Before inviting users to install Enterprise Browser and setting up policies, you must set up the basic configurations for the Enterprise Browser.
Enterprise Browser requires users to authenticate to steer traffic through Netskope to the destination (e.g. the corporate apps). Each request generated by Enterprise Browser needs to include an auth token in the form of a header. Unauthenticated requests are not allowed, and users are prompted to authenticate to their SSO.
Authentication flow to your SSO needs to be bypassed in Enterprise Browser, so your users can effectively authenticate before using Enterprise Browser to access corporate apps.
There are two ways to configure user authentication flow bypass, depending on how you configure conditional access to enforce the use of Enterprise Browser to access your apps.
- Option A: Auth (IdP flows) happens outside of Netskope (Browser set up)
- Option B: Auth (IdP requests) happen through Netskope IP range / Dedicated Egress IP range
Option B requires enabling the feature in your account. You must contact Support to enable the feature in your account.
Enterprise Browser Authentication Bypass (Browser Bypass)
This section describes authentication (IdP flows) that happens outside of Netskope, Option A noted above. The bypass is configured at the browser level. Enterprise Browser sends the requests directly to the SSO domain. Authentication happens outside of Netskope.This is likely the preferred approach if you want to impose conditional access (Netskope IP range / DEIP) on each individual corporate app. Imposing conditional access on all traffic reaching the corporate application is the most secure way to ensure only managed traffic reaches the application, anytime.
Path: Settings → Security Cloud Platform → Enterprise Browser → Browser Setup
- Set up the identity provider:
- Go to Forward Proxy SAML Section to connect your identity provider with Nestkope’s Forward Proxy. This will allow Netskope to authenticate users using Netskope Enterprise Browser. Select Access Method = “Enterprise Browser”.
- Set up the Bypass Settings:
Incoming requests from EB are only accepted after the user is authenticated to the customer’s SSO as configured in the previous step.
- You need to specify your IdP domains to allow user authentication to your SSO. If you do not include your IdP domains in this list, users will not be able to reach your IdP Domains to authenticate, and they will not be able to use Enterprise Browser.
- E.g. If your IdP is Okta, you will need to include: *.okta.com, *.oktacdn.com each in a separate row.
- Include Netskope domains such as: nsauth-<your_tenant_name>.goskope.com and authservice.goskope.com. To learn more: Recommended IdP Bypass List
SAML Proxy Authentication Bypass
This section describes authentication (IdP requests) that happens through Netskope IP range / Dedicated Egress IP range, Option B noted above.
Honoring SAML proxy auth bypass requires enabling the feature in your account. Contact Support to enable it in your account.
The bypass is configured at the Enterprise Browser / CEP level. Enterprise Browser steers unauthenticated requests to SSO from the Netskope IP range / DEIP range. Authentication requests originate from Netskope.
This is the preferred approach if you want to impose conditional access (Netskope IP range / DEIP) on the IdP level (e.g. typically with Okta). Imposing conditional access on all traffic (Option A) reaching the corporate application is the most secure way to ensure only managed traffic reaches the application, anytime.
Path: Settings → Security Cloud Platform → Forward Proxy → SAML → Settings →Bypass
Recommended IdP Bypass List
The following are the most frequently used IdPs with Netskope Enterprise Browser. This is the minimal bypass lists that need to be configured for the Enterprise Browser for different IdPs in Netskope UI, but it might require adaptations for your specific settings.
EB Bypass List for Microsoft Entra
Explicitly bypass the following domains for Microsoft Entra SSO authentications:
browser.events.data.microsoft.com autologon.microsoftazuread-sso.com autologon.microsoft-sso.com login.live.com login.microsoftonline.com login.microsoft.com aadcdn.msftauth.net aadcdn.msauth.net device.login.microsoftonline.com mysignins.microsoft.com authservice.goskope.com nsauth-<tenant-name>.goskope.com
EB Bypass List for Okta
Explicitly bypass the following domains for Okta SSO authentications:
*.okta.com *.oktacdn.com authservice.goskope.com nsauth-<tenant-name>.goskope.com
EB Bypass List for Google Workspace IdP
Explicitly bypass the following domains for Google SSO authentications:
accounts.google.com play.google.com *.gstatic.com authservice.goskope.com nsauth-<tenant-name>.goskope.com
EB Bypass List for OneLogin IdP
Explicitly bypass the following domains for OneLogin SSO authentications:
<Domain name in OnLogin>.onelogin.com web-login-v2-cdn.onelogin.com cdn.cookielaw.org cdn.onelogin.com nsauth-<tenant-name>.goskope.com