Netskope private access and network licensing covers the Netskope services that connect users, sites and data centers to applications through the Netskope NewEdge network: Netskope One Private Access (NPA, Netskope’s zero trust network access service), Netskope Enterprise Browser, DNSaaS, High-Capacity Tunnels, NewEdge Express Connect and Netskope One SD-WAN. Each of the first five has its own licensing terms in the “Product Terms and Use” section of Netskope’s documentation, which define units of measure, entitlement, pooling, measurement and overage remediation.[1][2][3][4][5] SD-WAN hardware is covered by the Netskope Hardware Terms and the Netskope One SD-WAN Life Cycle Policy; the SD-WAN licensing terms page itself requires a customer login.[6][7] All of these services are also subject to the Netskope Subscription Services Agreement (SSA).[8]
Editions
NPA is sold in packages whose Application Segment allocation “is specified in the Netskope quotation”, and in the Service Charges Document its SKUs (NK-NPA- and NK-ZTNXTL7) appear among the inline services charged per User.[1][9] Netskope does not publish the package contents. DNSaaS offers two licensing models, for authenticated and for unauthenticated traffic, each with a fixed monthly Query allocation per unit set by the SKU; the documentation’s worked example uses the SKU NK-DNSAAS-AT (DNSaaS authenticated traffic).[3] High-Capacity Tunnels are sold by protocol and bandwidth tier (the example is “IPSec 2 Gbps”) and NewEdge Express Connect by port bandwidth (the example is 10 Gbps).[4][5]
Metrics
| Service | Unit of measure | How it is counted | Catalog metric |
|---|---|---|---|
| NPA | User | Unique Users over a rolling 90 days | User |
| NPA | Light User | As User, capped at 5 Application Segments and 100 MB/month | Light User |
| NPA | Application Segment | Unique segments existing on the observation date | Application Segment |
| Enterprise Browser | Active User | Active Users on any particular day | Active User (Enterprise Browser) |
| DNSaaS | User or Device | Unique Users and Devices over a rolling 90 days | Device (DNSaaS) |
| DNSaaS | Query | Monthly total divided by days in month | Query (DNSaaS) |
| High-Capacity Tunnels | Tunnel pair and Gbps | Peak upload plus download on the active tunnel | Tunnel (active-standby pair) |
| NewEdge Express Connect | Port pair and Gbps | Peak throughput across both ports combined | Port pair (NewEdge Express Connect) |
Sources: NPA, Enterprise Browser, DNSaaS, High-Capacity Tunnels and NewEdge Express Connect licensing terms.[1][2][3][4][5]
Counting / floors
Netskope One Private Access
An NPA User follows Netskope’s standard User definition, and each User or Light User “counts as one Subscription Unit and cannot be shared between multiple Users”.[1] An Application Segment is “a single Private Application definition configured in the Netskope console by the administrator”.[1] Users are measured as unique Users over a rolling 90-day period and Application Segments as the number existing on the observation date (rule).[1]
Light Users are Users with capacity limits: “a maximum of 5 Application Segments and 100 MB of traffic per Light User per month” (rule).[1] If a Light User exceeds those limits, the customer must within 30 days of notice buy upgrades to full Users or stop the excess use.[1] User and Application Segment entitlements are pooled at account level across tenants, but Light Users are excluded from pooling.[1] For excess Users or segments, the customer must within 30 days license more, cease use by the excess Users or reduce the number of segments; Netskope may limit functionality until then.[1]
Commentary: Application Segments are a configuration artefact, not a user count, so they grow when administrators define applications more granularly. Consolidating definitions is a legitimate way to remain within the allocation, since the count is taken on the observation date.
Enterprise Browser
An Enterprise Browser Active User is an individual meeting the User definition who is “in Active Status in the Netskope UI”.[2] The subscription “Must be coterminous with Customer’s base Inline or NPA Subscription”, making it an add-on rather than a standalone product (rule).[2] Usage is “the number of Active Users on any particular day in the Subscription Period”, which is effectively a peak rather than a 90-day unique count.[2] In a license review Netskope may ask for directory data, directory sync logs or written confirmation of Active Users, and the customer must promptly license add-on packages or cease the excess use.[2]
DNSaaS
DNSaaS counts Users and Devices (any appliance or instance that generates traffic) as unique identities over a rolling 90 days, and Queries by volume.[3] Query entitlement is pooled at account level and “is not enforced on a per-User or Device basis”; unused queries do not roll over.[3] Netskope divides the month’s queries by the number of days and compares the daily average with the entitlement (rule).[3] In the documentation’s example, 1,000 units of NK-DNSAAS-AT generating 175,000,000 queries in a 30-day month average 5,833 queries per user per day against a 5,000 cap, so 1,167 units are required and 167 must be added.[3] Remediation is required when monthly usage exceeds the Query entitlement by more than 10% for any two months, within 30 days of notification.[3]
High-Capacity Tunnels
High-Capacity Tunnels steer traffic to NewEdge data centers over IPSec tunnels of 1 Gbps or more and GRE tunnels above 1 Gbps.[4] One Subscription Unit is one pair of active-standby tunnels, to a primary and a failover data center, and only one tunnel is active at a time.[4] Tunnel Bandwidth is the sum of upload and download, so an “IPSec 2 Gbps” unit does not allow 2 Gbps in each direction, does not allow active-active use of both tunnels and does not include additional data centers or GRE tunnels (rule).[4] Tunnel entitlement is assigned per tenant and bandwidth per tunnel, neither shareable.[4]
NewEdge Express Connect
NewEdge Express Connect provides dedicated physical ports on NewEdge data center equipment. One Subscription Unit is one pair of Ports, and the bandwidth tier applies across the pair combined, not per port.[5] Ports are pooled at account level and can be shared across tenants, but bandwidth is not pooled across port pairs.[5]
Bandwidth overage
Both network services measure the peak throughput continuously. If throughput exceeds the entitlement by more than 5% for more than 5 continuous minutes twice in a rolling 12 months, the customer must buy incremental packages or move to a higher tier within 30 days (rule).[4][5] Netskope may also constrain throughput above the entitlement, which can degrade service or cause traffic failure.[4]
Netskope One SD-WAN hardware
SD-WAN combines Netskope hardware with a cloud subscription. Under the Hardware Terms, the initial subscription period for Netskope One SD-WAN hardware begins on the earlier of first activation or 90 days after the hardware is placed for shipment (rule).[6] Software provided for hardware may only be installed on that hardware and may stop working when the subscription ends.[8] Hardware bought from a party that is not an authorised Netskope reseller receives no transferred software licence, support or updates, and support, warranty and software licences do not follow hardware transferred to third parties or exported from the original ship-to country without Netskope’s written consent (rule).[10][6]
The SD-WAN Life Cycle Policy commits Netskope to use commercially reasonable efforts to give 6 months notice before a hardware end of sale, and to support hardware and supply replacements for 5 years after it, provided the cloud subscription and support have been maintained continuously; support cannot be allowed to lapse and then be reinstated (rule).[7] Each SD-WAN software release version is supported for 24 months from initial release.[7] Replacement shipping on the next business day is a separately purchased service (Next Business Day Shipping).[6]
Virtualization & partitioning
None of these services is licensed by processor or host. Pooling across tenants differs by unit: NPA Users and Application Segments, Enterprise Browser Active Users, DNSaaS Queries and Express Connect ports are account-level, whereas Light Users, tunnels and bandwidth are not shareable.[1][2][3][4][5]
Cloud / BYOL
Not applicable. High-Capacity Tunnels and NewEdge Express Connect are available only in selected NewEdge data centers.[4][5]
Programs
No program is specific to these services apart from hardware replacement shipping. Evaluation hardware may be used for internal testing for up to 30 days from receipt and must be returned in good working order (rule).[6]
Out of scope
The login-protected Netskope One SD-WAN licensing terms, IoT Security hardware licensing and pricing are not covered. Inline User licensing for SWG and Firewall is covered in Subscription units and true-up.