Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Netskope Client
    Netskope Client Deployment Options
    Netskope Client Enrollment

    Netskope Client Enrollment

    Secure Enrollment content is now moved to the Netskope Client Enrollment section. This approach is to consolidate all enrollment methods and deployment instructions in one place.

    Netskope Client enrolment with the Netskope Cloud services is a mandatory step before steering the traffic and securing the end-user device.

    The enrollment process includes three methods:

    • IDP
    • UPN
    • Email Invite
    Netskope recommends enabling Secure Enrollment Service for all enrollment methods.

    Enrollment Methods Comparison

    AttributesIDPUPNEmail InvitationMDM Assigned (PLIST)
    User IdentificationUser Email addressUPNUserkeyUser Email address
    User AuthenticationThrough the configured IdPAuthentication Token part of Secure enrollmentUser activation key (One-time token)Authentication Token part of Secure enrollment
    User ExperienceRequires user interactionNo user interactionUser needs admin rights to deployNo user interaction
    SecuritySupports the security levels setup for IdP such as MFAUses the same authentication and encryption token across organization

    • One time token distribution through Email

    • Lacks control on the distribution of the Email invitation

    		Uses the same authentication and encryption token across organization
    Domain-JoinedNot requiredRequires to be domain-joinedNot requiredNot required
     Email invitation method does not require Secure enrollment token(s) for the enrollment. 

    Automatic Re-enrollment

    On Windows, macOS, and Linux, Netskope Client supports automatic re-enrollment when a user’s email address changes or gets removed and is synced to the tenant through SCIM. If the user does not re-enroll with the new or updated email address within 24 hours, the Client uninstalls itself, provided Uninstall clients automatically when users are removed from Netskope is enabled in Client Configuration. To learn more, see Deprovisioning Users.

    • In UPN-mode deployments,  if a user’s email address changes, Client automatically re-enrolls using the logged-in user’s current AD UPN when an email change invalidates the existing user key. Client requests and downloads an updated branding file containing the new email address (user key), then refreshes its configuration to re-enroll the user.  

    • In IdP-mode deployment, if a user’s email address changes, Client detects the change and displays the IdP enrollment screen, prompting the user to re-authenticate with the updated email address.

      Contact Netskope Support to enable this feature in your tenant for IdP mode deployment.
    • Enrollment Token Management
    • Netskope Client Enrollment Using IDP
    • Netskope Client Enrollment Using UPN
    • Netskope Client Enrollment Using Email Invite
    • Secure Enrollment Frequently Asked Questions
    • Secure Configuration Services FAQ

    In this Topic
    • Netskope Client Enrollment