Netskope Help

Netskope Client

The Netskope Client is a lightweight non-intrusive application installed on a users’ device (Windows, macOS, and Android) that steers traffic from the users device to the Netskope cloud. For example, to track cloud apps used in your organization for deep analytics, configure them as Managed Apps, and the Client will steer all the HTTPS traffic through the Netskope tenant UI. All other traffic in the network will be handled normally without any action by the Netskope Client. To download the Client, go to the Downloads page.

Supported OS and Platforms
Table 4. Netskope Client Support OS

OS

Versions

Notes

Microsoft Windows

  • Windows 7

  • Windows 8, Windows 8.1

  • Windows Server 2012 R2 (Windows NT 6.3)

  • Windows Server 2016

  • Windows Server 2019

  • Windows 10 20H2

Supported under special consideration. For more information, refer to Windows 7 EOL.

Apple macOS

  • 10.12 (Sierra)

  • 10.13 (High Sierra)

  • 10.14 (Mojave)

  • 10.15 (Catalina)

  • 11.0 (Big Sur)

(See this KB article for macOS High Sierra support)macOS High Sierra introduced a change in the Kernel Extensions loading (Apple Technical Note TN2459) which requires the end user of the device to approve loading any third-party kernel extensions such as Netskope.

Important

R78 Support. See Support portal : Download Netskope Client page for information about Big Sur support.

Google Android

  • 7.0 and above.

  • Android for Work (also known as Android Enterprise) is required if the clients are deployed using third-party MDM services.

Please read KB article about Android 7.0 support.

Note

When using Android for Work, only the apps managed by Android for Work is steered by the Netskope Client.

Google Chrome OS

53.0 and above



Note

Starting with release 75, the Netskope Client supports Windows devices running on ARM64 architecture.

Install the Netskope Client using an Email Invite

The Netskope Client (or the mobile profile on iOS) can be installed via the email invitation sent from the admin console. The user can click the link to download and install the client (or the mobile profile) on their device. Additionally, if you use the email invite option for iOS devices, ensure that you follow the steps defined here to trust manually installed certificates. Email invites are time-bound and can be used only by the intended user.

To watch a video about the Client email invite, click play.

This step is not required for MDM deployments.

End-user environment: Devices running Microsoft Windows, Apple macOS, iOS, and Android.

Caution

For iOS devices running versions after 12.1.3, Apple has changed how profile installations work on iOS devices. Automatic installation of profiles has been restricted, and now requires additional steps.

In such cases, for a new profile to be installed, end users must manually navigate to device settings to install the profile after clicking on the link in the email and downloading the profile. Netskope recommends updating the email invitation template to call the users' attention to this important step.

This change does not impact MDM-based configuration profile installation.

  • Reference: https://support.apple.com/en-us/HT209435

  • To enroll is iOS beta program, and try this experience: https://appleseed.apple.com/

Prerequisites

The users’ account must be set up on the tenant before sending out the email invite.

Create an Email Invite

Use the following procedure in your (administrator account required) Netskope admin console to create the email invite:

  1. Go to Settings > Security Cloud Platform > Netskope Client > Users page.

  2. Click Add Users and enter the following in the Add Users pop-up window:

  3. User email address. Enter comma separated email address if adding more than one user.

    Alternatively, to bulk add users you can upload a CSV file with the email address of all users. The CSV file entries must have this format: email, lastname, firstname. Last name and First name are optional.

  4. Select the Send email invite checkbox and click the Add button.

Support for Chromebook

To install Netskope client in Chromebook, use the following procedure to install the Netskope root CA cert in Chrome OS cert store.

Note

  • Ensure that you have purchased additional Chromebook management licence for the Google admin account.

  • Cert pinned app domains are bypassed in Netskope Android App

Enroll Chromebook to Google Managed Account
  1. Power on the Chromebook and follow the on-screen instructions until you see the sign-in screen. Don't sign in yet. If you see the enrollment screen instead of the sign-in screen, go to step 4.

  2. If you're enrolling a Chromebook tablet, tap Email or phone. Then, tap the More option (three vertical dots).

  3. Switch to full layout to open the on-screen keyboard.

  4. Choose an option to get to the enrollment screen:

    1. Press Ctrl+Alt+E.

    2. Click More options  > Enterprise enrollment 

      Note

      This option is not available on Chromebook tablets.

  5. Enter the username and password from your Google admin welcome letter or for a Google Account that has the permissions to enroll. If prompted, enter the asset ID and location and click Next.

  6. When you get a confirmation message that the device is successfully enrolled, click Done.

Configure Google Admin Account
  1. Sign in to your Google admin account console.

  2. Click Device Management.

  3. On the left, click Network and click Certificates.

  4. [Optional] On the left, choose the organizational unit to add the certificate.

    Note

    The top-level organization is selected by default to give all users (including those in sub-organizations) access to any added certificates.

  5. Click Add Certificate. Choose the certificate file to upload and click Open.

  6. [Optional] If the certificate is used as a root CA for an SSL-inspecting web filter or to allow the browser to validate the full digital certificate chain of servers, check the Use this certificate as an HTTPS certificate authority box.

  7. Click Save and then Done to confirm.

Deploy the Certificate to Chrome Devices

Enroll the Chromebook to the organization's Google account. Chrome devices will authenticate to Google and receive the SSL certificate. The pushed certificate will apply to all enrolled Chrome devices.

Deployment via Invitation Email

The admin sends an invitation email to the Chromebook user and the user must click the "ChromeOS app" link to install the android app in Chromebook.

Note

Ensure that you add  the <p>ChromeOS App: {{NS_CHROMEOSCLIENT}}</p>  in email invitation template.