configuration group or all users. Since we have multiple branch offices. we need to create many Groups and import in Entra ID.  So wondering if we can enable private access based on OU and apply client configuration based on OU as well.

Does anyone have any experience with allowing Partner Access for a 3rd party? We are thinking through building out device classification rules for a potential Partner Access use-case and it got me thinking about this topic. what will we see in Devices in our tenant for these devices? I assume we won’t have any “enable”/”disable” options but want to be sure safeguarding our partner safeguarding our environment

Use case: Our Support team can connect other users’ laptop with AOVPN feature but with zero Trust is blocking the admin drive access.In this user case, Support team can access the laptop CAL-XXX for Admin related activities but with Zero trust its not possible so what is the alternative solution? Is there any tool ? which can be used 

When running a query against “/api/v2/infrastructure/publishers” the list of to be returned fields can be attached. However it seems that only fields from the first level of the JSON can be selected. Does anyone know, if other fields e.g. assessment[latency], can be referenced in the field-list as well? And how? Thanks Timo

Team, Good morning. I’m using NPA to connect to Azure Databricks via Private Link’s.My initial connection works fine but the connection fails on the second attempt.I must clear the cache on the endpoint and disable/enable all clients services in the Netskope console for the connection to work again.When the connection fails, I get the error message below. Has everyone experience this issue connecting to Azure Databricks using NPA?   

Hi, I'm having a hard time with the netskope client on Linux. This is a WSL2 installation, and a netskope agent is running on the windows host. But the windows agent status has no influence on the behavior of the guest linux one. Very often, the nsclient config outputs a normal status with tunnel up, and private access enabled. Unfortunately the show-pa show this :  $ nsclient show-pastart process....Status: Connected (User Tunnel) Sent: 0 bytes Received: 78646 bytes and the nsdebuglog.log is spammen with this kind of errors : 2025/09/16 20:21:00.358996 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:01.381263 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:02.404470 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:25.547248 stAgentSvc p47489 t4755c error nsKernelUserShim.

Hello,I would like to know if it is possible to allow copy and paste when using ZTNA in browser access mode.If yes, could you please provide guidance on how to configure it?Thank you 

Some of my users are reporting errors when trying to connect to a SQL Server over NPA. The connection is successful but is erroring out due to a cert trust issue: The SQL server has forced encryption turned on; I have verified that the remote host is able to connect over the required ports.Is there another configuration that is needed to allow NPA to work with SQL Server Forced Encryption, do I need to deploy the Netskope Cert to the SQL servers? 

Refer to case 00555037. The main reasons we have this requirement is because our IdP domain myid.ladwp.com is within the App Discovery list *.ladwp.com (which allows users access to all internal hosts within this domain). However, the problem is that NPA is steering this myid.ladwp.com domain as a Private App, which causes Okta admins to always see the gateway IP as on-premise. Okta administrators need to see the XFF/Gateway IP. So if a user is working at home or from a remote network, Okta Admins should see that remote network XFF IP address, not our DWP public IP address. When Okta evaluates the IP chain, it uses this XFF IP address to determine whether or not to MFA challenge. At the moment, a remote user always appears to be on-premise from Okta's perspective. This is a problem that we'd like to solve. Hoping you can provide a way to perform NPA bypass similar to how there is steering bypass for SWG/CASB/CFW. Another strong use case is when on-premise detection feature is used, in

I searched and had a hard time finding much on this, but basically, I am deploying NPA across my organization and some server admins (notably using Macs) have run into hostkey mismatches when SSHing into servers behind NPA. Does anyone have experience, specifically, with managing SSH host keys to servers when migrating to use NPA?

Searching the forums and I couldn’t find an answer. We have the need to print, to on-prem printers (via a print server), for remote users.I’ve created the Private App for the Print Server with the following portsTCP 135,137,139,445,631,9100UDP 135,137,139,445,631,9100But it doesn’t seem to be working. Although management (via mmc) of the print server is fine.Any idea?I don’t think I need to create a Private App for the printer(s) themselves, since the Print Server should be the connection manager / proxy for that traffic.

How can i access private applications using enterprise browser? I tried creating a realtime policy with “access method” as one of the criteria but couldn’t find enterprise browser in the option. additionally i tried to create an enterprise browser protection policy for private apps but the option is grayed out.

I think that it would be helpful to have a button (or something) to do a SSH to the publisher directly from the tenant.

Good evening, everyone, I will be using the steering “Specific Private Apps” in my dynamic steering configuration. I usually steer all private apps, but I have a use-case for one application for my on-premises users. Do I need to add the private app to a real-time policy for this to work? It looks like I only need to add the specific private app to the steering configuration. See attached screenshots. Thanks. 

We would like to control the Private application (Client based access) with Time bound & Geolocation for the users.The Client based Private application defined policy doesn’t have the source IP as match criteria for identifying the users Geolocation. The Private Application policy doesn’t have the policy schedule option like the Cloud app or the web access policies.We are expecting whether this can be achieved with the Netskope or addressed by Netskope in the future releases.Thank you.

Hello Netskope Community, we want to use netskope on a azure virtual desktop environment which uses FSLOGIX.But sadly we don’t get it running. We configured the installation of the client in the golden image with the multisuser modecommand:tenant=igz domain=de.goskope.com installmode=IDP mode=peruserconfig enrollauthtoken=*token*enrollencryptiontoken=*token* autoupdate=on /qnthere would be a npavdimode as well but as far as I understood this mode is only needed when all  users should use the same tunnel on the vdi.We want that the user on the vdi needs to logon to the client with his azure user, so he has his personal tunnel up with his own private app permissions. On the first logon on sessionhost A it works without any problems.If I relogon and get on sessionhost B my npa will not connecting anymore. We think that on the first logon my client genereates an encryption key to safe the client settings. And on sessionhost B this wont match anymore.we are getting the following errors in t

It would be great if Multi Factor Authentication Integration will be provided for Manage Engine. Our corporation is using Manage Engine for multiple applications for Multi Factor Authentication. If Integration of Netskope for Manage Engine will be supported/ provided, then we would be leveraged to use the same solution for Multi Factor especially for NPA. For NPA all forum & Garner suggest for enabling multi factor for best security strategy. 

If I look at the instructions for configuring prelogon, then this seems to require a reinstall of the client with the correct “prelogonuser=<user>@prelogon.netskope.com” command line parameter.The “nsdiag” command does have a few extra things up its sleave, including update of the secure enrollment tokens.Is there a (hidden) option to also allow adding a prelogon user to an already installed client? --Erik

Hello all,I’d like to check if someone recently enabled the Session Recording feature in Browser Private Access.Additionally, could someone please explain how this feature works and what exactly is being recorded?  Thanks in advance