You are preparing to deploy Netskope at your company.

The correct approach is to enroll users using the corporate IdP. In a fully remote deployment, the strongest way to ensure that only authorized company users enroll the Netskope Client is to require authentication against the organization’s identity provider. Netskope’s IdP enrollment workflow sends users to the corporate IdP login process, and enrollment succeeds only after successful IdP authentication. This ties client enrollment to the company’s identity lifecycle, access policies, MFA requirements, and user status. Email invitation is easier to deploy, but it is weaker because possession of the invitation link is not the same as controlled corporate identity authentication. Corporate OAuth is not the Netskope Client enrollment method being tested here, and UEBA analyzes user behavior after activity occurs; it does not enroll or authenticate client users.