Product Forums

I would like to assign multiple roles to Netskope Restricted Admins, each role has different permissions dependent on the (group) scope. Please instruct if this possible. I only see the ability to assign a single role from the drop-down list of roles.

Hello, At the moment we don’t have any parameter available to deploy the URL list(s)(/api/v2/policy/urllist/deploy)I assume it’s the same limitation than through the WebUI: when we “apply changes” in the URL list menu, we apply all pending changes, even the ones from other admins It would be great to add the {id} of the URLs list to be deployed to avoid the automation tools to apply changes on other URL lists Thank you :)

We are using REST API v2 to sync our Entra ID users and groups. We switched over from SCIM a while ago. I noticed that a group in Entra ID that has nested groups inside are not shown in Netskope, only the individual users. Is this a known issue? Is there a way to have Netskope see nested groups? Thx

Hi Folks,Our development team is currently facing an issue with Ngrok connectivity. I’ve attached a reference screenshot for your review.Could someone please guide us on how to allow this traffic?Appreciate your support.  

ObjectiveHighlight the outcome that Netskope does not re-examine files with the same MD5 hash permanently. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can initially upload a file that contains no detectable data identifiers. Later, they may modify only the file name to include sensitive keywords. As a result, they can bypass Netskope’s DLP detection mechanism, potentially leaking sensitive information through the file name alone. Do You Know?If the administrator has not changed the DLP policies that should have been triggered, such data leakage will not generate any forensic records or DLP violation alerts. This means the administrator will be unable to track or investigate the data leakage incident. NotesWe’ve discovered that others have already raised similar concerns. I encourage you to vote for this feature as well, as this design issue d

Hello everyone,Here's my problem: we have a bastion server on AWS (Active Directory authentication) that is restricted in terms of authorized IPs (at the AWS instance level), and we need mobile service providers (smartphone access points, for example, so no fixed IPs, and we can't open the entire internet without our authentication portal being blown up in 2 seconds) to be able to connect to it.The IP ranges of our Netskope server are authorized, so my question is: Would it be possible to create a specific Netskope client that service providers could activate when they need to connect to our bastion server and then deactivate it after ? Has anyone had a similar need? I asked the AI, and they told me it's possible. Theoretically, I should create a "mobility providers" user group where we could place the email addresses of our mobility providers for enrollment, but I don't have this menu, even though I'm a "tenant admin." Our Netskope account supports SWG and NPA.Thanks in advance if you

 1. Private Appsの登録上限数について弊社の契約において、登録可能なPrivate Appsの最大数は20個で正しいでしょうか。2. Publisherの冗長化と優先順位についてイントラネット上のアプリケーションへのアクセスに高可用性を持たせるため、1つのPrivate Appに対して複数のPublisherを設置することを検討しています。この構成において、Publisherの優先順位付けや、特定のPublisherへアクセスを誘導するような設定は可能でしょうか。もし優先順位の設定ができない場合、どのPublisherがどのような基準で自動選択されるのでしょうか。（例：ユーザーから最もレイテンシが低いPublisherなど）

At least two years ago, users were already raising similar concerns to the ones we are now requesting.However, in the App Catalog (CCI), Google Docs still only shows “discovery only” support. Google Slides and Google Sheets are not even listed in the catalog at this moment.  I sincerely believe that Google Workspace is one of the most popular enterprise ready SaaS suites.I’m genuinely curious about your thoughts on this and how your companies currently monitors or regulates user activity within Google Workspace.If you agree, let’s vote together for this feature request. 

Do help in setting up reverse proxy for AWS using Azure ENTRA ID.If you have any document or Links available publicly do share. while i have stuck in executing.

Hi everyone, I'm looking to consult with others who may have experience integrating CDR (Content Disarm and Reconstruction) solutions with Netskope, specifically for securing web file downloads. The goal is: When a user attempts to download a file from the internet through Netskope, The file is either blocked or redirected, Then automatically sent to a CDR engine (e.g., OPSWAT MetaDefender) for sanitization, And only afterward made available to the user in a safe version.  Has anyone implemented this kind of workflow?Any insights, architecture suggestions, or practical challenges would be greatly appreciated. Thanks in advance!

We would like to control the Private application (Client based access) with Time bound & Geolocation for the users.The Client based Private application defined policy doesn’t have the source IP as match criteria for identifying the users Geolocation. The Private Application policy doesn’t have the policy schedule option like the Cloud app or the web access policies.We are expecting whether this can be achieved with the Netskope or addressed by Netskope in the future releases.Thank you.

Hello Community!We're thrilled to announce the completion of our comprehensive 5-part series designed to guide you through the intricate world of Zero Trust and maximizing your Netskope Security Service Edge (SSE) investment. This series has been crafted to provide you with actionable insights, strategic context, and a clear understanding of how Netskope empowers your security journey.In a landscape where "never trust, always verify" is paramount, understanding your traffic, applications, users, and data is critical. This series breaks down complex concepts into digestible, interlinked posts, offering value for new adopters and seasoned professionals alike. Why Read the Full Series? By exploring all five posts, you'll gain a holistic perspective on: Foundational Concepts: How Netskope steers traffic and the core role of its client. Deep Visibility: Unlocking granular context for informed security decisions. Strategic Adoption: A phased approach to implementing Zero Trust, consideri

Executive Summary: Trust Zones – Your Key to Zero Trust, Visibility, and GRC In today's dynamic threat landscape, securing your enterprise goes beyond simple "allow" or "block" decisions for applications. It demands nuanced, risk-adaptive controls. Trust Zones provide a structured framework to categorize applications based on their inherent risk, management oversight, and data criticality. This approach is fundamental to a mature Zero Trust strategy and critical for robust Governance, Risk, and Compliance (GRC).Netskope dramatically simplifies and empowers this process: Centralized Risk Intelligence: Our App Catalog (over 84,000 cloud apps!) provides deep risk insights and enables custom tagging, allowing you to align apps with your organizational Trust Zones. Dynamic Policy Enforcement: These App Tags feed directly into real-time policies, enabling dynamic, granular controls that adapt without constant policy change control. Unified Risk Orchestration: Risk Exchange integrates App

Want to migrate from onprem proxy to NS proxy for SOCKS proxy use case. Can someone help with the key consideration before migration plan? 

hi all!   We’ve been having great difficulties with Applications that are sensitive to SSL decryption.  Namely Software developer tools.    We have perhaps 2000 software devs, that could all potentially use a different dev tool, but many do use the same of course.  The issue is, the developers are either unwilling to help work with us to get the Netskope certs included into their application cert store, or they are unable to help us due to unknown OS type knowledge.    We have been charged with doing whatever we can to avoid any individualized “one off” type protections on the dev’s individual systems, as something that could be “deployed” would be very much more desirable.   We do have tamper protection enabled, so I know we’ll have to provide the NetSkope certs to whatever solution we find.     We have a few of their packages with a solution, but it usually requires us working with the user to implement.  We also have some cert pinned apps setup, and a couple DND’s setup as well.  Of

Implementing Zero Trust is a journey, not a single destination. The Netskope Zero Trust Inline Adoption Funnel provides a structured, progressive approach to gradually implementing Netskope's powerful security capabilities. This strategy is typically broken into the following key pillars or stages, building complexity and control as you gain confidence and visibility, while clearly defining roles and supporting compliance:Successful security programs, and the adoption of advanced models like Zero Trust, fundamentally rely on the harmonious interplay of people, process, and tooling. When one or more of these critical components is missing or misaligned – whether it's a lack of skilled personnel, undefined workflows, or unoptimized technology – the efficacy of your security initiatives, and thus the successful adoption of this vital Zero Trust model, will be severely hampered. This funnel, therefore, emphasizes the comprehensive engagement required across your organization.1. Threat Pill

Hello Netskope Community, we want to use netskope on a azure virtual desktop environment which uses FSLOGIX.But sadly we don’t get it running. We configured the installation of the client in the golden image with the multisuser modecommand:tenant=igz domain=de.goskope.com installmode=IDP mode=peruserconfig enrollauthtoken=*token*enrollencryptiontoken=*token* autoupdate=on /qnthere would be a npavdimode as well but as far as I understood this mode is only needed when all  users should use the same tunnel on the vdi.We want that the user on the vdi needs to logon to the client with his azure user, so he has his personal tunnel up with his own private app permissions. On the first logon on sessionhost A it works without any problems.If I relogon and get on sessionhost B my npa will not connecting anymore. We think that on the first logon my client genereates an encryption key to safe the client settings. And on sessionhost B this wont match anymore.we are getting the following errors in t

It would be great if Multi Factor Authentication Integration will be provided for Manage Engine. Our corporation is using Manage Engine for multiple applications for Multi Factor Authentication. If Integration of Netskope for Manage Engine will be supported/ provided, then we would be leveraged to use the same solution for Multi Factor especially for NPA. For NPA all forum & Garner suggest for enabling multi factor for best security strategy. 

If I look at the instructions for configuring prelogon, then this seems to require a reinstall of the client with the correct “prelogonuser=<user>@prelogon.netskope.com” command line parameter.The “nsdiag” command does have a few extra things up its sleave, including update of the secure enrollment tokens.Is there a (hidden) option to also allow adding a prelogon user to an already installed client? --Erik

Hi all, Nice to meet you! I'm currently distributing Netskope clients on company computers (both Windows and Ubuntu). I have configured the Netskope clients to Google Workspace accounts.This works fine for users without a passkey (Yubikey), but if they enable one, the client doesn't complete the login process. Has anyone else experienced this issue and found a solution?Thank you.  

 Issue Description: A customer needs to selectively block videos from playing on Facebook while still allowing users to browse the Facebook platform. This requires a targeted approach to block specific Facebook video-related URLs and domains without completely blocking access to the entire Facebook platform. Environment: Netskope tenant with web filtering capabilities Resolution: 1. Create a URL list with the following entries:video.*\.fbcdn\.netwww.facebook.com/watchwww.facebook.com/videofb.watch 2. Create a custom category in Netskope to encapsulate the URL list:  - Navigate to the custom categories section in your Netskope tenant  - Create a new custom category  - Add the URL list created in step 1 to this category 3. Create a block policy or add to an existing AUP Custom Category:  - Navigate to the policies section in your Netskope tenant  - Create a new policy or edit an existing one  - Set the action to "Block"  - Apply the custom category created in step 2 as the target 4. Save

Building on our discussions about traffic steering and the powerful Netskope Client, let's explore how to unlock the true potential of your Netskope SASE platform: achieving granular visibility.Deep visibility is built upon several layers of context, each with critical dependencies. Understanding these layers is key to extracting maximum value, enabling precise policy enforcement, and contributing directly to your organization's robust security and compliance posture. User, Group, and Organizational Unit (OU) Information: Value: This foundational context is paramount for establishing Identity-Centric Zero Trust. By knowing who is accessing resources, it enables explicit trust decisions, precise role-based access controls (RBAC), and granular auditing, aligning with the "never trust, always verify" principle. Compliance Reference: Essential for meeting NIST Cybersecurity Framework (CSF) Identify Function (ID.AM) - Access Management and ISO 27001 Annex A Control A.9 (Access Contro

Good morning!Can Netskope identify executable files or even other types within compressed files (zip), for example?

Does anyone have a benign, false positive site that can be used for testing of the  IDS of Netskope?Failing that, a true positive that I can turned the IDS on for in the Dev tenant?I primarily want to see what it looks like in the logs so when I put it in monitor mode in production I know what I am looking for.