This page lists known limitations and considerations for the Netskope Enterprise Browser. Review this page before deploying the Enterprise Browser to understand current platform constraints, feature gaps, and compatibility notes.
Configuration
The following limitations apply to browser configuration and administration:
- Account admins cannot add or modify Chromium-specific policies through the admin console. Changes to some specific Chromium policies require Netskope support.
- Enterprise Browser only supports users provisioned through SCIM. Users created manually or locally in the tenant UI are not available for selection under Enterprise Browser User Provisioning.
- Enterprise Browser supports English, French, Japanese, German, Spanish, and Portuguese (Portugal and Brazil). Other languages are not currently supported.
- Some extensions are not discoverable using the Extension Governance Policy search tool. This affects extensions whose IDs or names are not indexed in the Chrome Web Store.
- When both product-level (based on the default security posture) and tenant-level extension policies are configured, the tenant-level configuration overwrites the product-level configuration entirely. No merging or restrictiveness logic is applied between the two levels.
Navigation and Traffic
The following limitations apply to traffic steering and browsing:
- Enterprise Browser only steers HTTPS traffic to the Netskope cloud. HTTP traffic and other protocols (such as SSH or RDP) are not supported.
- HTTP/2 is not supported through the proxy.
- Some third-party websites may intermittently reject Enterprise Browser connections due to strict browser-validation policies on their servers. This may result in “Access Denied” or “Unauthorized” error pages.
Browser Protection Policies
The following limitations apply to Browser Protection Policies:
- Enterprise Browser protection policies are not evaluated for connections that are SSL bypassed.
- Copy and paste of files is not supported through clipboard policies. Only text-based data types are supported in clipboard control.
- Sharing content within the browser (for example, using the browser’s built-in share functionality) is not currently restricted by Browser Protection Policies.
- The following limits apply to policy and related objects: name (max 128 chars), description (max 240 chars), applications (max 100 entries), application instances (max 100 entries), categories (max 100 entries), users (max 100 entries), user groups (max 100 entries), organizational units (max 100 entries), policies (max 8192 entries).
- Enterprise Browser protection policies cannot be applied to “all users” directly. As a workaround, apply policies to groups containing all tenant users.
- Relaunch notification policies are applied during browser initialization based on the last value received. If a new value is received, the change does not take effect until the browser is relaunched.
User Management and Licensing
The following limitations apply to user provisioning and licensing:
- Licenses are not automatically removed from a user when the user is deleted or deactivated from the IdP. An admin must manually revoke the license.
- If an admin deletes a user, data on the user’s machine is deleted. The user requires a new license to be added back — the previous license is no longer valid.
- Policies are not immediately applied when a new user is added to a group or organizational unit.
Installation and Updates
The following limitations apply to browser installation and updates:
- Admins cannot force a specific version of the browser to install. The most current version available for the tenant’s release channel is always installed.
- The MSI installer used in MDM deployments installs the browser and creates a user profile based on the provided license. If the profile creation step fails, the MSI still completes successfully. The result of the profile creation step is stored in the registry for verification.
- When multiple profiles from different tenants are configured in a single browser, the browser stays at the most recent version among those defined in the respective release channels. The browser is never downgraded.
Device Compliance and Identity
The following limitations apply to device compliance and identity provider integration:
- Enterprise Browser does not present a native device compliance signal to identity providers (such as Microsoft Entra ID). Conditional access policies that require device compliance or hybrid-joined status cannot be satisfied directly by Enterprise Browser sessions. IP allow-listing is the supported method to distinguish Enterprise Browser sessions for conditional access.
Mobile Platforms
The following limitations apply to iOS, iPadOS, Android, and ChromeOS:
- NPA integration on iOS may present certificate errors in some configurations. Verify private application access on iOS devices during deployment.
Compatibility
The following limitations apply to compatibility with other products and services:
- Enterprise Browser can work with the Netskope Client on the same device with the appropriate configuration. A Certificate Pinned Application exception must be configured to avoid traffic conflicts.
Enterprise Browser does not implement its own MFA stack. Any MFA method that works in a standard Chromium-based browser through your IdP’s web flows is supported.