Frequently Asked Questions on Migration

Do you support automatic migration of a Classic app instance to Next Generation?

No, Netskope does not support automatic migration of instances from Classic to Next Generation.

Do you have customers using the Next Generation API Data Protection?

Yes, Netskope has a number of customers who are using Next Generation API Data Protection. In fact, all new customers for OneDrive and SharePoint are on-boarded on the Next Generation API Data Protection starting May 2023.

Since automatic migration is not supported, to set up an existing Classic instance to Next Generation, does it require disconnecting the existing legacy connection first?

You need not disconnect the Classic instance first. But make sure that you disable all the Classic policies so that there is a very short window of time when file change notifications are processed on both the platforms. This will also eliminate duplicate alerts and incidents.

If there is no need to disconnect the existing Classic instance, can I use the same SaaS app admin account (e.g Office 365 admin account) and instance name to provision it on the Next Generation configuration?

Yes, the same admin account can be used.

Can I continue to use the existing Classic API policies mapped to older instances for Next Generation?

No, you cannot use the existing Classic policies with Next Generation API Data Protection. You will have to create new policies for use with Next Generation API Data Protection. The Next Generation policies offer significant expressivity and efficiency. Customers can combine multiple Classic policies into a single Next Generation policy for simplified ongoing maintenance. That is the reason we recommend you take this opportunity to optimize the number of policies.

Is it required to map the existing Classic policies to the Next Generation instances or configure new policies?

No, mapping of policies is required. In fact, with Next Generation policies, you can choose to combine multiple policies into a single one. e.g. now one policy can have multiple DLP profiles selected.

Why should I migrate to Next Generation API Data Protection? What’s in it for me?

You should plan to switch to using Next Generation API Data Protection at the earliest possible time as it offers the following benefits:

• Superior end-to-end processing times for out-of-band events.

• Superior policy expression capabilities that allows you to consolidate policies into a more manageable number.

• Netskope offers new applications and improvements in existing application coverage on the Next Generation API Data Protection. Migrating to the Next Generation platform as soon as possible positions you to fully benefit from these enhancements.

For more benefits, see Key Features of Next Generation API Data Protection Platform.

I have multiple instances of Microsoft 365 SharePoint configured in Classic. Can I take a phased approach and migrate just one of the many Microsoft 365 SharePoint instances over to Next Generation?

Yes, you can.

Will there be loss of security coverage at any point during the migration process?

No, there will be no loss of security coverage as long as you follow the Netskope-recommended steps described in Migration Step.

Will there be duplicate incidents or alerts at any point during the migration process?

Not many, as long as:

• you have created policies in Next Generation and,

• you have deleted the policies in Classic.

Do I also have to recreate DLP, quarantine, forensic, legal hold profiles for the Next Generation policies?

Yes, you have to create new quarantine, forensic, and legal hold profiles for the Next Generation policies. However existing DLP profiles can be reused.

I have tens of policies for Microsoft 365 SharePoint in Classic. Before migrating to Next Generation, I want to test the policies in a test environment. I need to therefore create these policies in a test environment and then again recreate them in production. These manual steps can be time consuming and erroneous. Is there any way I can export my test environment policies and import them to my production environment?

No, there is currently no method to export and import policies and quarantine, forensic, and legal hold profiles.

I have several incidents, DLP and threat, which have to go through a manual remediation process. Incident remediators decide if they have to restrict access to sensitive files after reviewing the incidents carefully. This process can take several days, sometimes weeks. Will my Incident remediators continue to have the ability to invoke a manual remediation action on Classic-generated incidents even after the migration to Next Generation?

Yes, your incident remediator will have the ability to remediate both Classic and Next Generation quarantined files as long as you keep the old app instance configuration enabled. After all the files are remediated, you can then delete the Classic app instance.

I have several hundred files that are quarantined by Classic. Deciding what to do with them (release from quarantine or something else) will take time. Can I still proceed with the migration process and just deal with these files over the next several days and weeks?

Yes, you can still work on the files and restore them as long as you have kept your Classic app instance enabled.

How much time will Next Generation API Data Protection take to update the inventory?

Our benchmark tests have indicated that the process can take a few hours to a few days depending on the number of files and users you have in the application instance. Get in touch with your Netskope sales representative for more details.

Do I require a new license to migrate or use the Next Generation API Data Protection platform?

No, you do not need a new license to migrate or use the Next Generation API Data Protection platform. You can configure the Next Generation apps for which you already have entitlements in Classic.