Product Forums

Hello Everyone, We are unable to export the user list from Netskope tenant. We have tried to export the user list from Security Cloud Platform → User management, but unable to fetch the export option to export the user list.Kindly confirm is there any option in the Netskope tenant to export the user list from the tenant.If not, kindly suggest any alternative method for the same.

Thank you in advance - as a security measure, I was wondering if rather than bypassing traffic to AWS Workspaces from Netskope, might it be possible instead to source anchor traffic from our AWS Netskope publishers and configure IP restrictions from the AWS-end, such that access to our Workspaces tenant was restricted to our AWS/Netskope publishers? We’d ideally only like for access to AWS Workspaces to be driven from Netskope client-driven endpoints.

Hello I have NextGen API for Microsoft outlook. For 12 of my users I want to steer the outlook traffic via netskope.I know it is the pinned app and got a bypass, but is there any way to steer via Netskope

SUBJECT- Issue with Activity Control Policy for Banking/Finance URLs in Netskope Hello Team,Today, I created a policy related to custom URLs for banking and finance/accounting websites. I selected specific domains to control user activity and configured the policy properly.However, I am unable to control activities on banking websites in particular. I am not sure why this is happening.When I perform a URL lookup in Netskope, it shows that the traffic is being steered to Netskope, so the steering is working.If anyone knows how to resolve this issue—especially for banking sites—please guide me

Generated with the assistance of Claude Opus 4.6 (Anthropic) -- but any slop is my fault for not managing context.Summary We need a per-user, one-time enrollment token mechanism for IdP-mode enrollments on devices that cannot receive tokens via MDM (mostly Chrome or Linux laptops, unmanaged or “lightly managed” endpoints). The current Secure Enrollment model provides tenant-wide shared tokens distributed via MDM. We have specific questions about how Enforced/Not Enforced status interacts with IdP vs UPN enrollment, and whether per-user scoped tokens are available or planned. EnvironmentTenant: XXXX.goskope.com Secure Enrollment Service: Enabled Token set 1: Created Jan 2026, Status: Enforced (auth + encryption), Expiry: roughly 1 yr Token set 2: Created Mar 2026, Status: Not Enforced (auth + encryption), Expiry: roughly1yr Secure Configuration Service: Enabled IdP: Okta (SAML Forward Proxy configured with Client Enrollment access method) Deployment modes: UPN via Intune/Jamf (Windows/m

Hi everyone,I’m looking for a solution to define a policy in Netskope Standard edition to give me an alert on shared folders that are unsafely shared among external and al internal users.I’ve already have a policy in place for files but I can’t find a way to define it specifically for folders. I’ll appreciate it if anyone has a comment on the solution.

We have been informed by the Support team that if you create cases on behalf of customers, the SLA associated with the customer’s purchased support level will not be honored.Quoted from Support, with company information masked:“Also, regarding the SLA request, the reason is that the case was raised by a vendor account rather than the customer.Please sync with your account team for any further queries.”

Disclaimer and AdvisoryThis document and the guidance contained herein are provided by Netskope for informational purposes only and are intended to assist developers and administrators in configuring third-party tools to operate with the Netskope platform. "As-Is" Information: The information, scripts, and configuration examples are provided on an "as-is" basis. While Netskope makes a reasonable effort to ensure the accuracy of this information at the time of publication, we make no warranties, express or implied, regarding its completeness, accuracy, or suitability for any particular purpose. Third-Party Systems: The software, libraries, and tools discussed in this document are not owned, controlled, or maintained by Netskope. The configuration, commands, and behavior of these third-party systems are subject to change at any time without notice by their respective owners. Netskope assumes no responsibility for errors, omissions, or outdated information related to these third-party s

Hello everyone,I’m looking for guidance on how best to handle chat bots within business web applications, particularly when they are being blocked under Online Ads filtering.For example, we use the Blackbaud web application. While the main application functions as expected, the embedded chat bot is being blocked because it is categorized as Online Ads. The chat bot is an important feature, as it is used to create support cases for the application.Additionally, I’ve included screenshots from SkopeIT and had a couple of related questions:Is it normal for the same application to appear under multiple App Categories? What is the difference between a URL and a Page as shown in SkopeIT?Any insights or best practices would be appreciated. Business WebAppChat bot on Business WebApp 

Hi Team,Some of our customers would like the view under Settings → Cloud Security Platform → Devices to update (almost) in real time.Especially when selecting a specific device and clicking the refresh button, it often takes “forever” — if it has any effect at all — for the display to update and show which tunnels are currently online.The timestamp shown in the top left is current, but it does not reflect the actual status.This would be particularly helpful in troubleshooting situations.Our local SE mentioned that since this is not on the roadmap, we should submit a feature request for it. Thank you very much and best regards,Marco

Hello Netskope Community,Managing endpoint client software across an entire organization is a critical task. A key part of this is having a clear strategy for updates and, when necessary, rollbacks. This guide outlines Netskope's recommended best practices for managing client versions to ensure stability, minimize risk, and maintain business continuity. Understanding the Netskope Client's Upgrade Behavior A common question we see is, "How do I roll back the Netskope Client?"It's important to know that the Netskope Client does not have a native, in-place "downgrade" feature. The installer is designed to prevent an older version from being installed over a newer one to maintain system and configuration integrity.The Official Rollback Procedure:If you need to revert to a previous client version, the required process is a full uninstall and reinstall, orchestrated by your endpoint management tool (e.g., Intune, Jamf, SCCM). Obtain the Installer: Download the specific client version you wis

We tried with Iban (ALL) option but didn’t worked So Please provide an appropriate solution for this 

I am struggling with the props.conf setup to pull web transaction logs via S3 bucket. I have set up per Stream Logs to Splunk - Netskope Knowledge Portal .This would replace my setup for using REST API v2 for transaction logs eventually.  I currently have logs going in parallel into a temp index for validation before cut over.I am using queries below to validate time stamp detection and proper data parsing. If you have this setup to your satisfaction, Can I request you to share your props.conf? Validation queries: #Check if _time matches x-cs-timestampearliest=-10mindex=nsweb_temp sourcetype="netskope:web:test"| eval payload_time = tonumber(coalesce('x-cs-timestamp','x_cs_timestamp'))| eval splunk_time  = _time| eval diff_seconds = splunk_time - payload_time| eval status = if(diff_seconds==0, "PERFECT", "OFFSET")| eval diff_abs_s = abs(diff_seconds)| eval diff_hms   = tostring(diff_abs_s, "duration")| table _time payload_time splunk_time diff_seconds diff_hms status| sort - _time| head

Dears, Q1 : I appreciate your confirmation and guidance of how Netskope ATP sandbox license can integrate with MS Sharepoint to analyze upload/downloaded files ?Q2 : Also if Netskope sandbox can be used for manual file submission for analysis ?Thanks in advance,

We are experiencing an issue where Cursor AI traffic stops working when routed through Netskope with SSL decryption enabled. Specifically, the Cursor agent fails to function when traffic is inspected via Netskope.For security reasons, we do not want to bypass or exclude the Cursor AI domains from inspection. We would like to understand if there is a recommended solution that allows Cursor to function properly without bypassing SSL decryption.Could you please advise on: Any best practices for handling similar AI/agent-based applications under SSL inspection As part of our troubleshooting, we attempted lowering the HTTP version to 1.0. While this has resulted in partial functionality for some users, the issue is not fully resolved and the agent remains unstable. 

With Netskope client enabled, macOS machines are failing to sync to Intune.  When I disable the client the sync works as normal.  I have all of the predefined cert pinned app exceptions for both Windows and macOS in place, and Windows machines have no issues.I found this thread in the community pages that discusses this issue on Windows, and one comment briefly discusses macOS but the thread is closed and I can’t see any of the replies so not even sure if there is more info in here I that can’t get to.  I did create and additional custom cert pinned app for macOS and included the below processes, and added ‘*’ to bypass all domains.  Nothing is working though.company portalomadmclientintunemdmagentmdmclientcompany portalmdmclientwdavdaemon_enterpriseHas anyone figured out how to get Netskope to not interfere with Company Portal on macOS?

Looking for recommendations here. We are currently trying to onboard a group of consultants and provided them a requirements document for use of Enterprise Browser. One office could not use EB due to network issues. So they are currently whitelisting the domains and ports from your list. Their question was what to replace MP with? Are there regional static MP domain names that can be used? Network Connectivity: Netskope Enterprise Browser needs access to the following domains/ports:https://nsbrowser-updates.<MP>.goskope.com: Browser updates and installer downloads. https://nsbrowser-config.<MP>.goskope.com: To retrieve tenant and user configurations.I assume if they whitelist by subnet instead, will that cover these MP domains, correct? Consolidated Whitelist CIDR Notation IP Address Range 8.36.116.0/24 8.36.116.0 - 8.36.116.255 8.39.144.0/24 8.39.144.0 - 8.39.144.255 31.186.239.0/24 31.186.239.0 - 31.186.239.255

Question for the community…..Assuming we are blocking the following 2 categories (and of course blocking all of the known malicious)"Newly Observed Domain" "Newly Registered Domain"What is the opinion as to allowing “Uncategorized”?   I do understand that it is not impossible that a malicious link (in an email for example) could contain just an IP address (since all IP addresses generally are categorized as “Uncatgorized” by default) and therefore is an outlier risk (as uncommon this may be), but are there other known risks here I am not considering? The reason for the ask is that we have found that websites that are categorized by Netskope, on occasion at least, are legitimate business sites and thus have negative impact.  While we can add these to a custom policy that will allow access, it is a bit of a whack-a-mole exercise in futility since sites are added to this list all the time.

Hiis it mandatory to provision on the tenant the users that will only have access to Browser Access apps? I mean, for third-party or contractors, that won’t install the Netskope Client and that only need access to browser access private apps, is needed to provision them via SCIM or manually?I have checked that having the user associated on the IdP, the user authenticates when trying to access the public URL of the BA private app, but if the user is not provisioned on the Netskope tenant, get a 401 error after authenticating even if the RTP policy allows “all users”The user only access the private app via BA after provisioning on the tenant. Is this correct? I wouldn’t like to provision all my contractors on the tenant Regards

Is anyone aware of a library of APIv2 scripts that can be shared?   Looking for scripts that can discover devices and details about them as well as automating some functions like URL list updates and such.

We see a discrepancy in file names being visible in DLP incidents. Currently we have a DLP policy to detect exfiltration of sensitive information using file converter tools. While we are getting the file information using forensics for https://www.sejda.com/, the same is not happening for ilovepdf and ilovepdf only captures “blob” as an object and does not show any information. Is this a known limitation? 

Hello Community,  we have an Netskope Elite offer for China and have difficulties to have WECOM working with Netskope. A lot of delay in the message exchange. Before going full bypass, which is a clear security problem for my company, I would like to know if someone managed to make this app compatible with Netskope.  Official doc: https://work.weixin.qq.com/h5app/wework_domain_ip/latest Thanks! Robin