Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Netskope Client
    Netskope Client Deployment Options
    Netskope Client Enrollment
    Netskope Client Enrollment Using UPN

    Netskope Client Enrollment Using UPN

    Using this method, the user machine is joined to Active Directory or LDAP directory integration. The Netskope Client monitors the Directory Service to identify the user by their User Principal Name.

    Prerequisites

    • For user authentication and successful enrollment, add enrollment token(s) in the MDM configurations. To learn more on tokens: Enrollment Token Management.

    • User Provisioning: Provision all users into your Netskope admin console. The domain UPN ((User Principal Name)  of the user in the Netskope Admin Console must match the UPN value at the user’s device.

    • Requires the user’s device to be domain-joined to Active Directory or LDAP directory integration.

    Advantages

    • Organizations can easily adopt as user enrollment is transparent to the end user.

    • Works seamlessly with the AD environment.

    Disadvantages

    • Requires an authentication token deployment that administrators ensure are distributed properly and prevent any token compromises.

    • Requires periodic token maintenance by the admin.

    Netskope Client Deployment with Enrollment Tokens

    In this mode, the user’s UPN (User Principal Name) is used as user identity from the logged in domain-joined system. To identify if this method is used, refer the installation commands or methods and check for the following parameters:

    • token=” ”

    • host= “ “ (tenant name)

      And does not contain installmode=IDP

      Before you begin to deploy Netskope Client using enrollment tokens, ensure to enable Secure Enrollment Services and add tokens  in Settings > Security Cloud Platform > Netskope Client > MDM Distribution. 

      Ensure to enforce tokens for successful enrollment.
      Deployment OptionInstallation Commands
      Single-User Mode Installation for UPN-based EnrollmentWith authentication token< OS utility > < NSClient > host= < addon URL > token= < orgID > enrollauthtoken= < auth token >

      For example, MSIEXEC command in Windows:
      msiexec /I NSClient.msi host=addon-corp.eu.goskope.com token=XXX enrollauthtoken=XXX /qn

      With authentication and encryption tokens< OS utility > < NSClient > host= < addon URL > token= < orgID > enrollauthtoken= < auth token > enrollencryptiontoken= < encryption token >

      For example, MSIEXEC command in Windows:
      msiexec /I NSClient.msi host=addon-corp.goskope.com token=XXX enrollauthtoken=XXX enrollencryptiontoken=XXX /qn

      Multi-User Mode Installation for UPN-based EnrollmentWith authentication token< OS utility > < NSClient > host= < addon URL > token= < orgID > mode=peruserconfig enrollauthtoken= < auth token >

      For example, MSIEXEC command in Windows:
      msiexec /I NSClient.msi host=addon-corp.goskope.com token=XXX enrollauthtoken=XXX mode=peruserconfig /qn
      With authentication and encryption tokens< OS utility > < NSClient > host= < addon URL > token= < orgID > mode=peruserconfig enrollauthtoken= < auth token > enrollencryptiontoken= < encryption token >

      For example, MSIEXEC command in Windows:
      msiexec /I NSClient.msi host=addon-corp.goskope.com token=XXX enrollauthtoken=XXX enrollencryptiontoken=XXX mode=peruserconfig /qn

    User Impact

    Client version 116.0.0 or earlier (includes any upgrades to these versions) 

    DeviceExisting UserNew User EnrollmentsExisting Enrolled User Requiring Re-enrollment
    Client version 116.0.0 or earlier (includes any upgrades to these versions) Client Version 116.1.0 or later (includes during upgrades)Client version 116.0.0 or earlier (includes any upgrades to these versions) Client Version 116.1.0 or later (includes during upgrades)
    Personal Corporate MachineNo changeNetskope Client package with enrollment tokensNetskope Client package with enrollment tokens

    • Uninstall the Client

    • Reinstall Client package with Secure enrollment tokens


    • Client package with Secure enrollment tokens, Or

    • Apply tokens using nsdiag on Windows and macOS

    Shared Desktop/VDIs and so onNo change

    • Uninstall the Client

    • Reinstall Client package with enrollment tokens


    • Client package with the enrollment tokens, Or

    • Apply tokens using nsdiag on Windows


    • Uninstall the Client

    • Reinstall Client package with Secure enrollment tokens


    • Client package with Secure enrollment tokens, Or

    • Apply tokens using nsdiag on Windows

    All operating systems other than Windows, do not require uninstallation and reinstallation before version 116.1.0.

    Example commands:

    • Re-run the MSIEXEC command with the new tokens.

      This flexibility is available only for Windows devices and the MSI rerun is not supported if the Protect Client configuration and resources option is selected in the Client Configuration webUI

    • Use the following nsdiag command to update the tokens:

      nsdiag -e enrollauthtoken=<token> enrollencryptiontoken=<token>

      The preceding nsdiag command is supported only on Windows and macOS platforms. You can run nsdiag command using the path: C:\Program Files (x86)\Netskope\STAgent.

      Run this command in admin mode in Windows.

      In Windows and macOS, if nsdiag -e command fails then an error message is displayed in the command prompt.

    In this Topic
    • Netskope Client Enrollment Using UPN