We recently retired our VPN infrastructure and are using NPA for all private apps. I have attached a PDF that shows the configuration changes required on Mac systems for NPA to function properly. This covers disabling Secure DNS, Privacy & Security settings, disabling IPv6, disabling the QUIC protocol in Chrome, public DNS servers. Enjoy 😉
In certain instances, the private app domain name would be resolved to an IPv6 address, and the Netskope client was not able to recognize and steer it to publisher. By disabling IPv6 it got rid of this issue for us.