Product Forums

There is a business need to have a desktop shortcut created to complete Re-authenticate Private Access.

Hello Community, Is it possible to implement Netskope in a workgroup environment? The customer doesn't have any AD or IDP solution in their environment and have a distributed environment.If possible what would be procedure? 

Currently, Netskope identifies certain IP addresses as malicious based on threat intelligence; however, due to the absence of SNI inspection, traffic to these IPs is sometimes allowed to pass through. This behavior results in an inconsistent security posture because malicious IPs should be blocked unconditionally to minimize risk.We kindly request a feature enhancement to ensure that any traffic destined for an IP flagged as malicious is blocked unconditionally, regardless of whether SNI visibility is available or not.This improvement would strengthen the security logic by guaranteeing that malicious IPs never bypass protection simply because SNI information is missing or cannot be inspected.Impact: Prevents risky connections to known malicious IP addresses even when SNI cannot be inspected Aligns enforcement with expected security best practices Minimizes potential attack vectors and reduces security gaps You previously advised us to enable the backend flag “Block Single Destinati

Hi All, Has anyone integrated Crowdstrike NG SIEM with Netskope. In Crowdstrike i can see that their is native integration with Netskope and require API Key.  API V2 Document which is available in Crowdstrike portal is outdated. In Netskope, we need to create role and then generate API key. Not sure which role we should assign in Netskope Tenant before generating API key.and  also correct me if role creation in Tenant Admin and generating API key is wrong method. Thank you in Advance.Govi33

Hello everyone! We recently started having issues with Netskope where OWA and Outlook (new) will not sync emails without a manual sync. Outlook (classic) works just fine though.I have had Netskope on my device since May hand have had no issues until Dec 10th. Microsoft may have made some changes, but I'm looking for a fix on the Netskope side. This is affecting all of my users. I've tried temporarily adding steering exceptions for outlook domains, but it has not solved the issue. Thank you all for your help!!!

We are trying to install the netskope clinet via IDP using the below command. But somehow it is not successful. msiexec /I NSClient.msi tenant=XXX domain=goskope.com installmode=IDP mode=peruserconfig enrollauthtoken=XXX enrollencryptiontoken=XXX (/qn - we removed the qn just ot see the live progress what is happening). With Email-Invite it is working on the same PC, but we are trying to install via IDP for bulk installation without users intervention to enter the credentials. We have configred the token at MDM distribution and also created the SAML authentication under Forward Proxy. When we see the logs and didn’t found anything resolvable. "event_details": "Installed client version 132.0.7.2513",        "actor": "System"    }}2025/11/26 11:13:04.911 stAgentSvc p155c tc24 info addonmanapi.cpp:756 addonmanapi posting client status2025/11/26 11:13:04.911 stAgentSvc p155c tc24 error addonmanapi.cpp:759 addonmanapi Post Client Status addon userkey is empty2025/11/26 11:13:04.911 stAgentS

Hello!We have an enterprise license for Lovable AI at the company, but we want to block personal access and allow access only to those with the license. Currently, access to the license is via SSO.Since the application is not supported on Netskope, how can we achieve this license-based access control while blocking personal access?We've tried various methods using regex, HTTP headers, and attempts to block access through Google's provider and Git, but without success. When I click on Google login, for example, I'm redirected to their authentication page.

Hello Team,I am working on SSL inspection with Netskope in our organization (Bogotá, Colombia) and encountered the following issue when accessing a specific domain: Domain: jarvis.grupokonecta.co Netskope error message excerpt: IncompleteCertChain (unable to get local issuer certificate) … Blocked by SSL_INCOMPLETE_CHAIN Verification error: unable to get certificate for issuer = ‘/C=BE/O=GlobalSign nv-sa/CN=GlobalSign GCC R3 DV TLS CA 2020’, subject = ‘/CN=.grupokonecta.co’, altnames = DNS:.grupokonecta.co, DNS:grupokonecta.co’, caissuers = ‘http://secure.globalsign.com/cacert/gsgccr3dvtlsca2020.crt’, sslerrdesc = ‘unable to get local issuer certificate’ I have verified via openssl s_client -connect jarvis.grupokonecta.co:443 -servername jarvis.grupokonecta.co -showcerts and online tools such as SSL Labs, and indeed the certificate chain appears incomplete (missing or not served correctly by the server). What we have reviewed so far: The server certificate for *.grupokonecta.co i

I have installed the Netskope client on both Windows and macOS devices. On some Windows laptops, a few users are experiencing a freezing issue—specifically, their laptops freeze shortly after startup.We have multiple security tools installed on these devices, including Kaspersky Endpoint Security. All Netskope-related applications, pop-IPs, domains, and subdomains have already been allowed in Kaspersky. The following IPs and paths are whitelisted:Allowed IPs/Ports:http://162.10.*:443/ https://162.10.*:443/ http://163.116.*:443/ https://163.116.*:443/ Allowed Application Paths:C:\Program Files (x86)\Netskope\* C:\Program Files (x86)\Netskope\STAgent C:\Program Files (x86)\Netskope\STAgent\nsdiag.exe C:\Program Files (x86)\Netskope\STAgent\nspacparser.exeC:\Program Files (x86)\Netskope\STAgent\stAgentSvc.exeC:\Program Files (x86)\Netskope\STAgent\stAgentUI.exeC:\Program Files (x86)\Netskope\STAgent\tloader.exe C:\Program Files\Netskope\EPDLP\* Allowed Domains: netskope.com *.netskope.c

Is anyone experiencing problems with Next Gen when it comes to policies for Google Workspace. Not sure if it is just me but it seems that I have had multiple things that don’t seem to work or just is not available. An example I created a policy to take action on specific resource IDs (not sure why Netskope is not using the Google Document ID) but the policy did not find the document at all. Did this with support on the line and they did not know when it was not working. I cannot create a policy to apply to specific owners I only have the all owners in the Collaboration section. I feel like this has not been through any QA testing for Google Workspace at all. 

Netskope Microsoft Purview Integration with AI AgentsOverviewThis solution implements an integration with Netskope and Microsoft Purview for DLP enforcement and uses an AI Agent in Security Copilot to ask questions about the policies on both systems and about any alerts that might be happening. The Netskope One for Microsoft Purview DLP setup is documented here https://docs.netskope.com/en/netskope-one-for-microsoft-purview-dlpI will be covering the Microsoft side and how the two work together. There is one thing to note on the Purview DLP integration. You will see in that documentation that  Entra ID user provisioning within Netskope is a prerequisite. When setting up you create an Enterprise Application in Entra. The application you set up is touched again in the Purview setup in step 5 where you will need to re-grant permissions.PrerequisitesNetskope tenant account Microsoft Purview Microsoft E5 licenseArchitecture FlowVia Netskope policy, web traffic will be sent to Microsoft Purvi

How to allow google maps image, which is blocking under cloud storage category.

Does the Netskope client keep the SWG/NPA secure tunnels if the laptop/PC goes in sleep or hibernate mode?  Is there a recommendation? Thanks.

Hello,I need to block a specific application within the https://marketplace.visualstudio.com/ domain (VSCode Marketplace).I would like guidance on how to configure Netskope to block only this specific application without affecting access to the rest of the domain.Could you please advise on the recommended procedure for this type of blocking?Thank you.

Hi Teams, i’m try to find the CMD reference for publisher CLI to change the host name and username of default user on publisher ssh but cannot find in the knowledge KB from netskope. so i wonder is it possible to change the hostname of publisher and change the default username from ubuntu ?is they any issue if we change this parameter on publisher?i’m also need to change the same for cloud exchange server too.

Background In today's digital age, businesses of all sizes rely on technology to operate efficiently and effectively. It is essential for IT security leaders to protect their rapidly expanding corporate infrastructure and distributed workforce. With the rise of cyber threats, cybersecurity has become a crucial component of business strategy & operations. One of the most critical aspects of cybersecurity is security hardening, which involves implementing measures to protect systems and data from potential attacks. What is Security Hardening Security hardening is a proactive cybersecurity approach aimed at fortifying the defenses of systems, networks, and applications. It involves configuring security controls inbuilt into product and controls provided by other solutions outside of the product such as perimeter security solutions i.e. firewalls, access restrictions, network restriction etc. to protect systems, services, applications against unauthorised access and abuse. Prot

Greetings All,I’ve had a persistent issue for several months with Netskope on macOS that I wanted to throw out here to see if anyone else had come across something similar. Intermittently devices with the Netskope client installed will lose all connectivity to the internet. In the logs I see usually around 50,000 of these messages in a span of just a few seconds`critical nsDNSProcessor.cpp:149 dnsProcessor Failed to get DNS resolver values`Usually as this happens all active connections are killed, like ongoing zoom calls, even though those aren’t being steered to Netskope.Before this I see the DTLS tunnel close down with this flownpadebuglog.log```[info] npaClientHandler.cpp:748:npaClientHandlerStop():0x0 Will shutdown NPA handler and dispatch thread, tunnelId = 7f8b47.[info] tcpclient.cpp:530:shutdown():0x1086a1160 Shutdown socket fd 45[info] npaClientHandler.cpp:755:operator()():0x0 The client handler is stopping and shutting down, userId = 502.[info] tcpclient.cpp:199:handleClose():

Hi Community,Does anyone know how to make the Google Antigravity Certificate Pinned App exception for MacOS?I have the issue from the beginning like Login step. I’m try to except the process name with any domain (*)Antigravity* antigravity* language_server_macos_armBut still can’t sign-in.

Hi folks,do you know if when setting fallback action to alert, real time policies are still evaluated when a fallback action has been triggered?Use case : you don’t want to block download when file size > 400Mo (max file size analyzed by TP)1.You set fallback action to alert2.You set a RTP allow_all_vip for a VIP group to be allowed to download and surf with no exception3.You set a RTP block_dl_400 for all users to block download with constraints file size >400Mo AND specifics files typesExpected result when download a file under 400Mo, TP is applied, all users can download. when download a file great than 400Mo, fallback action is applied, then RTP is applied regarding the user’s groupIn Real life, when standard user try to download a file >400Mo, block_dl_400 is not applied, log indicate fallback action, so it seems that policies are not evaluated after fallback action.Moreover it seems that Netskope tenant is setting MIME/TYPE as application/octet-stream whatever the origin

WSL will work on windows , This info is not mentioned in netskope site (Windows Linux Subsystem)go to WSL settings change the networking mode to “ VirtioProxy” save it then run your commands , it should work In netskope tenant , you can see the logs refer to your laptop name . 

We have periodic reauthentication enabled for users, but on mobile devices, although a pop-up notification appears, users cannot view or be redirected to complete the  Periodical IdP Re-authentication to restore private app access.Is there any guidance available for this configuration?

How do I decrypt/read the TLS traffic in Advance Debug Logs while using Wireshark? 

Hello,I have a DLP policy that blocks the upload of unlabeled documents. The issue I’m facing is that when I try to upload a PPTX file that is labeled with Microsoft Purview Information Protection (MPIP), the upload is blocked by this policy.It’s important to note that not all PPTX files are blocked—only some of them.What I’ve noticed is that, for the blocked files, the “True file type” is detected as “ZIP archive.” In contrast, for files where the label is recognized and the upload is allowed, the “True file type” is shown as “Microsoft PowerPoint 2007 XML.”Has anyone encountered this problem before? Your help would be very much appreciated.Thanks, 

Hello,I am running VirtualBox in NAT mode on my machine with the Netskope Client installed on the host. The VMs inside VirtualBox are failing to connect or update due to SSL/Certificate errors caused by Netskope's inspection.I want to bypass SSL Decryption specifically for the VirtualBox application, but I do not want to bypass traffic for the whole machine or use a broad IP-based exception. Thanks.

What is currently supported to passthrough Phish-Resistant MFA methods like passkeys from unmanaged devices over Reverse proxy, universal reverse proxy and NPA browser access steering methods? We are moving to enforcing phish-resistanct MFA and need to understand what is supported and what has been tested. If this is not currently supported, is this on the roadmap or would this require the use of enterprise browser?