Tenant control
With Gateway tenant control, you can allow your users access to corporate SaaS applications while blocking access to personal applications. This helps prevent the loss of sensitive or confidential data from a corporate network.
When creating an HTTP policy with an Allow action, you will have the option to configure custom headers. Gateway can use custom headers to control SaaS application access. If a user's HTTP request is headed to your organization's account for the SaaS application, Gateway will approve the request. If the request does not match the information in the header, Gateway will block the request.
To create an HTTP policy with custom headers:
- In Zero Trust ↗, go to Gateway > Firewall policies. Select HTTP.
- Select Add a policy.
- Build an expression to match the SaaS traffic you want to control.
- In Action, select Allow. In Untrusted certificate action, select Block.
- Under Add headers to matched requests, select Add a header.
- Add any custom header names and values corresponding to your SaaS application.
- Select Create policy.
Your policy is now displayed in your list of HTTP policies. When your users attempt to authenticate your configured SaaS application with a personal account, authentication will fail.
Depending on which SaaS application your organization needs access to, different tenant control policies are required.
Microsoft 365 tenant control requires two policies. When you order your policies, make sure they follow order of precedence.
| Precedence | Selector | Operator | Value | Action | Untrusted certificate action |
|---|---|---|---|---|---|
| 1 | Domain | is | login.live.com | Allow | Block |
| Custom header name | Custom header value |
|---|---|
Sec-Restrict-Tenant-Access-Policy | restrict-msa |
| Precedence | Selector | Operator | Value | Action | Untrusted certificate action |
|---|---|---|---|---|---|
| 2 | Application | in | Microsoft Office365 | Allow | Block |
| Custom header name | Custom header value |
|---|---|
Restrict-Access-To-Tenants, Restrict-Access-Context | Your organization's domain |
For more information, refer to the Microsoft Entra ID documentation ↗.
| Selector | Operator | Value | Action | Untrusted certificate action |
|---|---|---|---|---|
| Application | in | Google Workspace | Allow | Block |
| Custom header name | Custom header value |
|---|---|
X-GooGApps-Allowed-Domains | Your organization's domain |
For more information, refer to the Google Workspace documentation ↗.
| Selector | Operator | Value | Action | Untrusted certificate action |
|---|---|---|---|---|
| Application | in | Slack | Allow | Block |
| Custom header name | Custom header value |
|---|---|
X-Slack-Allowed-Workspaces-Requester, X-Slack-Allowed-Workspaces | Your organization's workspace |
For more information, refer to the Slack documentation ↗.
| Selector | Operator | Value | Action | Untrusted certificate action |
|---|---|---|---|---|
| Application | in | Dropbox | Allow | Block |
| Custom header name | Custom header value |
|---|---|
X-Dropbox-allowed-Team-Ids | Your organization's ID |
For more information, refer to the Dropbox documentation ↗.
You can configure Browser Isolation to send custom headers. This is useful for implementing tenant control for isolated SaaS applications or sending arbitrary custom request headers to isolated websites.
To use custom headers with Browser Isolation, create two HTTP policies targeting the same domain or application group. For example, you can create policies for httpbin ↗, an open-source site for testing HTTP requests:
-
Create an Isolate policy for
httpbin.org.Selector Operator Value Action Domain in httpbin.orgIsolate -
Create an Allow policy for
httpbin.orgwith a custom header.Selector Operator Value Action Domain in httpbin.orgAllow Custom header name Custom header value Example-Headerexample-value -
Go to
httpbin.org/anything↗. Cloudflare will render the site in an isolated browser. Your custom header will appear in the list of headers.