Netskope Client Enrollment Using UPN - Netskope Technical Documentation

Using this method, the user machine is joined to Active Directory or LDAP directory integration. The Netskope Client monitors the Directory Service to identify the user by their User Principal Name.

Prerequisites

For user authentication and successful enrollment, add enrollment token(s) in the MDM configurations. To learn more on tokens: Enrollment Token Management.
User Provisioning: Provision all users into your Netskope admin console. The domain UPN ((User Principal Name) of the user in the Netskope Admin Console must match the UPN value at the user’s device.
Requires the user’s device to be domain-joined to Active Directory or LDAP directory integration.

Advantages

Organizations can easily adopt as user enrollment is transparent to the end user.
Works seamlessly with the AD environment.

Disadvantages

Requires an authentication token deployment that administrators ensure are distributed properly and prevent any token compromises.
Requires periodic token maintenance by the admin.

Netskope Client Deployment with Enrollment Tokens

In this mode, the user’s UPN (User Principal Name) is used as user identity from the logged in domain-joined system. To identify if this method is used, refer the installation commands or methods and check for the following parameters:

token=” ”

host= “ “ (tenant name)

And does not contain installmode=IDP

Before you begin to deploy Netskope Client using enrollment tokens, ensure to enable Secure Enrollment Services and add tokens in Settings > Security Cloud Platform > Netskope Client > MDM Distribution.

Ensure to enforce tokens for successful enrollment.

Deployment Option		Installation Commands
Single-User Mode Installation for UPN-based Enrollment	With authentication token	`< OS utility > < NSClient > host= < addon URL > token= < orgID > enrollauthtoken= < auth token >` For example, MSIEXEC command in Windows: `msiexec /I NSClient.msi host=addon-corp.eu.goskope.com token=XXX enrollauthtoken=XXX /qn`
	With authentication and encryption tokens	`< OS utility > < NSClient > host= < addon URL > token= < orgID > enrollauthtoken= < auth token > enrollencryptiontoken= < encryption token >` For example, MSIEXEC command in Windows: `msiexec /I NSClient.msi host=addon-corp.goskope.com token=XXX enrollauthtoken=XXX enrollencryptiontoken=XXX /qn`
Multi-User Mode Installation for UPN-based Enrollment	With authentication token	`< OS utility > < NSClient > host= < addon URL > token= < orgID > mode=peruserconfig enrollauthtoken= < auth token >` For example, MSIEXEC command in Windows: `msiexec /I NSClient.msi host=addon-corp.goskope.com token=XXX enrollauthtoken=XXX mode=peruserconfig /qn`
	With authentication and encryption tokens	`< OS utility > < NSClient > host= < addon URL > token= < orgID > mode=peruserconfig enrollauthtoken= < auth token > enrollencryptiontoken= < encryption token >` For example, MSIEXEC command in Windows: `msiexec /I NSClient.msi host=addon-corp.goskope.com token=XXX enrollauthtoken=XXX enrollencryptiontoken=XXX mode=peruserconfig /qn`

User Impact

Client version 116.0.0 or earlier (includes any upgrades to these versions)

Device	Existing User	New User Enrollments		Existing Enrolled User Requiring Re-enrollment
		Client version 116.0.0 or earlier (includes any upgrades to these versions)	Client Version 116.1.0 or later (includes during upgrades)	Client version 116.0.0 or earlier (includes any upgrades to these versions)	Client Version 116.1.0 or later (includes during upgrades)
Personal Corporate Machine	No change	Netskope Client package with enrollment tokens	Netskope Client package with enrollment tokens	Uninstall the Client Reinstall Client package with Secure enrollment tokens	Client package with Secure enrollment tokens, Or Apply tokens using nsdiag on Windows and macOS
Shared Desktop/VDIs and so on	No change	Uninstall the Client Reinstall Client package with enrollment tokens	Client package with the enrollment tokens, Or Apply tokens using nsdiag on Windows	Uninstall the Client Reinstall Client package with Secure enrollment tokens	Client package with Secure enrollment tokens, Or Apply tokens using nsdiag on Windows

All operating systems other than Windows, do not require uninstallation and reinstallation before version 116.1.0.

Example commands:

Re-run the MSIEXEC command with the new tokens.

This flexibility is available only for Windows devices and the MSI rerun is not supported if the Protect Client configuration and resources option is selected in the Client Configuration webUI
Use the following nsdiag command to update the tokens:
```
nsdiag -e enrollauthtoken=<token> enrollencryptiontoken=<token>
```
The preceding nsdiag command is supported only on Windows and macOS platforms. You can run nsdiag command using the path: C:\Program Files (x86)\Netskope\STAgent.

Run this command in admin mode in Windows.

In Windows and macOS, if nsdiag -e command fails then an error message is displayed in the command prompt.