Connect an SMB DFS File Share

Overview

DSPM connects SMB DFS namespaces through the same SMB connection flow described in Connect Your Data Store. This article covers endpoint setup, service account requirements, namespace link selection, duplicate scanning rules, scan results, and a known limitation.

Enter the DFS Namespace Endpoint

In the Data Store Endpoint field, enter the namespace path in UNC format. Use one of these formats:

• \\domain\namespace (for example, \\corp.test\shared)
• \\server\share (server-based DFS root)

For UNC endpoints, the share name is already part of the endpoint path. As a result, the system clears the Mount Point field and disables it, so the field appears grayed out.

Grant the Service Account Access to Target Shares

If the service account can read the root but lacks permission for a target share, DSPM:

• skips that link
• logs an ACCESS_DENIED warning in the scan logs
• silently omits the files in that link from the scan results

To learn more: Create a Netskope DSPM Service Account.

Choose the Shares to Scan

After the credentials validate and the connection succeeds, DSPM discovers the namespace links (the visible shares in the namespace) and displays the DFS Namespace Link Selection panel on the Select Capabilities tab.

In the panel, choose one of these 2 scanning modes:

Scanning Mode	Description
All Shares in Namespace (default)	Scans every link in the namespace. DSPM automatically scans any new SMB shares added to the DFS link in the next scan.
Selected Shares	Scans only the links you choose.

When you choose Selected Shares, you can combine these selection options. DSPM scans a link if either option selects it:

• Shares drop-down: a searchable list of the namespace links
• Also include shares matching: an optional regular expression that DSPM evaluates against link names during each scan, in addition to the shares you select explicitly

Understand Duplicate Scanning Rules

Duplicate scanning occurs when a share that is already onboarded in one data store is also part of a new data store you onboard. When the same data store is scanned twice, DSPM reports the same sensitive files multiple times, skewing sensitive data counts and related statistics.

You can split a single namespace across multiple data stores for multi-team setups, such as separate data stores for engineering and finance links. To handle this, DSPM checks for overlap during onboarding and applies these rules:

Prepare LDAP for Privilege Analysis (Optional)

If you plan to enable Privilege Analysis for your data store, configure LDAP credentials to allow Netskope DSPM to resolve user and group memberships. LDAP connectivity enables the platform to map permissions to specific users and groups, identify transitive group memberships (nested groups), and determine privilege levels and access risks. Configure LDAP during initial onboarding for comprehensive privilege analysis from day 1, or configure it later if needed.

Privilege Analysis Enablement (Toggle)

• New data stores: The Privilege Analysis toggle is enabled by default. You are prompted to either provide new LDAP credentials or select an existing LDAP connection from a dropdown (identified by the LDAP URL).
• Existing data stores: Go to Edit Data Store and toggle Privilege Analysis to ON.

Gather Your LDAP Configuration

Before proceeding to the DSPM console, ensure you have the following details ready:

• LDAP Server URL: Your Active Directory domain controller hostname/IP with port 389 (standard) or 636 (SSL).
• Base DN: Your Active Directory domain in DN format (for example, if your domain is example.com, the Base DN is DC=example,DC=com).
• Bind DN: The Distinguished Name of a domain user account with read permissions on user and group objects (for example, CN=netskope_user,CN=Users,DC=example,DC=com).
• Bind Password: The password for your Bind DN account.
• CA Certificate: If using LDAPS (secure LDAP with SSL/TLS), you must provide the PEM-encoded CA certificate to validate the server.

LDAP Connection Testing Behavior

When you enter LDAP credentials, DSPM tests the connection automatically once you lose focus on the input fields (click outside the box) and reports any errors. A separate Test Connection button is not required.

LDAP Security Best Practices

• Use LDAPS (LDAP over SSL/TLS, port 636) for encrypted communication when available.
• Create a dedicated LDAP service account with read-only permissions on user and group objects.
• Store the LDAP Bind Password securely and rotate it periodically.
• Restrict LDAP access to only the Sidecar OVA and backend services.

Connect Your Data Store

Connect your data store in 2 steps: provide the credentials, and then select the capabilities and save the connection.

Step 1: Provide Credentials

Follow these steps to configure the connection:

1. Go to Data Stores > Data Store Inventory.

2. Click CONNECT A DATA STORE in the upper right.

   Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.

   

3. In the Connect a Data Store window, click the data store icon you wish to connect.

4. In the Provide Credentials section, complete the fields below, then click Next:

Step 2: Select Capabilities and Save the Connection

Follow these steps to configure the connection:

1. When the Select Capabilities tab appears, complete the following fields:
   • Assign a Data Owner (Optional): Select one or more users responsible for this data store.
   • Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
   • Features: Select the features you want to enable.

Enabling Classification triggers file scanning based on your defined sampling rate. The following classification limits apply when using Advanced Scan. When Smart Scan is selected, file selection is automated by the clustering algorithm and these manual limits do not apply. For more details, see Data Store Smart Scan.

• Scan Limits: DSPM processes a maximum of 100,000 files per scan, regardless of the sampling rate. If you choose 100%, the system scans files in batches of 100,000 across subsequent scans until all files are covered. A maximum of 1,000,000 files will be scanned per data store.
• File Size Exclusions: The scanner skips files larger than 128 MB.
• Incremental Scanning: To optimize performance, DSPM only rescans files that have been modified since the last scan.
• File Type Filtering: You can optionally use a regular expression to restrict sampling to specific file types.

2. (Optional) Configure LDAP for Privilege Analysis: If you enabled the Privilege Analysis toggle in the previous step, the LDAP configuration panel appears. Complete the following fields:

3. Click Save. When the Review tab appears, the system validates your configuration.
   • Note: If you enabled Privilege Analysis, the system will test your LDAP connection now. If it fails, verify your LDAP Server URL, Bind DN, Password, and firewall rules on port 389/636.
4. If there are no issues, click Save to finalize the connection.

Review DFS Scan Results

File paths show the virtual DFS path instead of the physical server path. For example, a path appears as engineering\docs\readme.txt instead of \\fs01\engshare\docs\readme.txt. DSPM tracks files by how they appear in the namespace structure.

Prevent Duplicate Scanning of Plain-SMB Shares

Before you onboard a plain share, check the share selections in your existing namespace data stores.

DSPM can’t detect that a plain-SMB endpoint is part of an onboarded DFS namespace. If a namespace data store covers a share and someone onboards the same share directly as a plain-SMB endpoint, DSPM allows it, and both data stores scan the share. This duplicate scanning doubles scan cost and billing, and results in the same sensitive files being reported multiple times across DSPM, skewing sensitive data counts and related statistics.

Next Steps

Once your data store is connected and the initial scan is complete, you can review the access risks and governance metrics. For a detailed breakdown of the dashboard rules, remediation steps, and user metrics, see Understand Privilege Analysis Results for SMB.

Supported File Types for Unstructured Data Store Scanning

DSPM now supports all file types supported by the DLP appliance: