Enterprise Browser Device Classification - Netskope Technical Documentation

Netskope Enterprise Browser support for Device Posture Checking and Device Classification for Desktop enables administrators to assign customer-defined Device Classification labels to unmanaged (BYOD) and contractor devices—without requiring the Netskope Client to be installed. These labels can then be used to drive zero-trust access and browser controls based on device risk.

This feature includes:

Customer-defined Device Classification labels for Enterprise Browser: Create classification rules and labels based on posture signals collected by Enterprise Browser (Windows and macOS).
Use classifications in policy enforcement:
- Real-time Protection (RTP) policies for Enterprise Browser traffic: Apply access controls based on customer-defined Device Classification labels.
- Enterprise Browser Protection Policies: Apply browser controls based on the device’s risk classification.

Key Posture Signals Supported (examples)

OS Version: Minimum required operating system levels (Windows & macOS).
Anti-Virus (AV) & Firewall (FW): Verification that local security software is present and active.
Processes & Files: Detection of specified running processes or the existence of specific files (requires full path).
Registry & Certificates: Advanced checks for registry keys or specific local certificates.
AD Domain: Verification of Active Directory domain membership.

Considerations include:

Managed/Unmanaged device classification is not yet supported as a condition for RTP policies (Access Method = EB) or Enterprise Browser Protection Policies in this scope—only customer-defined Device Classification labels are supported.
RTP scope limitation: Device Classification is supported in RTP for Web and SaaS destinations only; it is not supported for RTP for Private Segments.
OPSWAT Compliance is not currently supported for Enterprise Browser and will be evaluated as false if configured in a Device Classification rule for EB.
Policy usage visibility: The “policies attached to Device Classification” list does not include RTP policies where Access Method = Enterprise Browser, or Enterprise Browser Protection Policies, even if those policies are using the label.

Key Posture Signals Supported (examples)

OS Version: Minimum required operating system levels (Windows & macOS).

Anti-Virus (AV) & Firewall (FW): Verification that local security software is present and active.

Processes & Files: Detection of specified running processes or the existence of specific files (requires full path).

Registry & Certificates: Advanced checks for registry keys or specific local certificates.

AD Domain: Verification of Active Directory domain membership.

Considerations include:

Managed/Unmanaged device classification is not yet supported as a condition for RTP policies (Access Method = EB) or Enterprise Browser Protection Policies in this scope—only customer-defined Device Classification labels are supported.

RTP scope limitation: Device Classification is supported in RTP for Web and SaaS destinations only; it is not supported for RTP for Private Segments.

OPSWAT Compliance is not currently supported for Enterprise Browser and will be evaluated as false if configured in a Device Classification rule for EB.

Policy usage visibility: The “policies attached to Device Classification” list does not include RTP policies where Access Method = Enterprise Browser, or Enterprise Browser Protection Policies, even if those policies are using the label.