Deploy Netskope Client on MacOS Using Jamf School

Jamf Profiles manage the core configuration for Client installation. The following sections provide a detailed overview of how to configure these profiles effectively.

Create Profile

Creating profiles is useful as it can help define and configure the system settings such as VPN, Restrictions, and so on for your device. Always create a profile before you start configuring the profile settings. For more information, view Profiles.

You can either create a new profile or add the following to an existing profile. To create a new configuration profile:

1. Log into JAMF School.

   

2. Go to Profiles.

3. Click +Create Profile.

4. In Platform, select the following:

   1. Select the Platform as macOS

   2. Select the Enrollment Type.

   3. Click Next.

5. In Details, perform the following:

   1. Enter the profile name.

   2. Enter the description for the profile.

6. Click Next.

7. In Time Filter, select the checkbox to configure the time at which you want to apply the profile to the devices.

8. Click Finish.

   After creating the profile, it navigates to the page where you can set up the profile details such as Certificates, System Extensions, and so on. Refer to the following sections to learn more about adding different attributes in your profile.

Pre-Approve Network Extension

The Netskope Client on macOS installs a network extension that requires administrator approval to function. The following configuration pre-approves the network extension and suppresses end-user notifications requesting approval.

To configure system extensions in Jamf School:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Click System Extensions.

5. Click Configure and perform the following:

   1. Select the checkbox to enable Allow users to approve system extensions.

   2. Select Type as Allowed System Extensions.

   3. Enter 24W52P9M7W in Team Identifier.

   4. Click +Add and enter com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy

      in Allowed System Extensions.

      

6. Click Save.

Pre-Approve Full Disk Access Permission For macOS 14 (Sonoma) and Later

The Netskope Client on macOS requires Full Disk Access permissions for various foundational functionalities. The following configuration pre-approves these permissions and suppresses end-user notifications requesting approval.

To configure full disk access permission in Jamf School:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Click Security & Privacy.

5. Click Configure and perform the following:

   1. Click the Privacy tab.

   2. Scroll to System Policy All Files.

   3. Click Add new.

   4. Click Select Application.

   5. Enter the following:

      • Enter the Name.

      •  Enter com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy in Identifier.

      • Select Bundle ID for Identifier Type.

   6. Enter the following anchor apple generic and identifier in Code Requirement.

      "com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

      

6. Click Save.

Pre-Approve VPN Popup for App Proxy

The Netskope Client on macOS installs a network extension that triggers updates to the device’s Network settings. The following configuration pre-approves these updates and suppresses end-user notifications requesting approval.

To configure:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Click VPN.

5. Click Configure and perform the following:

   1. Enter any name in Connection Name.

   2. Select Custom SSL in Connection Type. 

   3. Enter com.netskope.client.Netskope-Client in Identifier.

   4. In Designated Requirement, enter the following:

      anchor apple generic and identifier”com.netskope.client.Netskope-Client” and (certificateleaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificateleaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificateleaf[subject.OU] = “24W52P9M7W”)

   5. Select App-Proxy in Provider Type.

   6. Enter the Netskope Gateway URL for the tenant in Server: gateway-<tenant_hostname>.goskope.com

6. Click Save.

   

Restrict App Proxy Removal

Netskope recommends adding optional deployment parameter Restrict App Proxy Removal to manage user permissions regarding System Extensions in macOS 15 (Sequoia) and above. These controls prevent the removal of the specified system extension by the user.

To restrict app proxy removal:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Click Restrictions.

5. Click Configure and perform the following:

   • Under Preferences, select Restrict items in System Preferences.

   • Select items (Network in this case)

6. Click Save.

   

Push Netskope Root and Tenant Certificates Through Jamf School

Provide additional trust to end users by pushing Netskope certificates during Client installation. Before pushing the root and tenant certificates, ensure that you do the following:

1. Download root and tenant certificates from Netskope Certificates page.

   1. Login to Netskope tenant admin console with admin credentials.

   2. Go to Settings > Manage > Certificates > SIGNING CA. The certificate download options are displayed in the Certificate Setup section.

2. Convert the downloaded certificates to .cer format by renaming the .pem files to .cer.

Perform the following steps to add certificates to Jamf School:

1. In the Jamf School console, go to Profiles.

2. Select and open the required Profile.

3. Click Scope.

   1. Click + to add the desired group.

   2. Click Save.

4. Click Certificates.

   1. In Select your file, click Choose File and upload the root certificate.

   2. Click Upload Certificate.

   3. Repeat the same steps to upload the Netskope Intermediate certificate.

5. Click Save.

Use this section only if you are deploying using PLIST.

1. Go to Profiles.

2. Click +Create Profile.

3. Click Upload Custom Profile.

4. Upload the .mobileconfig file (check prerequisites to download the file) in Profile file.

   The webUI now displays Email Configuration in Settings in this profile.

   

5. Click Next.

6. Enter Profile Name and Description.

7. Click Next.

8. Enable Use time filter and select the time and day according to the requirement.

9. Click Finish.

   Click the created profile and map the respected device group.

In this section, add scripts in Jamf School that later helps in user enrollment based on the chosen enrollment method. Use the following enrollment methods of your choice and proceed with the deployment. For more information, view Scripts.

Copy and paste the shell script from the file nsclientconfig.sh downloaded from the Netskope Support Portal. For more information, view Prerequisites.

User Enrollment Method	Configuration Parameter
IDP Single-User mode	To add a new script using IDP Single-User mode: Go to Scripts > +Create New Script. Perform the following: Enter the Name for the script. Select bash in Type. Select Just once in when to run. Copy paste the above script in the content section and modify as follows on line #62: Remove leading “#” Replace Domain name=. For example, goskope.com. Tenant name=. For example, if your tenant URL is example.goskope.com, then enter only example. Email address request option. Replace with 0, if you do not want to request user's email address. Enter 1 to request user's email address. Add ​​enrollencryptiontoken if needed. For example, enrollencryptiontoken=51696332b0116a7f446077xxxxxxxxxx. Get your Encryption token from Settings > Security Cloud Platform > MDM Distribution > Secure Enrollment. Click + to add the desired device group. Click Save.
IDP Multi-User mode	To add a new script using IDP Multi-User mode: Go to Scripts > +Create New Script. Perform the following: Enter the Name for the script. Select bash in Type. Select Just once in when to run. Copy paste the above script in the content section and modify as follows on line #62: Remove leading “#” Replace Domain name=. For example, goskope.com. Tenant name=. For example, if your tenant URL is example.goskope.com, then enter only example. Email address request option. Replace with 0, if you do not want to request user's email address. Enter 1 to request user's email address. Enter peruserconfig to specify multi-user IDP deployment mode. Add ​​enrollencryptiontoken if needed. For example, enrollencryptiontoken=51696332b0116a7f446077xxxxxxxxxx. Get your Encryption token from Settings > Security Cloud Platform > MDM Distribution > Secure Enrollment. Click + to add the desired device group. Click Save.
PLIST	To add a new script using PLIST: Go to Scripts > +Create New Script. Perform the following: Enter the Name for the script. Select bash in Type. Select Just once in when to run. Copy paste the above script in the content section and modify as follows on line #68: Replace with addon-. For example, if administrators access Netskope admin console through acme.goskope.com then addon URL is addon-acme.goskope.com. Replace with the Organization ID available in the MDM Distribution webUI in your tenant. Leave the following as this is a static value: com.netskope.client.Netskope-Client.plist. Leave the following as this is a static value: preference_email If Secure Enrollment is enabled, append the authentication and encryption enrollment parameters and tokens: enrollencryptiontoken=<encryption token> enrollauthtoken=<authentication token> Get your Authentication token and Encryption token from Settings > Security Cloud Platform > MDM Distribution > Secure Enrollment. Click + to add the desired device group. Click Save.

You can use the In-House macOS Package option to upload the macOS package to Jamf School.

To create an app:

1. Go to Apps > Inventory.

2. Click + Add App.

3. Select Add In-House macOS Package.

4. In Add In-House macOS package, click to select the Netskope macOS .pkg file downloaded from Netskope Support.

5. Click Close.

   The Apps section displays the uploaded application details.

   

6. Click the edit icon to add the respective device groups to this application.

Create Device Group

Use Device Groups to classify your devices according to their attributes. For more information, view Device Groups.

To create a device group:

1. Log in to JAMF School.

2. Go to Devices > Device Groups.

3. In the Groups page, click +Add Group.

4. In Add device group, perform the following:

   1. Enter the name for the device group.

   2. Enter the description for the device group.

   3. Select Static Group or Smart Group.

      This document proceeds with the Static Group option. 

   4. In Options, configure the desired requirements.

   5. Click Next.

   6. In Profiles, select the profile that you want to add to the smart group for automatic or on-demand installation. Click Automatic/On-Demand tabs to select.

   7.  Click Next.

   8. In Apps, select the devices on which you want to install applications automatically or on-demand. Click Automatic/On-Demand tabs to select.

   9. Click Next.

   10. In Documents, select the documents from the list for automatic or on-demand installation.

   11. Click Next.

   12. In Members, select the devices that you want to add to this device group.

5. Click Finish.

   The Groups page displays the created device group details.

Check the installation logs on the user’s machine in the /var/log/install.log folder. If the user configuration download script fails and the Netskope client installer is executed, the installer will exit and display the “Configuration file missing, aborting installation! error” message.

Check Netskope Client Installation Status

1. To verify the status of each device, go to Computer > Policies and click on the policy you created.

2. Click the Logs button at the bottom to view the log files for each device and then click the Show button.

Confirming the Netskope Client Extension Approval

To confirm that the Netskope Client extension has been approved and the client is running, run the following command in your macOS terminal window:

systemextensionsctl list

The output should look like this:

% systemextensionsctl list  
1 extension(s)
--- com.apple.system_extension.network_extension
enabled active teamID bundleID (version) name [state]
* * 24W52P9M7W com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy (85.2.0.269/1) 
NetskopeClientMacAppProxy [activated enabled]

Additionally, inspect the system preferences and Network UI to confirm that Netskope Client extension is active.

See Uninstalling the Netskope Client for instructions on uninstalling the Netskope Client.