Netskope One for Microsoft Purview DLP Configuration

This configuration will have to be performed on both the Microsoft and Netskope-side.

Netskope Setup

1. In the Netskope portal, browse to Settings > Manage > Microsoft Purview Integration then click Setup Purview Instance.

2. Enter an instance name (no spaces), and optionally an admin email for instance notification then click Grant Access. 

3. In the popup window that appears, sign in with your Microsoft Entra global administrator account (or any account that has the permissions to add and authorize an enterprise application). 

4. Once you log in, click Accept to the permissions requested, which authorizes Netskope to interact with Purview. 

5. Once authorized, you should now see the instance has been created. 

Permission Re-grants

As part of Netskope App registration in Azure for a given tenant, API permissions must be re-granted for Microsoft Graph as shown below in highlighted red box:

After a successful re-grant, the app registration will succeed and will be able to fetch the token for performing below API calls:

1. Protection Scope
2. Process Content

Purview Setup

1. Go to https://purview.microsoft.com/ > Solutions > Data Loss Prevention

   

2. Create a new policy and choose the Inline web traffic option.

   

3. Create a custom policy.

   

4. Name the policy.

   

5. Add your cloud apps.

   

6. Choose your data sources.

   

7. Choose your enforcement policy. Leave Network enabled.

   

8. Create as many DLP rules as desired.

   

   

   

9. Enable the policy.

   

Microsoft Security Copilot AI Agents

You can also use the Netskope One Data Protection Integration Agent with this setup.

1. Go to Microsoft Security Copilot and click Browse more agents

   

2. Search for Netskope and select Netskope One Data Protection Integration Agent. Click on it and click Get Agent.

   

   

3. Add your billing, resource group and give it a name. There is no license cost for the agent. CLick next and then press place order.

   

   

4. Click on Use in Security Copilot

   

5. Click Set up

   

6. When you get to user_query, put Generate a report for recent DLP incidents. This will be a drop down when you use the agent. You can also go back later and change it.

   Set up Home and Sources.

   

7. Under Non-Microsoft, select Show more

   

8. Enter your Netskope tenant url and your Netskope v2 API token. See /en/roles-rbac-v3

   

API Permissions

Creating the service principal in Azure is a requirement. Follow the steps below:

1. Install Azure PowerShell module if not already installed.

2. Connect to Azure: Connect-AzAccount -Tenant [tenantname].onmicrosoft.com

3. Add the service principle by pasting the following statement into PowerShell:

   if (-Not (Get-AzADServicePrincipal -ApplicationId "9ec59623-ce40-4dc8-a635-ed0275b5d58a")) {
           "Service principal not yet created"
           try{
               New-AzADServicePrincipal -ApplicationId "9ec59623-ce40-4dc8-a635-ed0275b5d58a"
           } catch {
               Write-Host "An error occurred when creating the service principal"
               Write-Host $_
           }
       } else {
           "Service principal already exists"
       }

Enable sending the traffic to Purview 

1. In the Netskope console, browse to Policies > Real-time Protection and select New Policy > Cloud App Access.

2. Create a new policy, select the scope (e.g., user, applications, activity), and select the action as Forward to Purview-DLP. Then, choose the correct Purview instance that you have synced with Netskope. The Forward to Purview action is applicable for both visibility and enforcement to allow/block the traffic. You need to have the appropriate policy (e.g. Block/ action policy) on the Purview platform to have Netskope perform the enforcement.

User Importing and Netskope Client Installation 

Make sure the Purview integration is enabled on the UI, and then perform a Entra ID user SCIM sync. If a SCIM sync is already in place before the feature enablement, make an update to the synced user or group. This change will trigger the user sync to happen on Netskope side and make sure all the configs are refreshed. 

Additional Considerations 

The default file size for Netskope is 16MB. To forward files exceeding the default size to Purview, you can enable Advanced File Scanning, also known as Large File Support (LFS).