Next Generation API Data Protection supports the following features for the supported SaaS apps:
-
Policy alerts: Generates alerts on the Skope IT > Alerts page when a policy matches.
-
UEBA alerts: Generates User Entity Behavior Analytics (UEBA) alerts on the Skope IT > Alerts page. To learn more on UEBA: Behavior Analytics.
-
Audit: The audit action generates audit logs/events such as any change made in the SaaS app (upload, download, delete, and more) that Netskope retrieves using API calls. You can view the audit logs/events on the Skope IT > EVENTS > Application Events page of the Netskope UI.
-
DLP: The DLP profiles that enforce compliance and protect sensitive data consist of DLP rules that specify data identifiers. These data identifiers find content that should not be present in cloud app transactions or public cloud storage.
-
Threat Protection: Scans files stored in your cloud storage applications for malware.
Currently, Netskope allows the default malware profile only. Custom malware profile will be introduced in a future release. -
Retroactive Scan: A retroactive policy scans files, folders, repositories, and other supported entities that already exist in the app instance, going back up to the retroactive scan limit supported for that SaaS application.
-
Retroactive Scan Limit: The maximum historical look-back period that Next Generation API Data Protection can scan for a supported SaaS application when a retroactive scan is initiated. The limit is specific to each SaaS application and determines how far back existing files, messages, repositories, or other supported entities can be scanned.
-
Dashboard: Similar to Classic API Data Protection, Next Generation API Data Protection has a dashboard page. This page provides a high-level overview of total number of files, files with DLP violations, malware-infected files, internal and external users, file exposure, file DLP violations widget categorized by DLP rule or profile, and more.
-
Inventory: SaaS apps that support entities on the Inventory page. The Next Generation API Data Protection Inventory page provides deep insights on various entities supported by the SaaS apps.
-
Email Notification: Next Generation API Data Protection supports email notification in policy wizard. With this enhancement, you can now define an email notification for events in the policy wizard. These notifications, triggered by events like policy violations or alerts, provide administrators and designated user groups with timely information about important activities.
| Cloud Apps | Policy Alert | UEBA Alert | Audit | DLP | Threat Protection | Retroactive Scan | Retroactive Scan Limit | Dashboard | Inventory | Email Notification |
|---|---|---|---|---|---|---|---|---|---|---|
| Anthropic Claude Enterprise | Yes | Yes | Yes | Yes | Yes | Yes | 90 days | Yes | Yes | Yes |
| Atlassian Confluence | Yes | No | Yes | Yes | Yes | Yes | 90 days | No | Yes | Yes |
| Atlassian Jira | Yes | Yes | Yes | Yes | Yes | Yes | 90 days | Yes | Yes | Yes |
| Box | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite | Yes | Yes | Yes |
| ChatGPT Enterprise | Yes | No | No | Yes | Yes | Yes### | 30 days | Yes | Yes | Yes |
| Cisco Webex | Yes | Yes | Yes | Yes | Yes | Yes | 90 days | Yes | Yes | Yes |
| Dropbox | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite | Yes | Yes | Yes |
| Egnyte | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite | Yes | Yes | Yes |
| GitHub | Yes | Yes | Yes | Yes## | Yes## | Yes# | 10 days | No | Yes | Yes% |
| Gmail | Yes | Yes | No | Yes$ | Yes$ | No | No | Yes | Yes$$ | Yes |
| Google Calendar | Yes | Yes | Yes | Yes | Yes^ | Yes^^ | 28 days and 23 hours | Yes | Yes | Yes |
| Google Drive | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite | Yes | Yes | Yes |
| Microsoft Copilot | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite | Yes | Yes | Yes |
| Microsoft 365 OneDrive (Commercial/GCC) | Yes | Yes | Yes | Yes~ | Yes~ | Yes | Indefinite (files only) | Yes | Yes | Yes |
| Microsoft 365 OneDrive (GCC High) | Yes | Yes | Yes | No | No | No | No | No | No | Yes |
| Microsoft 365 Outlook (Commercial/GCC) | Yes | Yes | Yes | Yes~~ | Yes | No | No | Yes | Yes** | Yes |
| Microsoft 365 SharePoint (Commercial/GCC) | Yes | Yes | Yes | Yes~ | Yes~ | Yes | Indefinite (files only) | Yes | Yes | Yes |
| Microsoft 365 SharePoint (GCC High) | Yes | Yes | Yes | No | No | No | No | No | No | Yes |
| Microsoft 365 Teams (Commercial) | Yes | Yes | Yes | Yes~ | Yes~ | No | No | Yes | Yes | Yes |
| Microsoft 365 Teams (GCC High) | No | Yes | Yes | No | No | No | No | No | No | No |
| Microsoft Viva Engage | Yes | Yes | Yes | Yes | No | No | No | No | Yes | Yes |
| Okta | No | Yes | Yes | No | No | No | No | No | No | No |
| Salesforce | Yes | Yes | Yes | Yes | Yes | Yes$$$ | Files - indefinite Page, Comment, ChatMessage - 180 days | Yes | Yes | Yes |
| ServiceNow | Yes | No | No | Yes%% | Yes%%% | Yes | Indefinite | Yes | Yes | Yes |
| ShareFile | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite | Yes | Yes | Yes |
| Slack Enterprise | Yes | Yes | Yes | Yes | Yes | Yes*** | 90 days | Yes | Yes | Yes |
| Smartsheet | Yes | Yes | Yes | Yes* | Yes* | Yes | Indefinite | Yes | Yes | Yes |
| Workday | Yes | Yes | Yes | Yes | Yes | Yes | Indefinite (files only) | Yes | Yes | Yes |
| Zendesk | No | Yes | Yes | No | No | No | No | No | No | No |
| Zoom | Yes | No | Yes | Yes^^^ | Yes^^^ | No | No | Yes | Yes | Yes |
#You can scan up to the last 10 days for default branch commits only.
##Netskope can scan for DLP and threat protection on plain text source code only. Netskope does not scan binary files such as Microsoft Office docs, PDFs, images, executable files, and likes. Each section of a commit that includes any violations will result in a unique incident with a URL linking to that section of the commit. To view a DLP incident, navigate to Incidents > DLP, look for a GitHub incident, and click it.
###You can scan up to the last 90 days from when the retroactive scan is initiated.
^Only applicable to notes/attachments.
^^You can scan up to the last 30 days from when the retroactive scan is initiated.
^^^For more information, see Activities Monitored by Netskope.
%The Owner field does not apply to repository when you configure email notification for GitHub.
%%For ServiceNow, Netskope supports DLP for the record field values and attachment content. However, work notes and comments content are not supported yet.
%%%For ServiceNow, Netskope supports threat protection for attachments only.
~Netskope does not scan any OneNote files for DLP and threat protection on Microsoft 365 OneDrive (Commercial), SharePoint (Commercial), and Teams (Commercial).
~Microsoft 365 Teams (Commercial): Microsoft does not provide any webhook notification for files uploaded through the files and wiki tab of Microsoft 365 Teams. Due to this limitation, Netskope does not support DLP scanning and threat protection for such file uploads. However, Netskope detects files sent as an attachment from a channel’s chat window. For full coverage, you should set up respective API Data Protection instances for Microsoft Office 365 OneDrive and SharePoint.
~~For DLP, Netskope scans outgoing emails (sent folder) including the body of the message, subject, and attachment. For threat protection, Netskope scans attachment only.
*DLP scan on Smartsheet is supported for sheets, reports, comments, and attachments. It is not supported for workspace, forms, and dashboards. Threat Protection scan is not supported for forms.
**The Inventory page displays emails that have either violated a policy, or contain an attachment that violated a policy.
***For Slack Enterprise, Netskope provides retroactive scanning of messages and files from the past 90 days.
$For DLP, Netskope scans outgoing emails (sent folder) including the body of the message, subject, and attachment. For threat protection, Netskope scans attachment only.
$$The Inventory page displays emails that have either violated a policy, or contain an attachment that violated a policy.
$$$Salesforce supports retroactive scan for file (content document, document, attachment), message (chatter message), page (feed item), and comment (feed comment). However, for message, page, and comment entity types, Netskope only lists and scans entities that were either created or updated within the past 180 days (current time [minus] 180 days).
More feature matrix for the supported SaaS apps:
-
Change Owner to Specific User: This action changes the owner of the file to a specific user. Designates the administrative owner of files and folders for which the policy is applied.
-
Restrict Access to Internal Users: This action restricts the access of the file to users within the organization and domains as defined under Settings > Administration > Internal Domains.
-
Restrict Access to Owner: This action restricts the access of the file to the owner only.
-
Restrict Access to Specific Domains and Internal Users: This action restricts the access of the file to selected domain(s) and internal collaborators as defined in the previous bullet item. On clicking this option, the UI prompts you to enter the domain profile name. Click Proceed.
If you do not have a domain profile defined, click Manage Domain Profiles to create a new domain profile. -
Revoke Users Added at the File Level: This action removes individually listed users be it internal or external from accessing the file. Special note on Microsoft 365 OneDrive & SharePoint. To learn more: Policy Action Special Behavior.
-
Revoke Organization-wide Sharing: This action removes any kind of organization-wide sharing links and access.
-
Revoke Public Sharing: This action removes general access/public links. Only users who have access can open the file.
-
Revoke Access from Specific Domains: This action removes access for users matching the specified domain profile. On clicking this option, the UI prompts you to enter the domain profile name. Click Proceed.
If you do not have a domain profile defined, click Manage Domain Profiles to create a new domain profile.
| Cloud Apps | Change Owner to a Specific User | Restrict Access to Internal Users | Restrict Access to Owner | Restrict access to Specific Domains and Internal Users | Revoke Users Added at the File Level | Revoke Organization-wide Sharing | Revoke Public Sharing | Revoke Access from Specific Domains |
|---|---|---|---|---|---|---|---|---|
| Anthropic Claude Enterprise | No | No | No | No | No | No | No | No |
| Atlassian Confluence | No | Yes | No | Yes | No | No | Yes | Yes |
| Atlassian Jira | No | No | No | No | No | No | No | No |
| Box## | Yes# | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| ChatGPT Enterprise | No | No | No | No | No | No | No | No |
| Cisco Webex | No | No | No | No | No | No | No | No |
| Dropbox## | No | Yes | No | Yes | Yes | Yes | Yes | Yes |
| Egnyte | No | Yes | No | Yes | Yes~~~ | No | Yes | Yes~~~ |
| GitHub | No | Yes~ Note: Removes external collaborators only. | No | No | No | No | No | No |
| Gmail | No | No | No | No | No | No | No | No |
| Google Calendar | No | No | No | No | No | No | No | No |
| Google Drive** | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Microsoft Copilot | No | No | No | No | No | No | No | No |
| Microsoft 365 OneDrive (Commercial/GCC)* | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Microsoft 365 OneDrive (GCC High) | No | No | No | No | No | No | No | No |
| Microsoft 365 Outlook (Commercial/GCC) | No | No | No | No | No | No | No | No |
| Microsoft 365 SharePoint (Commercial/GCC)* | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Microsoft 365 SharePoint (GCC High) | No | No | No | No | No | No | No | No |
| Microsoft 365 Teams (Commercial) | No | No | Yes | No | No | No | No | No |
| Microsoft 365 Teams (GCC High) | No | No | No | No | No | No | No | No |
| Microsoft Viva Engage | No | No | No | No | No | No | No | No |
| Okta | No | No | No | No | No | No | No | No |
| Salesforce | No | No | No | No | No | No | No | No |
| ServiceNow | No | No | No | No | No | No | No | No |
| ShareFile | No | No | No | No | No | No | No | No |
| Slack Enterprise | No | No | No | No | No | No | No | No |
| Smartsheet### | No~~ | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Workday | Yes*** | Yes | Yes | Yes | No | Yes | No | Yes |
| Zendesk | No | No | No | No | No | No | No | No |
| Zoom | No | No | No | No | No | No | No | No |
#Box supports changing the owner of the file only, not the folder.
##For the restrict or revoke access remediation actions, the default setting does not restrict or revoke inherited permissions when they match the policy. If you would like to enable this feature for Box and Dropbox, talk to your Netskope sales representative.
###Important points to note on Smartsheet:
-
For the restrict or revoke access remediation actions, the default setting does not restrict or revoke inherited permissions when they match the policy. If you would like to enable this feature for Smartsheet, talk to your Netskope sales representative.
-
Revoke access is possible for any user other than the owner.
-
Due to limitations in the Smartsheet API, restricting access to comments or attachments independently is not supported. When a policy violation occurs in a comment or attachment, Next Generation API Data Protection restricts access to the parent sheet instead.
~Currently, Netskope does not support Restrict Access to Internal Collaborators remediation action in GitHub from the Incidents page. As a workaround, you can restrict access to internal collaborators either from the policy wizard page or navigate to API-enabled Protection > CASB API (Next Gen) > Inventory, then click the Content Collections drop-down and select Repository. Identify the repository name, and take the appropriate action.
~~Not supported by the Smartsheet API.
~~~A sharing link with multiple recipients will be deleted even if a single recipient’s access is revoked.
*In Microsoft 365 OneDrive and SharePoint, files can inherit sharing links from a parent folder. When performing remediation actions—either manually from the Inventory page or via policies—if only certain users need their inherited access revoked, new sharing links may be generated at the file level to preserve access for others.
**Important points to note on Google Drive:
-
Change owner to a specific user – Since there is no owner in Google shared drive, Netskope cannot change owner on files or folders in a shared drive. This action applies to My Drive only.
-
Restrict access to owner – Since there is no owner in Google shared drive, Netskope cannot restrict access to owner on files or folders in a shared drive. This action applies to My Drive only.
-
Restrict access for inherited permission – Netskope does not remove inherited permissions from files or folders in Google Drive (including both My Drive and Shared Drives). Inherited permissions are controlled at the parent folder level where they originate and must be managed there. When a permission removal request includes any inherited permissions, the entire operation fails because permission changes are processed in batches. To ensure successful removal of direct permissions, exclude inherited permissions from the request and update them at the parent folder level instead.
-
Policy action for files and folders in a shared drive – Netskope only applies policy actions to files or folders in a shared drive if there is a user with a Manager/Content Manager/Writer role on the shared drive. Netskope impersonates that user to carry out the policy action. If there are no permissions granted to any user with these roles on the shared drive, Netskope will not perform the policy action, even if there is a policy hit.
-
Quarantine: Netskope does not support Google Jamboard and Google Apps Script file types for quarantine.
***Workday automatically restricts the access to the new owner only. The others including the previous owner will no longer have access to the file.
More feature matrix for the supported SaaS apps:
-
Restrict Access to Owner’s Domain: Restrict access to users within the current domain. Remove file permissions if a user’s email domain differs from the file owner’s. Only users in the current domain will have access.
-
Restrict Access to Specific Domains: Restrict access to users of the domains in the domain profile. Only users matching the specified domain profile will have access.
-
Restrict Access to Specific Users: Restrict access only to the users in the user profile. Only users matching the specified user profile will have access.
-
Revoke Access from Specific Users: Revoke access to all users except the ones in block-list user profiles. Remove access for users matching the specified user profile.
-
Disable Print & Download: Restrict users from printing and downloading files. You can apply this policy action to restrict access to view only.
-
Set Link Expiration Date: Publicly shared links will expire after ‘x’ days.
-
Restrict Sharing to View: Remove edit and comment permissions from files and folders.
-
Webhooks: Delivers near out-of-band notifications from the SaaS application to Next Generation API Data Protection when supported events occur.
| Cloud App | Restrict Access to Owner's Domain | Restrict Access to Specific Domains | Restrict Access to Specific Users | Revoke Access from Specific Users | Disable Print & Download | SharePoint/OneDrive: Revoke EEEU sharing | Set Link Expiration Date | Restrict Sharing to View | Webhooks |
|---|---|---|---|---|---|---|---|---|---|
| Anthropic Claude Enterprise | No | No | No | No | No | No | No | No | Not Supported |
| Atlassian Confluence | Yes | Yes | No | No | No | No | No | No | Supported |
| Atlassian Jira | No | No | No | No | No | No | No | No | Supported |
| Box*** | Yes | Yes | Yes | Yes | Yes* | No | Yes^^ | Yes** | Supported |
| ChatGPT Enterprise | No | No | No | No | No | No | No | No | Not Supported |
| Cisco Webex | No | No | No | No | No | No | No | No | Not Supported |
| Dropbox*** | Yes | Yes | Yes | Yes | Yes^ | No | No | Yes$$ | Not Supported |
| Egnyte | Yes$ | Yes## | Yes## | Yes## | No | No | No | Yes | Supported |
| GitHub | No | No | No | No | No | No | No | No | Supported |
| Gmail | No | No | No | No | No | No | No | No | Supported |
| Google Calendar | No | No | No | No | No | No | No | No | Supported |
| Google Drive | Yes | Yes | Yes | Yes | Yes | No | No | Yes | Supported |
| Microsoft Copilot | No | No | No | No | No | No | No | No | Supported |
| Microsoft 365 OneDrive (Commercial/GCC) | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes# | Supported |
| Microsoft 365 OneDrive (GCC High) | No | No | No | No | No | Yes | No | No | Supported |
| Microsoft 365 Outlook (Commercial/GCC) | No | No | No | No | No | No | No | No | Supported |
| Microsoft 365 SharePoint (Commercial/GCC) | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes# | Supported |
| Microsoft 365 SharePoint (GCC High) | No | No | No | No | No | Yes | No | No | Supported |
| Microsoft 365 Teams (Commercial) | No | No | No | No | No | No | No | No | Supported |
| Microsoft 365 Teams (GCC High) | No | No | No | No | No | No | No | No | Supported |
| Microsoft Viva Engage | No | No | No | No | No | No | No | No | Not Supported |
| Okta | No | No | No | No | No | No | No | No | Not Supported |
| Salesforce | No | No | No | No | No | No | No | No | Not Supported |
| ServiceNow | No | No | No | No | No | No | No | No | Not Supported |
| ShareFile | No | No | No | No | No | No | No | No | Not Supported |
| Slack Enterprise | No | No | No | No | No | No | No | No | Not Supported |
| Smartsheet~~ | Yes | Yes | Yes | Yes | No | No | No | Yes | Not Supported |
| Workday | Yes | Yes | Yes | No | No | No | No | No | Not Supported |
| Zendesk | No | No | No | No | No | No | No | No | Not Supported |
| Zoom | No | No | No | No | No | No | No | No | Supported |
^Netskope disables downloads for shared links, but users or groups with file access permissions can still download the file.
^^Log in to Box as an admin, then navigate to Admin Console > Enterprise Settings > Content & Sharing tab. Scroll down to the Auto-Expiration setting and enable Allow item owners and editors to modify the expiration date. This setting is required for this action to work.
*Box does not directly support the disable download action. To support this action, Netskope locks the file so that you cannot download the file.
**Box does not directly support the view only action. To support this action, Netskope locks the file and the permissions of all the collaborators in the Box file/folder are set to viewer access level so that the collaborators cannot unlock the file.
***For the restrict or revoke access remediation actions, the default setting does not restrict or revoke inherited permissions when they match the policy. If you would like to enable this feature for Box and Dropbox, talk to your Netskope sales representative.
#The Restrict Access to View action for Microsoft 365 OneDrive & SharePoint relies on ‘beta’ Microsoft Graph APIs. So the behavior might be inconsistent.
##A sharing link with multiple recipients will be deleted even if a single recipient’s access is revoked.
~The disable download action does not apply to plain text files.
~~Important points to note on Smartsheet:
-
For the restrict or revoke access remediation actions, the default setting does not restrict or revoke inherited permissions when they match the policy. If you would like to enable this feature for Smartsheet, talk to your Netskope sales representative.
-
Revoke access is possible for any user other than the owner.
-
Due to limitations in the Smartsheet API, restricting access to comments or attachments independently is not supported. When a policy violation occurs in a comment or attachment, Next Generation API Data Protection restricts access to the parent sheet instead.
$Egnyte’s file owner is categorized as following:
-
File in shared folder: Shared folders and files under them do not have designated owners.
-
File in private folder: Owner is set to the admin/power user who owns the private folder.
$$In Dropbox, a file could either have a shared link with view access or write access. With this action, Netskope removes the write access shared link to make sure the file is read only.
More feature matrix for the supported SaaS apps:
-
Licensing: The minimum SaaS application license or edition required to integrate with Next Generation API Data Protection.
-
Delete: Deletes a file from the cloud app when a policy matches.
-
Legal Hold: Preserves all forms of relevant information when litigation is reasonably anticipated. You can choose to have a copy of the file saved for legal purpose if it matches policy criteria.
-
Quarantine: Allows you to quarantine a file if a user uploads a document that has a DLP violation. This moves the file to a quarantine folder for you to review and take appropriate action.
-
Threat Protection Quarantine: This action quarantines a malware-infected file. This moves the file to a quarantine folder for you to review and take appropriate action.
-
DRM (Box Label): Box allows users to classify, label, and protect data as part of its security classification capability. Next Generation API Data Protection has introduced a new policy action – Apply Sensitivity Label. With this action, you can now apply a Box classification label on DLP-sensitive Box files.
-
DRM (Microsoft Purview Information Protection): Microsoft Purview Information Protection (MPIP, formerly Microsoft Information Protect) is a Digital Rights Management (DRM) solution provided by Microsoft to help classify, label, and protect data. Next Generation API Data Protection has introduced a new policy action – Apply Sensitivity Label. With this action, you can apply an MPIP label on DLP-sensitive files.
-
DRM (Google Badged Label): Netskope supports Google’s badged label, a content classification feature. With this new capability, Netskope can read through the badged labels in Google Drive and apply a policy action. For example, if a document matches a badged label value which is deemed sensitive, an alert action can be taken. To learn more: Create a Next Generation API Data Protection Policy
-
Access Review: The access review action notifies Microsoft 365 SharePoint site owners about over-shared top-level sites to review and remediate site access permissions.
| Cloud App | Licensing | Delete | Legal Hold | Quarantine | Threat Protection Quarantine | DRM (Box Label) | DRM (Microsoft Purview Information Protection) | DRM (Google Label Badge) | Access Review |
|---|---|---|---|---|---|---|---|---|---|
| Anthropic Claude Enterprise | Enterprise | Yes## | No | No | No | No | No | No | No |
| Atlassian Confluence | Standard, Premium, Enterprise | No | No | No | No | No | No | No | No |
| Atlassian Jira | Standard, Premium, Enterprise | No | No | No | No | No | No | No | No |
| Box | Business, Business Plus, Enterprise, Enterprise Plus, Enterprise Advanced | Yes# | Yes | Yes | Yes | Yes | Yes | No | No |
| ChatGPT Enterprise | Enterprise | Yes** | No | No | No | No | No | No | No |
| Cisco Webex | Business, Enterprise | Yes | No | No | No | No | No | No | No |
| Dropbox | Advanced, Enterprise | Yes | Yes | Yes | Yes | No | Yes | No | No |
| Egnyte | Business, Enterprise Lite, Elite, Ultimate | Yes | Yes | Yes | Yes | No | Yes | No | No |
| GitHub | Enterprise Cloud | No | No | No | No | No | No | No | No |
| Gmail | Business Standard, Business Plus, Enterprise | No | No | No | No | No | No | No | No |
| Google Calendar | Business Standard, Business Plus, Enterprise | No | No | No | No | No | No | No | No |
| Google Drive | Business Standard, Business Plus, Enterprise | Yes | Yes### | Yes | Yes | No | Yes | Yes (read/write) | No |
| Microsoft Copilot | Supported Microsoft Copilot Licenses | No | No | No | No | No | No | No | No |
| Microsoft 365 OneDrive (Commercial/GCC) | Supported Microsoft 365 OneDrive Licenses | Yes | Yes | Yes$ | Yes | No | Yes | No | No |
| Microsoft 365 OneDrive (GCC High) | Supported Microsoft 365 OneDrive Licenses | No | No | No | No | No | No | No | No |
| Microsoft 365 Outlook (Commercial/GCC) | Supported Microsoft 365 Outlook Licenses | No | No | No | No | No | No | No | No |
| Microsoft 365 SharePoint (Commercial/GCC) | Supported Microsoft 365 SharePoint Licenses | Yes | Yes | Yes$ | Yes | No | Yes | No | Yes |
| Microsoft 365 SharePoint (GCC High) | Supported Microsoft 365 SharePoint Licenses | No | No | No | No | No | No | No | No |
| Microsoft 365 Teams (Commercial) | Supported Microsoft 365 Teams Licenses | No | No | No$$ | No | No | No | No | No |
| Microsoft 365 Teams (GCC High) | /en/supported-microsoft-office-365-teams-licenses-for-next-generation-api-data-protection | No | No | No | No | No | No | No | No |
| Microsoft Viva Engage | Supported Microsoft Viva Engage Licenses | Yes%% | No | No | No | No | No | No | No |
| Okta | Starter,Essentials,Professional,Enterprise | No | No | No | No | No | No | No | No |
| Salesforce | Professional, Enterprise, Performance, Unlimited | Yes%% | Yes~~~ | Yes~~~ | Yes | No | No | No | No |
| ServiceNow | All Licenses | No | No | No | No | No | No | No | No |
| ShareFile | All Licenses | No | No | No | No | No | No | No | No |
| Slack Enterprise | Enterprise with eDiscovery | Yes | Yes | Yes | Yes | No | No | No | No |
| Smartsheet | Enterprise license with Event Reporting Addon | Yes* | No | No | No | No | No | No | No |
| Workday | Workday Human Capital Management | No | No | No | No | No | No | No | No |
| Zendesk | Professional,Enterprise,Enterprise Plus | No | No | No | No | No | No | No | No |
| Zoom | Pro, Business, Enterprise | Yes | No | No | No | No | No | No | No |
#The choice between moving files to trash or permanently deleting them in Box is determined in the Box admin console. To configure this setting, go to Admin Console > Enterprise Settings > Content & Sharing > Trash. Customers can make this decision based on their preferences.
##When triggered on a chat violation, the entire conversation thread is permanently deleted. When triggered on a file violation, only the specific file is deleted. This action is irreversible.
###Netskope does not support Google Jamboard and Google Apps Script file types for legal hold.
%%For Salesforce, Netskope supports a soft-delete only for content document, document, and attachment. This is due to upstream API limitation. On performing the delete action, Netskope moves the file to the recycle bin.
%%For Microsoft 365 Viva Engage, Netskope supports a soft-delete only for attachment. This is due to upstream API limitation. On performing the delete action, Netskope moves the file to the backing SharePoint site’s recycle bin.
*Due to a limitation in the Smartsheet API, deletion of reports is not supported. Delete action is supported for all other Smartsheet resources, including sheets, dashboards, attachments, comments, and workspaces.
**Delete applies to files only. The delete action does not apply to user prompt or AI response conversation messages, as the ChatGPT Compliance API does not support deletion of individual conversation. Additionally, if the model had already inserted file content into a conversation context prior to deletion, those embedded snippets remain in the conversation history and are not removed.
$If you have any Microsoft Purview Information Protection (formerly Microsoft Information Protection)-encrypted files in Microsoft 365 OneDrive or SharePoint, Netskope cannot tombstone such encrypted files. This is due to a limitation in the Microsoft Graph API.
$$Files that are uploaded to Microsoft Teams chats or channels are stored in Microsoft 365 OneDrive or SharePoint respectively. For reference, read this Microsoft article. You can create a policy with a quarantine profile in Microsoft 365 OneDrive or SharePoint instances. Hosted contents are currently not supported.
~~~You cannot configure Salesforce as a legal hold or quarantine destination. However, an offending file or an object can be copied or quarantined to a different SaaS app as a destination (like Google Drive, Microsoft 365 OneDrive, SharePoint, or any other app that supports legal hold or quarantine as a destination).