Product Forums

Hi Guys,I am trying to deploy the Netskope Client on macOS devices using Endpoint Central, but I am unable to complete the device enrollment.I have enabled the Secure Enrollment Method and am following the Netskope documentation below:Netskope – Deploy Netskope Client with Endpoint Central on macOSIt appears that the enrollment tokens are being picked up by the agent, but the devices are still not getting enrolled.One important point is that not all of our Mac devices are fully managed through ManageEngine MDM. Could this be related to the enrollment failure, or are there any additional MDM profiles/permissions required for Secure Enrollment?Please suggest the required configuration or troubleshooting steps.Thanks,Jayesh

I am trying to figure out an easy way to block personal Copilot without blocking enterprise Copilot. I tried creating two RTP policies: One blocks the ‘Microsoft Copilot’ app, and the other (which sits before the block policy) allows access to Microsoft 365 Copilot. Even with this setup, I can still go to copilot.microsoft.com, and I can even log in with my personal email account and have my personal Copilot running on my work computer.

We are Muting rules inside the Security Posture IaaS but as new Instance/Resources comes onboard the instance is not muted. Every week I have to go into the section and mute rules that have been muted in the past. We should be able to MUTE this at the top level so all new ones are muted by default as they come online?

I can’t see the main publisher menu with the options. Am I missing something?   

 May we know if Netskope supports QUIC now?Update: It seems not yet 6 month ago.If you have the same request, join the vote for this func support here:-----------------------------------We only found this 3y old article.and docs not sure if it is up to date.https://docs.netskope.com/en/about-netskope-secure-web-gateway

Hi We have bypassed outlook.com and created a cert pinned app - wbxcoiex.exe,searchprotocolhost.exe,msedgewebview2.exe,winword.exe,outlook.exethese are the URLS we have added: outlook.com, outlook.office365.com, office365.com, outlook.office.com, groupsapi-prod.outlookgroups.ms, groupsapi2-prod.outlookgroups.ms, groupsapi3-prod.outlookgroups.ms, groupsapi4-prod.outlookgroups.ms, outlookgroups.ms, outlook.office365.de, outlook.office.de, outlook.de, office365.de, attachment.outlook.office365-net.de, attachment.outlook.office.de, attachments.office.net, attachments.office365.net, graph.microsoft.com  However, users on Netskope get a popup asking for their password throughout the day.  We are in the middle of a rollout and its only Netskope users that have this issue. See below popup   Are there any recommendations on how to handle outlook exceptions as we assume that something is getting inspected and Microsoft doesn’t like that. 

Does Netskope have logs to view prompts sent to AI tools (Gemini, Claude, etc)?

Google’s AI Mode is now correctly being categorized as Generative AI.As with Gemini and other AI tools, there are organization wide guardrails you can setup for corporate accounts so we would like to allow only our corporate google instance and block non-corporate or logged-out instances of Google AI Mode.To do this, the instance must first be detected in Google AI Mode.

We are enhancing a Real-time Protection policy designed to prevent users from accessing personal or non-corporate accounts through sanctioned and unsanctioned cloud applications.Our current policy configuration is:Categories: Cloud Storage, Application Suite, Webmail, and Technology Activities: Login Attempt and Login Successful Constraint: From User = Non-Corporate Domains Action: Block

Hello all!Customer’s internal domain ends is customer.net. We know that’s a public domain (.net), but it predates us, and we don’t think that migrating to customer.local or something like that is viable in the given time.We are deploying NPA and, so far so good. The issue is that their domain exists on the internet, and is not owned by the customer themselves. So, if a client resides outside of the premises, they can resolve internal names to a public IP address. And since that domain seems to have some sort of catch-all resolution, everything gets resolved.The security concerns are obvious: the owner of the public domain can learn all of their internal services hostnames and then deploy phishing sites, etc.We already have blocked that IP address, but we are trying to block DNS resolution all together. Although blocking other domains works, this one doesn’t, because it is defined in many private apps.What can we do to sucessfully block these requests?Thanks.

Hello.Is the Netskope Publisher supported on ARM hardware?Specifically the standalone Ubuntu install method Thanks!

Dear Netskope Team,As I understand, AI Post and AI Response activities should be generated when a user interacts with an AI assistant in a SaaS application such as Microsoft 365 Copilot.However, when testing M365 Copilot, I can only see Post and Response activities in Application Events and do not see any AI Post activity.Is this expected behavior, or should AI Post activity also be generated for M365 Copilot?Thank you in advance.

Hi Team, We needed to export the list of Certificate Pinned applications (including custom)and steering configuration list where these are part of exception. There is no option available . Please suggest where to export such details.

Hi,When we publish applications using classic authentication, we do not encounter any issues. However, when we publish applications that are federated with our Identity Provider (IdP), after the authentication process completes and then the user is redirected back to the application's original URL, the browser displays an access error: ERR_NAME_NOT_RESOLVED Does anyone know if any additional configuration is required for this type of access to work? Thx 

Hello,we currently have 2 publishers at our site. They frequently connect to different NetSkope datacenters (A and B) with similar RTT, which is working as designed. However, the majority of our users are routed to datacenter C, and here we are noticing a discrepancy. Around 80% of the traffic is being routed through only one publisher because it is the only one falling within the (Latency range: 0-31 ms). It seems that even a minimal difference in latency - if it unluckily falls near the threshold of this range - causes the traffic to skew heavily toward a single publisher. Do you have any recommended solutions or workarounds for this behavior?

Hi Team,I do not believe "Fallback Action" is available as a standalone filter in Netskope reporting/search. Based on Netskope documentation, a fallback action is triggered when the content inspection engine cannot complete analysis (for example, file size limit exceeded, scan timeout, or internal scanning error), and the system applies the configured fallback action (Allow/Alert/Block). If the goal is to determine how many fallback actions occurred historically, we may need to look for the resulting events/actions rather than filter directly on "Fallback Action." I have not found evidence that Netskope provides a dedicated Fallback Action filter in the UI. As an alternative, it may be possible to identify these events through SkopeIT/Event exports or log analysis by looking for scan failures, timeout conditions, file size limit exceedances, or other fallback-related indicators if those fields are logged in our environment.Has anyone identified a field in SkopeIT, Reporting, or exporte

Hello I would be very interested by all localisation of the “stichers” in NETSKOPE worldWe have subsidarie in US (Philadelphia)We have local Publisher on Philadelphia Experience with NPA is not goodThe network path is : User (near Philadephia) > US-PHIL1 (GW) > US-DEN1 (Sticher) > Publisher (Philadelphia) > local ressource26+43+51Minimum 120 RTT time up to Publisher !!! FromHow having better time ?Eric  

 If you monitor your Netskope proxy logs or Real-Time Protection events, you have likely come across traffic destined for raw public IP addresses where the Host FQDN looks something like this: http://77.111.102.203/filestreamingservice/files/ff268a10-8dd6-4190-8bc1-d1db06722d0c?P1=...&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.comhttps://194.36.32.209/92f3b6cc-ee7d-4056-af0d-6026e0d4e2f2/.../86ec8c94.intunewin.bin?cacheHostOrigin=swdb02-mscdn.manage.microsoft.comSeeing raw IP addresses in HTTP GET requests can immediately raise red flags for SOC and network teams. However, this pattern is completely normal behavior for Microsoft Delivery Optimization (DO).In this post, we’ll explain why this happens and show you how to build a hyper-efficient, lightweight regex URL profile to accurately match and bypass/steer this traffic in Netskope.Understanding the Behavior: Why Raw IPs?When Windows endpoints fetch OS patches, Defender updates, or Intune app packages (.intunewin), Microsoft

Under what categories should a Custom Cloud App fall under ? Does the categorization rely on the domains that we provide when defining the application?

Hi Team, Can you please help to allow login to Codex Enterprise application only and block rest? I tried using the Header insertion but it's not working.

Thoughts on FWaaS Policy  This article assesses some key considerations when constructing a policy for Netskope One Firewall-as-a-Service (FWaaS/Cloud Firewall). FWaaS secures traffic destined for public IP addresses on non-web ports. It should be assumed that the real-time policy table is split into policy groups to aid administrators with the correct placement of their policies. The focus here is the implications of positional placement of policies for Layer 3/4, and Layer 7. This article assumes that the tenant has been enabled for Service and Destination profiles (the equivalent on a legacy tenant would be Custom Firewall Apps). It also assumes that non-web application firewall is enabled for app detection at L7. Netskope evaluates policies using a top-down approach, hence the first policy that matches the traffic flow criteria will apply. Key Points The following are some of the policy objects that can act on traffic processed by firewall and therefore potentially change behaviour

 1. Overview This article documents the procedure to resolve Docker Engine and Docker Compose version prerequisite failures encountered during Netskope Cloud Exchange (CE) setup or upgrade on Ubuntu 22.04.5 LTS. The root causes identified are:Docker Engine: Package pinned at an older version; the official Docker apt repository not yet configured or cache outdated. Docker Compose: A manually installed standalone binary at ~/.docker/cli-plugins/docker-compose (installed July 2025) was taking priority over the updated apt plugin, causing the CE setup script to read the wrong version.!!! Important Note: Make sure you have a backup of your Cloud Exchange instance or take a snapshot before starting the upgrade process.  2. Symptoms When running the CE setup script (sudo python3 ./setup), the prerequisite check outputs one or both of the following failures:  3. Environment OS: Ubuntu 22.04 Hypervisor: VMware4. Root Cause Analysis 4.1  Docker Engine — Outdated PackageDocker Engine was install

Hello the community.I need your help.I’ve opened a high-priority support ticket separately, but I’m looking for information on how DNS works (ping / nslookup).We’re having an issue with our business applications.I have an internal application published on our DNS. I don’t have any issues at work.But outside of work, when I ping it, I get the following response:C:\Users\THOMAJULIE>ping wug.XXX.frSending a ‘ping’ request to wug.XXX.fr [100.64.0.1]  > Normal comportmentC:\Users\THOMAJULIE>nslookup wug.XXX.frServer:  UnKnownAddress:  192.168.1.254Non-authoritative answer:Name:    wug.XXX.fr.transports.comAddresses:  2a01:7e01::f03c:95ff:feeb:9d4b          2a01:7e01::f03c:95ff:fe00:2692          2a01:7e01::2000:dff:fec1:5cdb          2a01:7e01::f03c:95ff:feed:783e          2a01:7e01::f03c:95ff:fe91:5d91          139.162.181.76          172.104.149.86          172.104.251.198          139.162.174.209          172.104.203.186Is this normal behavior?Can you tell me how ping/nslookup r

Background :We have Netskope SMTP DLP, Endpoint DLP, and Microsoft Exchange integrated with Netskope. Users are currently imported via Directory Importer (LDAP/AD) with a synchronization interval of 180 minutes.Use CaseWe are implementing a Leavers Email and Endpoint Monitoring Policy (Monitor/Allow mode only). When HR raises a MyAccess request, the user is automatically added to a dedicated LDAP group. The Netskope policy is configured against this group.The challenge is that policy enforcement is delayed until the next Directory Import sync, which can take up to 60 minutes. Our requirement is for the policy to become effective immediately after the user is added to the LDAP group.  Options ConsideredSCIM Provisioning: We considered using SCIM to provision the specific leavers group and apply policies based on SCIM group membership. However, our understanding is that users already imported through Directory Importer should not also be provisioned through SCIM, as this could create ide

I have Slack configured via Next Gen API connector. I have DLP policies to identify specific data types being shared externally. After opening an incident I can clearly see the channel name identified. However, I have no way of whitelisting or filtering on them. We have a channel naming convention to identify false positives, but no way to filter them out besides manual review. What can be done?