Product Forums

Team,Good morning. Is there a reason I'm getting DNS Leakage? Did I forget something in my configuration  See screenshots below.  All "DNS Traffic" is enabled in the steering configuration. DNS Profile is configured with resolver IP of 162.10.1.1 Real-Time Policy is configured. Thanks.  Expand Post

Does NS Client upgrade cause any impact on end user running traffic, especially on active web sessions, Audio/Video calls ? Version 132.0.7.2513_Windows 

User case :   Git Pull/Push basic commands does not work and throws connection timeout error when i enable NPA and even i have whitelisted git hub web site with ports 22,443 but when i disable NPA and use AOVPN it works . so need some advice ?Note: even i have enabled virtio proxy enabled at wsl setting but no luck 

We are supporting a client with two separate Azure tenants and using Netskope SSE for secure access. Our configuration allows certain Azure base URLs via NPA for PaaS services, while the Azure portal routes through SWG. We use the same client and steering configuration for users accessing both tenants.Observed Behavior:When accessing via GUI/browser, traffic is correctly segregated per tenant.When using CLI, traffic always routes to the primary tenant, even when attempting to access resources in the secondary tenant.CLI-based operations cannot properly enforce tenant-specific routing.Impact: CLI operations on the secondary tenant fail or incorrectly use the primary tenant context

Hello,We are looking to control access to a social media site with cloud app access real time policy. However, the site doesn’t exist as a selectable CASB cloud app today and we have to fall back to using SWG policy instead.The site in question is www.weddingpro.com.Can we get a new cloud application created for this website?Thanks,Nick 

Just wanted to see if any of you are servicing customers that have recently implemented NinjaOne for endpoint management and patching. If so, how have you approached the third-party patching? cert pinned app bypass?  domain bypasses? ssl no decrypt policies?  mix of all of the above? We have our endpoint management team working but we just foresee a massive maintenance task in the future for the needed and potentially changing domains? A wildcard approach seems like too much of a security hole. 

Hi team,Can we use  New Policy Group based on location and move all private access Policies on this group?  Example: Site A Private Access ( Group Name)          Site A Private Access Policy 1( Example Policy Name :File Server Site A Access)          Site A Private Access Policy 2 ( Example: Private Web Application Site A Access)         Site A Private Access Policy 3   ( Example: Backup Server Access Site A Access) Site B Private Access( Group Name)         Site  B Private Access Policy1 ( Example Policy  : File Server Site B Access)          Site B Private Access Policy 2  ( Example Policy: Private Web Application Site B Access)         Site B Private Access Policy 3   ( Example Policy: Backup Server site B Access) Challenge what I am trying to solve here is that group policy based on Physical location of offices, so that i dont need go through long list of Policy and navigating through this policies is difficult. So if we arrange the Policies based on locations , we know that this p

Why sometimes on-premise detection shows “remote" and sometimes it shows “off-premise” when users are not in intranet, such as office environment.

It seems that users under SkopeIT are only displayed when accessing Cloud Apps or the Web.Events from Cloud Firewall or Private Apps are not included, resulting in limited visibility.Do you have any suggestions on how we can monitor user activity in these cases?

ObjectiveThe current Private App Segment definition conflicts with what is described in the Netskope Knowledge Base article.When Publisher DNS is enabled, both IP and URL must be defined in the host configuration of a private app segment.Reference:https://docs.netskope.com/en/private-access-best-practices#idm46139539889184In docs.goskope.com, enabling Publisher DNS can still only use URL to define Private app, 2026/1/6 PrerequisiteThis issue generally applies to Netskope Private App Segments Definitions. ContextWe observed that in the current Netskope Private App Segment configuration, once Publisher DNS is enabled, users are unable to access a private application if only the private app URL is defined. Do You Know?This mechanism appears redundant. Once Publisher DNS is enabled, it is possible to configure a random port for the URL and then define a separate policy using the private IP with the correct port, since users can no longer access the URL using the originally defined port.Thi

I would like to get some clarification on a Netskope SWG + DLP deployment scenario.We have established a firewall tunnel to the Netskope cloud and integrated ADFS for user authentication. Both corporate-managed devices and BYOD devices (phones and personal laptops) are connected to the same LAN and their traffic is forwarded to Netskope through the tunnel.My question is regarding BYOD behavior: When ADFS authentication is enabled, are BYOD devices expected to experience browsing or authentication issues? How does Netskope handle user identification and authentication for non-domain-joined devices in this setup? Are there recommended best practices for handling BYOD traffic when using ADFS with a firewall-based forwarding architecture? Any guidance or real-world experience would be appreciated.

 Ref Link Quarterly Product Release Webinar – December 2025 | Community   

Dear Team, We have implemented a policy to block the sharing of source code when a user attempts to send it via file attachments (such as TXT, PDF, DOC, etc.) to personal email domains like @gmail.com. The policy is working as expected when the source code is shared directly as plain text within the email or message body. However, when the same source code is included inside a file attachment and sent, the policy does not trigger. We have already raised this concern with the Netskope Support team, and the response received was that this use case is not supported. However, we request you to please re-check and confirm if there is any possible way to achieve this requirement. Note:We are able to block uploads entirely, but our specific requirement is to block the transfer only when the to_user does not belong to the corporate domain. We request you to please help us understand why this behaviour is occurring and assist in resolving the issue, as this use case is critical and needs to be

There is a business need to have a desktop shortcut created to complete Re-authenticate Private Access.

Hello Community, Is it possible to implement Netskope in a workgroup environment? The customer doesn't have any AD or IDP solution in their environment and have a distributed environment.If possible what would be procedure? 

Currently, Netskope identifies certain IP addresses as malicious based on threat intelligence; however, due to the absence of SNI inspection, traffic to these IPs is sometimes allowed to pass through. This behavior results in an inconsistent security posture because malicious IPs should be blocked unconditionally to minimize risk.We kindly request a feature enhancement to ensure that any traffic destined for an IP flagged as malicious is blocked unconditionally, regardless of whether SNI visibility is available or not.This improvement would strengthen the security logic by guaranteeing that malicious IPs never bypass protection simply because SNI information is missing or cannot be inspected.Impact: Prevents risky connections to known malicious IP addresses even when SNI cannot be inspected Aligns enforcement with expected security best practices Minimizes potential attack vectors and reduces security gaps You previously advised us to enable the backend flag “Block Single Destinati

Hi All, Has anyone integrated Crowdstrike NG SIEM with Netskope. In Crowdstrike i can see that their is native integration with Netskope and require API Key.  API V2 Document which is available in Crowdstrike portal is outdated. In Netskope, we need to create role and then generate API key. Not sure which role we should assign in Netskope Tenant before generating API key.and  also correct me if role creation in Tenant Admin and generating API key is wrong method. Thank you in Advance.Govi33

Hello everyone! We recently started having issues with Netskope where OWA and Outlook (new) will not sync emails without a manual sync. Outlook (classic) works just fine though.I have had Netskope on my device since May hand have had no issues until Dec 10th. Microsoft may have made some changes, but I'm looking for a fix on the Netskope side. This is affecting all of my users. I've tried temporarily adding steering exceptions for outlook domains, but it has not solved the issue. Thank you all for your help!!!

We are trying to install the netskope clinet via IDP using the below command. But somehow it is not successful. msiexec /I NSClient.msi tenant=XXX domain=goskope.com installmode=IDP mode=peruserconfig enrollauthtoken=XXX enrollencryptiontoken=XXX (/qn - we removed the qn just ot see the live progress what is happening). With Email-Invite it is working on the same PC, but we are trying to install via IDP for bulk installation without users intervention to enter the credentials. We have configred the token at MDM distribution and also created the SAML authentication under Forward Proxy. When we see the logs and didn’t found anything resolvable. "event_details": "Installed client version 132.0.7.2513",        "actor": "System"    }}2025/11/26 11:13:04.911 stAgentSvc p155c tc24 info addonmanapi.cpp:756 addonmanapi posting client status2025/11/26 11:13:04.911 stAgentSvc p155c tc24 error addonmanapi.cpp:759 addonmanapi Post Client Status addon userkey is empty2025/11/26 11:13:04.911 stAgentS

Hello!We have an enterprise license for Lovable AI at the company, but we want to block personal access and allow access only to those with the license. Currently, access to the license is via SSO.Since the application is not supported on Netskope, how can we achieve this license-based access control while blocking personal access?We've tried various methods using regex, HTTP headers, and attempts to block access through Google's provider and Git, but without success. When I click on Google login, for example, I'm redirected to their authentication page.

Hello Team,I am working on SSL inspection with Netskope in our organization (Bogotá, Colombia) and encountered the following issue when accessing a specific domain: Domain: jarvis.grupokonecta.co Netskope error message excerpt: IncompleteCertChain (unable to get local issuer certificate) … Blocked by SSL_INCOMPLETE_CHAIN Verification error: unable to get certificate for issuer = ‘/C=BE/O=GlobalSign nv-sa/CN=GlobalSign GCC R3 DV TLS CA 2020’, subject = ‘/CN=.grupokonecta.co’, altnames = DNS:.grupokonecta.co, DNS:grupokonecta.co’, caissuers = ‘http://secure.globalsign.com/cacert/gsgccr3dvtlsca2020.crt’, sslerrdesc = ‘unable to get local issuer certificate’ I have verified via openssl s_client -connect jarvis.grupokonecta.co:443 -servername jarvis.grupokonecta.co -showcerts and online tools such as SSL Labs, and indeed the certificate chain appears incomplete (missing or not served correctly by the server). What we have reviewed so far: The server certificate for *.grupokonecta.co i

I have installed the Netskope client on both Windows and macOS devices. On some Windows laptops, a few users are experiencing a freezing issue—specifically, their laptops freeze shortly after startup.We have multiple security tools installed on these devices, including Kaspersky Endpoint Security. All Netskope-related applications, pop-IPs, domains, and subdomains have already been allowed in Kaspersky. The following IPs and paths are whitelisted:Allowed IPs/Ports:http://162.10.*:443/ https://162.10.*:443/ http://163.116.*:443/ https://163.116.*:443/ Allowed Application Paths:C:\Program Files (x86)\Netskope\* C:\Program Files (x86)\Netskope\STAgent C:\Program Files (x86)\Netskope\STAgent\nsdiag.exe C:\Program Files (x86)\Netskope\STAgent\nspacparser.exeC:\Program Files (x86)\Netskope\STAgent\stAgentSvc.exeC:\Program Files (x86)\Netskope\STAgent\stAgentUI.exeC:\Program Files (x86)\Netskope\STAgent\tloader.exe C:\Program Files\Netskope\EPDLP\* Allowed Domains: netskope.com *.netskope.c

Is anyone experiencing problems with Next Gen when it comes to policies for Google Workspace. Not sure if it is just me but it seems that I have had multiple things that don’t seem to work or just is not available. An example I created a policy to take action on specific resource IDs (not sure why Netskope is not using the Google Document ID) but the policy did not find the document at all. Did this with support on the line and they did not know when it was not working. I cannot create a policy to apply to specific owners I only have the all owners in the Collaboration section. I feel like this has not been through any QA testing for Google Workspace at all. 

Netskope Microsoft Purview Integration with AI AgentsOverviewThis solution implements an integration with Netskope and Microsoft Purview for DLP enforcement and uses an AI Agent in Security Copilot to ask questions about the policies on both systems and about any alerts that might be happening. The Netskope One for Microsoft Purview DLP setup is documented here https://docs.netskope.com/en/netskope-one-for-microsoft-purview-dlpI will be covering the Microsoft side and how the two work together. There is one thing to note on the Purview DLP integration. You will see in that documentation that  Entra ID user provisioning within Netskope is a prerequisite. When setting up you create an Enterprise Application in Entra. The application you set up is touched again in the Purview setup in step 5 where you will need to re-grant permissions.PrerequisitesNetskope tenant account Microsoft Purview Microsoft E5 licenseArchitecture FlowVia Netskope policy, web traffic will be sent to Microsoft Purvi

How to allow google maps image, which is blocking under cloud storage category.