Overview
You can configure Netskope DSPM to automatically sync with your Microsoft Entra ID (formerly Azure AD). This allows you to control which specific employees are imported, map their Entra ID attributes (both default and custom) to Netskope DSPM fields, and leverage these employee-specific values to trigger policies.
This sync can be a one-time activity or scheduled to refresh Netskope DSPM data on a regular cadence.
Examples of alerts possible via this feature include:
- Ensure no one in the Marketing department is running queries that return PII.
- Identify specific types of users selecting high volumes of records.
- Closely monitor the behavior of employees on a Performance Improvement Plan (PIP) or who have given notice.
- Automatically notify your security teams when data usage is detected for terminated employees.
More information on Entra ID is available here.
Step 1: Configure Initial Sync
- Log into Netskope DSPM as any user with the Admin role.
- Navigate to User Identity > Employee Management.
- On the top-right of the screen, click Connect to Directory Service.
- The Directory Configuration modal is displayed, starting with Choose Directory. Click on the Microsoft Entra ID icon to proceed.
Step 2: Configure the Directory Integration
To complete this step, you must configure an Entra ID service principal app registration dedicated to Netskope DSPM’s use.
Grant Permissions
We then need to grant the app registration the following permissions:
Application.Read.AllGroup.Read.AllUser.ReadUser.Read.All
Provide Credentials
Now, provide the Netskope DSPM platform with details on where and how to access your Entra ID. On the Provide Credentials tab, provide the following information:
- Name: This is used within Netskope DSPM only and can be any friendly name of your choosing.
- Tenant ID: Copy from the App registration overview page Directory (tenant) ID field.
- Client ID: Copy from the App registration overview page Application (client) ID field.
- Client Secret: Create a client secret and [provide its value].
- Application ID: Copy from the App registration overview page Object ID field.
Configure Sync Schedule
This includes optionally configuring Netskope DSPM to sync regularly with your Entra ID so the former is always up-to-date with fresh employee data, including newly discovered Entra ID employees.
- If you do not wish to regularly sync your Entra ID, you can deselect the Sync Enabled toggle.
- Otherwise, configure the cadence & timing of your choosing.
- Click the Next button. The Mapping tab is displayed.
Step 3: Map Entra ID Attributes to Netskope DSPM Fields
You can define mappings between Entra ID attributes and Netskope DSPM fields on the Mapping tab. For each discovered Entra ID attribute, the Netskope DSPM Directory Field Name auto-populates to match. You can override these matches by selecting different source Entra ID attributes.
Best practice when mapping between systems:
- Map all Expected Database Usernames: If your Entra ID directory contains a database user name field or Expected DB Usernames field, we recommend mapping it to the Expected Username field. In the Entra ID attribute for Expected DB Usernames, include all possible username permutations (comma-separated), e.g.,
gwashington, washington, george. This way, Usernames can be leveraged within Netskope DSPM for the following downstream activities:- Linking your directory employees to the Usernames, which Netskope DSPM discovers while scanning your Data Stores.
- Over-privilege analysis for said linked employees.
- Matching the database and/or employee user name within Policy Conditions triggers the creation of Alerts and Tasks.
- Be sure to map employee status: This way, its value can also be leveraged within Netskope DSPM to trigger the creation of Alerts & Tasks, such as flagging the continued activity of terminated employees.
- Remove unnecessary mappings: If the Netskope DSPM destination field is not required (marked with a red asterisk) or used in your Policy Conditions, we recommend you remove its mapping entirely by clicking the Delete icon.
- Do not map your Entra ID attributes more than once.
Once your mappings are set, click the Next button.
Step 4: Include / Exclude Specific Employees
After setting up mapping, you will use the Include/Exclude Users tab to define which employees will be synced to Netskope DSPM.
Within Entra ID, you can group users based on common or shared traits. In turn, you can configure Netskope DSPM to import all employees, or just those within specific Entra ID Groups. (For example, you might organize all employees with database access into an Entra ID Group named “Data Owners”, then configure Netskope DSPM to import just those privileged employees).
You can use two methods to sync employee groups from Entra ID: manual sync (by selecting Sync Groups) or via CSV upload. Manual syncing supports up to 50,000 Entra ID Groups, and CSV upload supports unlimited Entra ID Groups. We recommend manual sync for groups less than 1000 and CSV upload for groups more than 1000.
Method A: Sync Groups
- Click Sync Groups. Close the modal and sync will run in the background. You will be notified when groups are loaded and ready to select.
- The left side displays your Entra ID Group picklist. Use the selectors and include and exclude buttons to decide which Entra ID Groups to include.
- If you wish to import all, select and include “Everyone”.
- Otherwise, select one or more Entra ID Groups. (For example above, only the “Netskope DSPM-users” group members will be imported into Netskope DSPM).
- Once complete, click the Save button.
Method B: CSV Upload
- Click Upload CSV.
- Drag and drop or upload your CSV file.
a. For guidance on exporting groups and populating the CSV file, read Bulk download a list of groups in Microsoft Entra ID.
b. The file should only contain the specific Entra ID Groups you want included in Netskope DSPM’s Employee Management feature.
c. Note that any duplicate Entra ID Groups will be automatically de-duped during the sync. - Click Save to close the modal, and the sync will run and complete in the background.
Step 5: Verify and Manage Synced Employees
You’ll see the Success banner once your Entra ID Groups have successfully uploaded, and all uploaded groups will automatically import and sync to the Employee Management page.
Once complete, the Entra ID Configuration modal will auto-dismiss, and your included Entra ID employees will now be listed in Netskope DSPM’s Employee Management screen, specifically within the All Employees tab.
- This will include any new columns from your mappings.
- Employees synced from Entra ID are kept separate from any database users discovered by the Netskope DSPM platform.
Going forward, the employees listed in the Netskope DSPM Employee Management screen will reflect the matching Entra ID Group configurations and be refreshed after every scheduled sync. (More information on Entra ID Groups is available here).
Sync Behavior & Maintenance
Details on your sync schedule are displayed at the top of the Employee Management screen. To make changes to any portion of your configuration, click the Edit icon to once again display the Entra ID Configuration modal.
- Updates: Changes made within the source Entra ID will be available within Netskope DSPM each time a sync is performed.
- Deletions: If you delete an employee within your Entra ID, their corresponding record will still remain in Netskope DSPM, but it will be styled on-screen to indicate this scenario.
- Removal: If you no longer wish to utilize Entra ID integration, you can remove it by clicking the Delete icon. Note that doing so will remove all employees previously brought over from Entra ID, which may affect other platform parts, such as triggering policies.
Limitations
At this time, current limitations include:
- You can connect to a single Microsoft Entra ID.
- You can map a single database Username attribute.