Product Forums

Hi team, I have a query regarding the NPA the customer wants to segerate the group of user traffic should be steer in NPA. Like they only want the specific group of users. use NPA services I checked the same in steering configuration option i didnt get it please let us know if we can acheive this use cases kindly find the below questions from client end. Also please let me know what limitations we get in Azure AD license. Like what netskope suggest to purchase the license so we can configure SAML SSO. 1.In AD, do we need create a separate security group for SWG,CASB and add few user in the group and test for couple weeks.2.In AD ,do we need a separate security group for NPA and add few users in the group who will access  

Hi, I noticed this morning that the NS Client Latest Golden Release version has been updated to v108.0.0, which is the same as the Latest Release. Was this intentional? Was a lesser version skipped (v107, v106, etc)? Also, the Support page is still shown v105 and v108 is not available for download.. Thx.. https://support.netskope.com/s/article/Download-Netskope-Client-and-Scripts

During the development of Netskope Next Generation SaaS Security Posture Management (SSPM )  capabilities, one key decision was made to replicate the data models and resource relationships of the monitored systems as closely as possible with our graph-based engine. This choice has yielded a significant advantage, allowing us to swiftly adapt to changes and new features within the target systems represented in our model whenever the need arises.   An illustrative case is the management of Salesforce Delegated Group policies through SSPM. Delegated administration is a feature that permits Salesforce administrators to grant specific users (and user groups in the future) in designated roles the authority to manage users even profiles on their behalf. The Salesforce Spring ‘23 update introduced the ability to access Delegated Group Information via their API. This update allowed Netskope SSPM to add support for these resources, as managing delegated group policies pr

Apologies if this has already been requested, but are there any plans to support the system default browser for SAML re-authing for private app access? Right now, whether authenticating via SAML for enrollment or after the time period configured for private app access, we are redirected to our idp via an embedded browser. This defeats the purpose of SSO since it doesn't use the system native browser. If users are already auth'd to the IDP in their system default browser (such as chrome) then launching it in chrome wouldn't require any additional auth, SSO would just kick in. 

Hello,Does anyone know if Netskope can enforce employees to log in AAD account on their managed endpoints to access internet?If employees don't log in their AD account and use local admin to access internet, can Netskope block their access?I haven't found any related discussion or KB on this. Appreciate if someone has already tried or know the configurations.

Hello All,   I was wondering if it is normal for Netskope to go into disabled and then into Fail close if the user account in AD gets locked out.  I don't see anything in our agent arguments that would imply it is installed with fail close.  As well, I have the fail close option unchecked on our client configuration.  The only thing I have read is that I have a password set for tamper proofing, which is a prerequisite for fail close.    Has anyone come across this situation before?

Hi team,We migrating policies from Zscaler to Netskope NGSWG with file type url filtering  and cloud apps control. As the categorization is totally different can you please help me out with this migration of policy I need to know the category fall in Zscaler which is fall in Netskope or any docs from your end will help thank you.

How is license consumption worked out for the SWG product? We're currently just syncing groups from Azure AD that contain users based on their office location and the total number of members in those groups is just under what we're licensed for, but want to ensure that we aren't missing anyone. If we sync a catch all group from Azure AD that contains about 3 times as many accounts as we have Netskope licenses what happens to our license consumption? Do we consume licenses equal to the total number of AD accounts that are synced, total number of enabled AD accounts, total Netskope clients seen over a time period, max concurrent connected clients, or something else?

Good afternoon,Many of our users on Chromebook/Chrome OS (differents constructors and differents "versions" like "Nami", "Zork", "Octopuss", "Hatch"...) experiment frequent disconnections since earlier version (actual latest version for ChromeOS via Playstore is 107.1.0.1529, published on 2023/08/23), tunnel going up/down in logs, this is very embarrasing for our users. Fixes have been deployed until the latest stable version mentioned above, but the disconnections are persistent, and seems more frequent when users are in homeworking. Does anyone encounters the same kind of issue, please ?Thank you if you can help me. I precise Netskope official support have already been contacted and is aware of this problem.Best regards. 

Hi team, I looking for a configuration where the user try to access the prvt apps whenever they tried the user get auth prompt for the Pvt apps only please let me know if it's possible to do so as I'm currently doing one POC so i get this requirement from customer end. Also please let us know the configuration to access network drive with the help of NPA.The user access the folders like go to THISPC on upper side bar write //x.x.x.10 IP e.g and access the network share folder I want this to acheive by Netskope I do follow the steps of SMB configuration but required a details regarding this please help me out with this configuration.

We recently attempted to set our NPA policies to our "Domain Users" (in our case "corp.alfacompanies.com/Users/Domain Users") group rather than leaving the "source/user=" field empty so it applies to All Users.  After the policies had time to simmer, we began noticing problems withfile shares (likely a DNS or Domain Controller conflict)lost access to the file sharesWindows Security prompts asking for credentialsgpupdate /forcefailed almost immediately due to failure to connectForticlient EMS status failed over to "not reachable"After changing our NPA policies related to domain controllers and DNS back to user=all users (aka empty) and allowing time for the settings to propagate , access returned to normal. That begged the question, why would setting the policy to "Domain Users" create such an adverse issue. In your experiences, if all domain users need access, do you typically leave the "source/user=" field empty?

Hello, we have disabled unenroll from client UI through client config. But in some instance need this operation  [eg: IT accidentally enrolled while troubleshooting under user's windows session]. Wondering if this can be done from CLI or manually deleting user level files. 

The Netskope clients have not been able to update configuration since September 1st for my tenant.  Netskope said its a known issue. Is there a reason why https://trust.netskope.com/ does not reflect this yet? Thank you. 

Hello and good morning 🙂 I would like to know how can I get the bandwidth consumption logs of a publisher because in the DEM (Digital Experience Management) in the NPA section it only shows the network sessions but not the throughput.

it is possible to enable the TCPDUMP command in the publisher? I have tried to run it, but it shows me this message You don't have permission to capture on that device(socket: Operation not permitted)

I have a few questions related to Netksope MIP integration. I looked around but did not get any concrete answers. Does Netskope require the customer to provision an Azure subscription or similar services when applying MIP labels to OneDrive files?  From what i understand , we only need the M365 licence ? Is the timestamp of a OneDrive file altered when Netskope applies a label? - This is important for our org to ensure that we dont modify the file timestamp. Is Netskope's file labeling service charged separately, or is it included with the standard Office 365 protection license? - I'm guessing there is no extra charge. Are there any restrictions on the number of files that can be labeled within a specific period by Netskope? - This is something our security team is asking and would love to know if there are any known limitations 

Hello, I need to enable the traffic of print queues from a pc client (with netskope client installed) to network printers in the headquarter(already installed with local IP on pc client), can you help me to create a NPA policy?What are the steps to follow?Is there a guide/best practies somewhere?  Thank you very much

Hello,  We configured a URL list to allow certain github repositories and noticing netskope is processing the list in case sensitive mode. Is this the default behavior? Can we have it process in case insensitive mode?  eg: github.com/Azure vs github.com/azure

Has anyone else heard of Microsoft changing their licensing model for Graph API integration. It's come to our understanding that the licensing model would now require E5 or equivelent add on to do the Netskope Teams integration for DLP. Does anyone else use the Netskope/MS Teams CASB Integration?

We started seeing safevisit.online in our reports within the last week or 2 that this site is being blocked as a security risk.  I've looked online but I haven't found any resources explaining what this site is or why its showing up.  If its a tracker, I'm guessing users are visiting a site that has it embedded.  The domain is less than a year old.

We have been unable to deploy Endpoint DLP. Having the same issues with different versions and the newest 1408. A good number of Managed devices on reboot disable the usb devices like mouse, keyboard, and printers. Has anyone been able to successfully deploy Endpoint DLP protection?I currently don't have any device control policies but do have quite a few Content Control policies.Any help would be appreciated.

A customer has several publishers deployed in the AWS cloud, he wants to see the resource consumption generated by the publishers but does not want to see them through the DEM>NPA on the tenant but wants to see them through the command line.How can I see this diagnostic?

Hello Netskope community,    Customers adopt different approaches on how they manage access to Youtube, where some have a more relaxed policy and some are more strict. For customers that need more granular controls over the video giant, controlling based on channel is one of the possible solutions.    Netskope's Instance Awareness feature extracts the channel name every time you visit a page or video so if you browse to the Netskope YouTube channel and check SkopeIT you will see something like this:  (notice the instance ID field populated with "netskope" and that will be true to any other channel on YouTube)    In order to setup a Real Time policy to either blocks a channel or simply allow it, depending on your strategy, create a new instance from SkopeIT by expanding one if these Application events and clicking on "Create New Instance" and just giving it a name.    After that, go to Real Time policies and setup a policy using this newly c

Just want someone else to confirm my observation:  While what POP a client software is connecting to is available, what version of the client being used is not.   I was trying to replicate the DEM dashboard, right now I have to download devices into a spreadsheet and then chart it.

I am looking for a way to look up a way to get a policy hit count, specifically for NPA policies but I can easily identify the NPA policies based on the name.  I would like to know of a way to get a count of every time a policy was hit.  Right now I have to go into Network Events in SkopeIt, export a list of all data for the last 90 days, and then do some Excel Kung-Fu and do a count-if for each policy name.  Maybe something in Advanced Analytics??