Create a Netskope Support Admin

You can grant Netskope personnel temporary access to your account through Netskope IdP. This feature is helpful when working with Netskope Support, Professional Services, Customer Experience, etc.

To Grant Access

1. Navigate to Settings > Administration > Administrators & Roles > Settings > Netskope Personnel. The Netskope Personnel side panel displays.
2. Enable the SSO Quick Access radio button. This allows Netskope personnel to log in to your account.
3. Optionally, enable the SSO Explicit Access radio button. This grants Netskope personnel access with an assigned role and an expiration time. To learn more: Explicit Access for Netskope Personal
4. Click Save.

To Disable Access

You can view and filter access in the Audit Log.

To View Access

The Audit Log shows all users that have admin access to your account. This list includes all internal users and delegated SSO access.

To Filter Access

The Audit Log page displays with a filtered view showing only the Netskope Personnel users.

RBAC Role Assignment

The following are the permissions provided by Netskope personnel:

• Netskope Support – NS technical success

• Netskope CX Team – NS technical success

• Netskope Professional Services (PS) – NS technical success

Explicit Access for Netskope Personal

Explicit access allows tenant administrators to invite and add Netskope personnel to their tenant. This feature provides invited Netskope personnel with enhanced control over the access privileges required to access your environment, offering a more secure and granular approach than the previous Quick Mode (single-click option).

• Quick Mode is typically used to invite Netskope Professional Services (PS) and Customer Success (CS) personnel. If no explicit access is defined, a default read-only privilege is applied.

• Explicit Access Mode allows you to assign specific roles with limited permissions and set expiration times for these accounts.

  If a Netskope support user is added for both Quick Access Mode and Explicit Access Mode, the Explicit Access Mode role privilege will override the Quick Access Mode role privilege.

Prerequisites

The explicit access feature requires RBAC v3 (Role-Based Access Control Version 3) to be enabled in the tenant.

Enabling Explicit Access

1. After the RBACv3 is enabled by support, go to Settings > Administrators > Administrators & Roles to add Netskope Personnel to your tenant.

2. Click Settings (top right corner of the user listing table) > Netskope Personal

3. Toggle the SSO explicit access button to ON.

4. Accept the Usage acknowledgment policy and click Continue.

5. Then click Save. You can now start inviting Netskope personnel into your tenant.

6. After saving, the “Invite Netskope personal” option is available as a link and an option under the Invite dropdown in the user listing table.

Adding a Netskope Personnel

1. Navigate to the invite section and click the Invite Netskope personal option.

2. Enter the email address of the Netskope personnel (e.g., xyz@Netskope.com).

    You must know the exact email address, as access to the Netskope directory is unavailable.

3. Select a role for the user. You can choose from custom roles or predefined roles. Roles can be assigned with limited permissions.

4. Set an expiration time for the account. The default expiration time is 7 days from the creation time. The maximum expiration time is 2 years. There is also an option to set no expiration date.

5. Once added, the account will be listed as a “user account only,” showing details like the role, expiration date, and that it was provisioned by SSO. The icon for Netskope personnel accounts will be distinct.

Managing Netskope Personnel Accounts

• User Authentication: Netskope personnel added via explicit access will log in using Netskope SSO. They will not receive an email invitation for activation, as access is granted directly via SSO.

• Extending Expiration Time: If a Netskope personnel account has expired, you can re-enable it by extending its expiration time.

• Disabling Explicit Access: If you toggle off the explicit access feature, you will receive two warning messages indicating that all explicitly added users will be deleted. This action will permanently remove all explicit access accounts.

Special Scenarios and Important Notes

Handling Existing Local Accounts: In cases where a local account for a Netskope employee already exists (e.g., from before this feature was available), if you try to invite that same email address via explicit access, a pop-up will ask if you want to delete the local account and create a Netskope personnel account instead. Netskope recommends using SSO for explicit access rather than making local accounts for Netskope personnel. If a Netskope personnel account (via SSO explicit access) already exists, the system will not allow you to create a local account for the same email address.

• Limited Access Notification: Netskope personnel who log in with roles that have limited permissions will see a banner indicating “limited access on the dashboard.” For instance, a role might only grant permission to the SSO section under administration.

• Access Denial: If a Netskope employee attempts to log in via Netskope SSO, but their email is not explicitly defined under explicit access or quick mode (and the feature is enabled), their access will be denied with an error.

• SSO Types for Admins: It’s important to distinguish between SSO Quick Access and SSO Regular Access:

  • SSO Quick Access (previously supported): Based on Identity Provider (IDP) group mapping for predefined roles. Administrators can only delete these roles; no other changes are permitted.

  • SSO Regular Access (Regular Admin SSO): This is the standard SSO configuration for a customer’s own administrators. If an SSO account does not have “Netskope personnel” associated with its email, it is considered the customer’s regular SSO account.