Zone Selection Based on User Identity

The primary goal of Zone Selection is to enable customers to selectively provide access to specialized infrastructure, such as China Elite POPs or Special Access POPs, based on the user identity such as User Groups or Organization Units (OUs). Zone Selection applies to traffic steered by the Netskope Client, including web and cloud app traffic and Netskope Private Access (NPA) traffic [CONFIRM: exact NPA traffic scope]. Administrators can ensure that users requiring high-performance or specific regional access (like China Elite) are automatically routed through the appropriate POPs for both their internet-bound and private-app traffic.

Prerequisite

Supported minimum Client version: 135.0.0
Applicable to tenants with China Elite subscription.

Enable Zone Selection

To activate Zone Selection, navigate to Settings > Security Cloud Platform >Netskope Client > Client Configuration > Tunnel Settings > Advanced Options and enable Zone Selection. To learn more, view Zone Selection.

Implementation Details

The feature allows specific zone selections with Client Configuration profiles:

China Elite: Returns an ordered list of Elite POPs followed by Premium POPs.
China Elite Extended: Returns China Elite Extended POPs (for example, HKG2), followed by Elite POPs and then Premium POPs.

If an administrator chooses China Elite or China Elite Extended in at least one Client Configuration profile, users associated with other Client Configurations that do not have a Zone selection specified will no longer receive China Elite POPs.

Zone Selection for Private Access (NPA)

Zone Selection also applies to Netskope Private Access (NPA) traffic. When a user is matched to a Client Configuration profile with China Elite or China Elite Extended selected, their NPA traffic is steered through the corresponding specialized POPs, in the same identity-based manner as their web and cloud app traffic. [CONFIRM: exact behavior — which component performs the selection (NPA Client Gateway / POP), and how it interacts with Publisher Selection and latency-based Publisher selection.]

Requirements:

Minimum Netskope Client version: R135.
The user must be associated with a Client Configuration profile that has Zone Selection enabled (OU or User Group based).

Note

Zone Selection (identity-based, configured in Client Configuration) is different from NewEdge Traffic Management Zones per NPA Tenant, which restricts NPA traffic to specific geographic Zones tenant-wide for compliance. Use Zone Selection to route specific user groups to specialized POPs; use NewEdge Traffic Management Zones to constrain where NPA traffic is processed.

China Elite Extended: Supported Use Cases and Guidelines

China Elite Extended is available to China Elite users for two use cases:

Supporting traveling executives or VIP users who need consistent access to sites and apps outside China while in mainland China.
Supporting marketing teams that need access to social media sites to manage ad campaigns.

Approach your Netskope account team to enable the China Elite Extended license.

China Elite Extended is intended for steering specific user groups to solve specific problems, not for routing an entire user base through the service. Netskope enforces this scope to ensure China Elite Extended is provided only to the user groups that need it.