The Access Graph in DataSec Command Center visualizes how identities connect to sensitive files across your cloud repositories. It models who has access, what access mechanism grants that access, where the files reside, and what sensitive content they contain.
Use the Access Graph to:
- Identify overexposed sensitive data across SaaS applications and cloud storage repositories.
- Trace access paths from specific users, groups, or external guests to sensitive files.
- Locate access chokepoints, such as public links or tenant-wide permissions, that expose sensitive files to broad audiences.
- Plan and run remediations to reduce access exposure using native or advisory actions.
What Feeds the Graph
The Access Graph integrates data from multiple Netskope capabilities and connected systems:
| Source | Description |
|---|---|
| SaaS applications connected through CASB API | Provides file inventories, metadata, native permissions, direct sharing, shared drives, and sharing links. |
| Data stores connected through DSPM | Provides file inventories and sensitive data classifications for cloud storage repositories. |
| Directory integration | Enriches user accounts with corporate directory attributes, department data, manager relationships, and account status (active, suspended, offboarded) through Netskope User Provisioner or SCIM. |
To learn more about supported SaaS applications: Next Generation API Data Protection Feature Matrix per Cloud App
Starting an Investigation: The Landing Hub
To open the Access Graph landing hub, go to DataSec Command Center > Access Graph.
The landing hub presents risk lenses that group exposure risks into three key categories:
- Identity and access risk: Highlights accounts with broad exposure, including offboarded users with active access grants, suspended users, and non-human accounts (service accounts and AI agents). An offboarded user is an identity marked deleted or inactive in your directory. A suspended user is an identity marked suspended or blocked by directory administrators.
- External and public exposure: Summarizes assets accessible to anyone on the internet, external domains, or guest users through direct sharing and public links.
- Internal exposure: Displays sensitive data exposed across all internal users in the organization or through tenant-wide sharing links.
From the landing hub, you can begin your analysis in two ways:
- Click Investigate risk findings to review filtered findings aligned with the DataSec Command Center Risk page.
- Click Explore the full graph to open the interactive graph canvas with all connected assets and permissions in view.
Reading the Graph
The graph canvas organizes access relationships across four primary columns, with a scope bar at the top and an objects region docked at the bottom.
WHO HAS ACCESS
This column represents the identities that can access files within the evaluated scope. The system categorizes identities into cohorts:
- Anyone on the internet: Public sharing links or unauthenticated access mechanisms.
- Internal users: Active corporate identities provisioned within your directory.
- External users: Third-party collaborators, personal accounts, and external vendor identities.
- Service accounts: Non-human identities used by integrations and automated workflows.
- AI agents: Automated agents or machine learning services interacting with repositories.
- Unlinked accounts: Accounts detected in SaaS applications that do not match a provisioned corporate identity.
- Access not analyzed: Files where permissions could not be evaluated due to API limitations or access restrictions.
- Audience unresolved: Access grants where individual group memberships or link recipients cannot be expanded.
Below the cohorts, the Top people section ranks individual identities by the number of sensitive files they can access.
ACCESS MECHANISM
This column displays how identities obtain access:
- Public access: Open links accessible without authentication.
- All internal users: Domain-wide or organization-wide links and permissions.
- External guest link: Sharing links shared directly with external email addresses.
- Group permission: Access inherited through directory groups or workspace teams.
- User sharing: Direct user-to-user file sharing.
- App-managed sharing: Access controlled by third-party application configurations.
- Owner-only access: Files accessible exclusively by the asset owner.
- Cloud store grant: IAM roles and bucket-level policies applied to cloud storage buckets.
When you select a mechanism, you can expand Top grants to identify chokepoints. A chokepoint is a single permission grant, group, or public link that provides access to a large volume of sensitive data.
DATA STORES
This column lists the managed SaaS applications (such as Google Drive, Microsoft OneDrive, SharePoint, and Box) and cloud storage buckets where evaluated files reside.
DLP PROFILES
This column lists the Netskope DLP profiles matched within exposed files. Use the toggle at the top of the column to switch between:
- Profiles: Displays aggregate policy profiles matched by files.
- Data Types: Displays individual sensitive data identifiers (such as Credit Card Numbers or Social Security Numbers).
Filtering, Focusing, and Sharing a View
Use filters to narrow the canvas scope to specific risk areas, users, or data stores.
Applying Filters
Click Filter on the scope bar to apply one or more criteria:
- Exposure: Public, External, Internal, or Restricted.
- DLP Profile: Predefined or custom DLP profiles.
- Data Type: Specific data identifiers detected in files.
- Last modified: File activity timeframes (such as last 7, 30, or 90 days).
- File size: Specific file size thresholds.
- Managed Application: Cloud services connected through CASB API.
- Store: Specific shared drives, sites, or cloud storage buckets.
- Access Path: Direct sharing, link sharing, or group inheritance.
- Risk Policy: Specific DataSec Command Center risk policies.
- Identity Type: Internal, external, service account, or AI agent.
- Identity Status: Active, suspended, or offboarded.
- Privilege Level: Admin, editor, or viewer permissions.
- Group: Directory groups or application-level security groups.
- Identity: Specific user accounts or email addresses.
Focusing on an Element
To isolate relationships for an identity, grant, or store:
- Hover over an item in any column.
- Click Focus. The canvas re-renders to show only the connected paths for that selected item.
- Click Back on the scope bar to return to your previous view.
Sharing a View
To share an exact investigation state with another administrator:
- Configure your filters and focused elements on the canvas.
- Click Copy link on the scope bar.
- Share the URL. The URL preserves all active filters, selections, and canvas states.
Investigating Identities
The Access Graph distinguishes between an identity (the person or service recorded in your directory) and linked accounts (the application-specific accounts that person uses across cloud services).
To investigate an identity:
- Click any user in the WHO HAS ACCESS column.
- Review the identity details drawer that opens on the right side of the page.
- Examine the Linked accounts section to see all application accounts mapped to that identity.
- Review access paths to see which sensitive files the user accesses directly versus through group membership.
Using Files and the Remediation Wizard
The docked region at the bottom of the page provides two tabs: Files and Remediation Wizard.
Reviewing Exposed Files
Click the Files tab to review the file inventory matching your current graph scope. The table displays:
- File name and file type
- Data store and application
- Exposure status
- DLP profile matches and data types
- File owner and last modified date
To trace the historical movement, access events, and exposure path of an exposed file see Viewing File Lineage.
Planning Actions with the Remediation Wizard
Click the Remediation Wizard tab to plan and review remediation steps for the current scope.
The wizard supports three remediation modes:
- Exposure mode: Focuses on removing broad access mechanisms, such as public links or organization-wide sharing.
- Identity mode: Focuses on revoking access for specific users, such as offboarded employees or unauthorized external guests.
- Classification mode: Focuses on securing files that contain specific high-risk data types or DLP profiles.
The remediation plan evaluates each proposed action across three metrics:
- Coverage: The number and percentage of exposed files secured by the action.
- Collateral: The number of legitimate users whose access is modified or removed by the action.
- Steps: The sequence of technical actions required to complete remediation.
Actions fall into two execution categories:
- Native: Actions executed directly through Netskope CASB API (such as revoking sharing links, changing link permissions, or removing collaborators).
- Advisory: Actions that require manual execution in third-party management consoles or directory services (such as disabling an account in your identity provider or modifying cloud IAM policies).
To learn more about supported native remediation actions per cloud app: Next Generation API Data Protection Feature Matrix per Cloud App
Example Investigations
Follow these walkthroughs to learn how to investigate and remediate common exposure scenarios.
- On the landing hub, locate External and public exposure and click Public access.
- On the graph canvas, look at the ACCESS MECHANISM column.
- Select Public access and expand Top grants.
- Identify the grant with the highest sensitive file count.
- Click Focus on that grant.
- Look at the DLP PROFILES column to review the sensitive data types exposed.
- Open the Remediation Wizard tab at the bottom of the page.
- Select Revoke public link under native actions.
- Click Apply action to eliminate public exposure for all files connected to that chokepoint.
- On the landing hub, locate Identity and access risk and click Offboarded users with access.
- Select an offboarded user from the WHO HAS ACCESS column.
- Review the identity details drawer to see their active linked accounts across cloud apps.
- Examine the ACCESS MECHANISM column to determine whether access stems from direct sharing or group membership.
- Open the Remediation Wizard tab.
- Choose Identity mode.
- Review native actions to remove direct user shares from SaaS repositories.
- Review advisory actions to remove the user from remaining corporate directory groups.
- Click Filter on the scope bar.
- Select Group and choose the project group you want to inspect.
- In the WHO HAS ACCESS column, inspect the External users cohort to identify guest email addresses.
- Click an external user to trace which data stores they can access through the group grant.
- In the DLP PROFILES column, verify whether files accessible to the group contain restricted sensitive data.
- Open the Remediation Wizard tab to plan group membership adjustments or restrict specific file permissions.
Coverage, Limits, and FAQ
What qualifies as a sensitive file in the Access Graph?
A file qualifies as sensitive if it matches at least one DLP profile configured in your Netskope tenant or evaluated by Netskope DSPM. Files without DLP rule matches appear in the general file inventory but do not generate sensitive exposure findings in the graph.
Which cloud stores does the Access Graph analyze?
The Access Graph evaluates SaaS applications connected through Next Generation API Data Protection and cloud storage repositories integrated with Netskope DSPM. It does not evaluate data from unmanaged web traffic or apps without API connectors.
What are unlinked accounts?
Unlinked accounts are application-level user accounts found in SaaS applications that do not match an active or inactive identity in your corporate directory (SCIM or Netskope User Provisioner). These often represent personal accounts, test accounts, or legacy users.
Why do some groups display as audience unresolved?
Some third-party applications do not expose nested group memberships or external domain link recipients through their APIs. When the system cannot expand the full membership list, it categorizes the grant as audience unresolved to indicate that additional unverified users may have access.