Private Access for ZTNA

Thank you in advance - as a security measure, I was wondering if rather than bypassing traffic to AWS Workspaces from Netskope, might it be possible instead to source anchor traffic from our AWS Netskope publishers and configure IP restrictions from the AWS-end, such that access to our Workspaces tenant was restricted to our AWS/Netskope publishers? We’d ideally only like for access to AWS Workspaces to be driven from Netskope client-driven endpoints.

Hi Team,Some of our customers would like the view under Settings → Cloud Security Platform → Devices to update (almost) in real time.Especially when selecting a specific device and clicking the refresh button, it often takes “forever” — if it has any effect at all — for the display to update and show which tunnels are currently online.The timestamp shown in the top left is current, but it does not reflect the actual status.This would be particularly helpful in troubleshooting situations.Our local SE mentioned that since this is not on the roadmap, we should submit a feature request for it. Thank you very much and best regards,Marco

Looking for recommendations here. We are currently trying to onboard a group of consultants and provided them a requirements document for use of Enterprise Browser. One office could not use EB due to network issues. So they are currently whitelisting the domains and ports from your list. Their question was what to replace MP with? Are there regional static MP domain names that can be used? Network Connectivity: Netskope Enterprise Browser needs access to the following domains/ports:https://nsbrowser-updates.<MP>.goskope.com: Browser updates and installer downloads. https://nsbrowser-config.<MP>.goskope.com: To retrieve tenant and user configurations.I assume if they whitelist by subnet instead, will that cover these MP domains, correct? Consolidated Whitelist CIDR Notation IP Address Range 8.36.116.0/24 8.36.116.0 - 8.36.116.255 8.39.144.0/24 8.39.144.0 - 8.39.144.255 31.186.239.0/24 31.186.239.0 - 31.186.239.255

Hiis it mandatory to provision on the tenant the users that will only have access to Browser Access apps? I mean, for third-party or contractors, that won’t install the Netskope Client and that only need access to browser access private apps, is needed to provision them via SCIM or manually?I have checked that having the user associated on the IdP, the user authenticates when trying to access the public URL of the BA private app, but if the user is not provisioned on the Netskope tenant, get a 401 error after authenticating even if the RTP policy allows “all users”The user only access the private app via BA after provisioning on the tenant. Is this correct? I wouldn’t like to provision all my contractors on the tenant Regards

SummaryAllow administrators to configure an active/passive failover mode for publishers on a per-application basis, instead of the current active-active only model.Business justificationWe route SAP S/4HANA traffic (SAP GUI thick client) through two Private Access publishers. The SAP GUI client does not tolerate network path changes: any publisher switch immediately resets the TCP session, causing a SAP_GUI_DISCONNECT error.Hundreds of unique users experienced repeated disconnections due to publisher switching. Each Netskope "Change in Network" event triggered a PoP or publisher change, breaking the active SAP session.Current situationActive-active (current): redundancy is maintained, but publisher switching causes mass disconnections for session-sensitive applications. Single publisher (our workaround): disconnections are resolved, but redundancy is completely lost. If the publisher fails, all SAP access is down.We are forced to choose between reliability and availability.Requested fe

We have facing the issues private access re authentication issues. to resolved the issues we have restarted issues user machine. but restart option is not a solution. 

Hello Everyone,I have a few questions regarding External User Access to On‑Prem Exchange via Netskope Private Access or Reverse Proxy.We are using Netskope Private Access (NPA) to publish our on‑premises Exchange Server behind a Netskope Publisher. Currently, only managed devices with the Netskope Client are allowed to access OWA and Outlook, and unmanaged devices are blocked who don’t have Netskope agent Installed — this is working as expected.This behavior is working as designed and aligns with our Zero Trust access policies.We now have a requirement to allow external users to access Outlook or OWA from non-managed devices and we have not exposed our OVA to Internet.Could you please confirm the following: Can Outlook or OWA access for external users be provided using Netskope Private Access without requiring the Netskope client on the user device? is there any other supported approach  to provide external user access to an on-premises Exchange server? Thank you for your confirmatio

Hi all, I have a question, that maybe it’s already managed in other ways but I don’t know.I have many apps that use the same port, example 8080, but I need to have different application segment because of security access. Is there a way to do in a different way? For example my think is to have one or more application segment and one or more real-time policies but create a “service group” with the port number and indicate it in the police and not in the private application segment.

Hi Community Happy New Year :)  I’m keen to understand if a Publisher Reboot is necessary every time a change is made to the local host file when using it for DNS resolution of applications hosted in Azure? It seems like a Publisher reboot is required when adding in entries? Is there a service that can be restarted instead for the changes to take effect? I’ve had a scrounge through the Community and Documentation pages but haven’t been successful in finding any info. Thanks in advance.

We are supporting a client with two separate Azure tenants and using Netskope SSE for secure access. Our configuration allows certain Azure base URLs via NPA for PaaS services, while the Azure portal routes through SWG. We use the same client and steering configuration for users accessing both tenants.Observed Behavior:When accessing via GUI/browser, traffic is correctly segregated per tenant.When using CLI, traffic always routes to the primary tenant, even when attempting to access resources in the secondary tenant.CLI-based operations cannot properly enforce tenant-specific routing.Impact: CLI operations on the secondary tenant fail or incorrectly use the primary tenant context

Hi team,Can we use  New Policy Group based on location and move all private access Policies on this group?  Example: Site A Private Access ( Group Name)          Site A Private Access Policy 1( Example Policy Name :File Server Site A Access)          Site A Private Access Policy 2 ( Example: Private Web Application Site A Access)         Site A Private Access Policy 3   ( Example: Backup Server Access Site A Access) Site B Private Access( Group Name)         Site  B Private Access Policy1 ( Example Policy  : File Server Site B Access)          Site B Private Access Policy 2  ( Example Policy: Private Web Application Site B Access)         Site B Private Access Policy 3   ( Example Policy: Backup Server site B Access) Challenge what I am trying to solve here is that group policy based on Physical location of offices, so that i dont need go through long list of Policy and navigating through this policies is difficult. So if we arrange the Policies based on locations , we know that this p

Why sometimes on-premise detection shows “remote" and sometimes it shows “off-premise” when users are not in intranet, such as office environment.

It seems that users under SkopeIT are only displayed when accessing Cloud Apps or the Web.Events from Cloud Firewall or Private Apps are not included, resulting in limited visibility.Do you have any suggestions on how we can monitor user activity in these cases?

ObjectiveThe current Private App Segment definition conflicts with what is described in the Netskope Knowledge Base article.When Publisher DNS is enabled, both IP and URL must be defined in the host configuration of a private app segment.Reference:https://docs.netskope.com/en/private-access-best-practices#idm46139539889184In docs.goskope.com, enabling Publisher DNS can still only use URL to define Private app, 2026/1/6 PrerequisiteThis issue generally applies to Netskope Private App Segments Definitions. ContextWe observed that in the current Netskope Private App Segment configuration, once Publisher DNS is enabled, users are unable to access a private application if only the private app URL is defined. Do You Know?This mechanism appears redundant. Once Publisher DNS is enabled, it is possible to configure a random port for the URL and then define a separate policy using the private IP with the correct port, since users can no longer access the URL using the originally defined port.Thi

There is a business need to have a desktop shortcut created to complete Re-authenticate Private Access.

Hi Teams, i’m try to find the CMD reference for publisher CLI to change the host name and username of default user on publisher ssh but cannot find in the knowledge KB from netskope. so i wonder is it possible to change the hostname of publisher and change the default username from ubuntu ?is they any issue if we change this parameter on publisher?i’m also need to change the same for cloud exchange server too.

WSL will work on windows , This info is not mentioned in netskope site (Windows Linux Subsystem)go to WSL settings change the networking mode to “ VirtioProxy” save it then run your commands , it should work In netskope tenant , you can see the logs refer to your laptop name . 

We have periodic reauthentication enabled for users, but on mobile devices, although a pop-up notification appears, users cannot view or be redirected to complete the  Periodical IdP Re-authentication to restore private app access.Is there any guidance available for this configuration?

What is currently supported to passthrough Phish-Resistant MFA methods like passkeys from unmanaged devices over Reverse proxy, universal reverse proxy and NPA browser access steering methods? We are moving to enforcing phish-resistanct MFA and need to understand what is supported and what has been tested. If this is not currently supported, is this on the roadmap or would this require the use of enterprise browser?  

Hi Team, Is it possible to integrate/ install AD agent so that we can apply client configuration based on OU. and Use Entra ID integration for SSO? Just for Sign-in.  Possible that we can use OU to provide access to private resources.? One way is to create groups and provide access to private resources and apply client configuration group or all users. Since we have multiple branch offices. we need to create many Groups and import in Entra ID.  So wondering if we can enable private access based on OU and apply client configuration based on OU as well.

Does anyone have any experience with allowing Partner Access for a 3rd party? We are thinking through building out device classification rules for a potential Partner Access use-case and it got me thinking about this topic. what will we see in Devices in our tenant for these devices? I assume we won’t have any “enable”/”disable” options but want to be sure safeguarding our partner safeguarding our environment

Use case: Our Support team can connect other users’ laptop with AOVPN feature but with zero Trust is blocking the admin drive access.In this user case, Support team can access the laptop CAL-XXX for Admin related activities but with Zero trust its not possible so what is the alternative solution? Is there any tool ? which can be used 

When running a query against “/api/v2/infrastructure/publishers” the list of to be returned fields can be attached. However it seems that only fields from the first level of the JSON can be selected. Does anyone know, if other fields e.g. assessment[latency], can be referenced in the field-list as well? And how? Thanks Timo

Team, Good morning. I’m using NPA to connect to Azure Databricks via Private Link’s.My initial connection works fine but the connection fails on the second attempt.I must clear the cache on the endpoint and disable/enable all clients services in the Netskope console for the connection to work again.When the connection fails, I get the error message below. Has everyone experience this issue connecting to Azure Databricks using NPA?   

Hi, I'm having a hard time with the netskope client on Linux. This is a WSL2 installation, and a netskope agent is running on the windows host. But the windows agent status has no influence on the behavior of the guest linux one. Very often, the nsclient config outputs a normal status with tunnel up, and private access enabled. Unfortunately the show-pa show this :  $ nsclient show-pastart process....Status: Connected (User Tunnel) Sent: 0 bytes Received: 78646 bytes and the nsdebuglog.log is spammen with this kind of errors : 2025/09/16 20:21:00.358996 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:01.381263 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:02.404470 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:25.547248 stAgentSvc p47489 t4755c error nsKernelUserShim.