Here is the list of the new features and enhancements.
Private Access Cloud
Pattern Matching Support in Application Definition
Private application definitions now support pattern matching for host (FQDN) entries. This is useful for environments where application hostnames are dynamically generated and only partially predictable. For example, container platforms such as AWS ECS that create names like nginx.consumers.sandbox.internal-1e2cdc5, where only the middle segment (consumers.sandbox.internal) is stable. Instead of defining each host individually, administrators can define a single pattern that matches the stable portion of the name, reducing configuration overhead and keeping policy in sync as applications are created and destroyed.
Supported Operating Systems: All supported platforms
This release introduces a tenant-level option (disabled by default) to perform Publisher-first DNS validation and resolution for private applications matched by an exact FQDN policy. Previously, exact-match apps configured with use_publisher_dns: false received an immediate locally generated stub IP without resolving through the Publisher, which did not preserve the DNS answer structure (for example, CNAME chains). This could disrupt workloads that rely on DNS aliasing and canonicalization, such as Microsoft SQL AlwaysOn listeners and Kerberos/SPN flows.
When the option is enabled, QTYPE A queries for exact-match policy hits are validated and resolved via the Publisher before the client responds. The returned DNS response preserves the full DNS structure (CNAME chain and other record sets) while still enforcing ZTNA steering by rewriting A-record data to the stub IP. Wildcard matching and validation behavior are unchanged. The toggle is available in the management UI with RBAC and audit support.
The initial release covers QTYPE A queries only (AAAA/HTTPS/SVCB are not in scope). This option is disabled by default; there are no behavioral changes unless you enable it.
Local Broker
Dedicated Local Broker Hostname Per Steering Configuration
Administrators can now assign a dedicated Local Broker hostname (FQDN) to individual Traffic Steering configurations. Instead of all users resolving a single tenant-wide hostname, different user groups can be mapped to distinct LBR hostnames.
For tenants using latency-based local broker selection (GSLB), the dedicated hostname also serves as a per-steering-config DNS fallback when GSLB is unavailable.
This is a Beta feature. Contact Netskope Support or your sales representative to enable this feature for your tenant.