Hello @farhan,

As I understand it, users are being prompted for authentication when accessing apps over NPA?  I assume this is a Windows environment using kerberos and SSO?  If so, then you must configure both the SMB best practices you referenced and the Active Directory best practices found here. If both of these are configured for a POV and you're still seeing auth prompts, we would need to better understand the environment and it might make more sense to reach out to your local Netskope account team or support.  

Hi @sshiflett 

There are two scenarios here 1) the customer wants the auth prompt when user trying to access any prvt apps. Let suppose I try to access perimeter firewall so user get auth prompt to auth (not fw login creds) the basic windows login auth.

Also can we do this necessary to user whenever user turn on laptop they get prompt for internet access by Netskope and for prvt apps as well.

2) there is a network drive they access by //xyz (private IP) and this is i beleive SMB so how can I acheive this what port has been used please let me know.

Hello @farhan,

Scenario 1

Administrators can enable periodic reauth in this case.  This will require the user to authenticate (and MFA) via your identity provider on an interval set by an admin.  They can optionally also require this on logon as well which would include restarts.  The administrator must configure a SAML integration with their identity provider to use this feature.   For more info look here. 

Scenario 2

If they want to access the file share (network drive) by SMB via IP address, then you must ensure that you have an app definition with that IP address and TCP 445 defined.  Please ensure it's also assigned in a real time policy to the user trying to access it as well.  You may need to confirm that it's using standard ports.  

Okay so we required SAML and IdP need to be configured for Auth prompt also for internet access (SWG) Do we require the same right 

For SMB I need to check in firewall which port has been used for file access.can you give me the list of standard port which supported by NPA.

NPA supports any TCP or UDP based traffic regardless of port.  For testing, you could allow all ports to the specified IP and capture which ports are in use.  

Thanks @sshiflett 

Can you please provide me the proper docs for SAML integration with IdP.

The documentation varies by identity provider.  Do you know what Identity Provider is in use?  Keep in mind the reauth uses the same IDP integration as Forward Auth Proxy so if you already have this configured, you will not need to create another integration.