Internet Access network content filtering

This page's changes and edits · All guidance changes

Microsoft's edit · 28 Sep 16:58 UTC

Clarify network content filtering descriptions

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 768af77 · +3 −3 lines · also on GitHub

⋯ 13 unchanged lines

1414 # Create content policies for network content filtering

1515

1616 Microsoft Entra Global Secure Access content policies provide real-time control over what users and agents share with generative AI applications, unmanaged cloud apps, and other internet destinations. These controls apply to content shared from managed endpoints through browsers, applications, add-ins, APIs, and more.

17 −**Basic content filtering** lets you block specific content types from being shared with selected destinations.

18 −**Scan with Purview** enables network data security by combining Microsoft Purview's data loss prevention (DLP) with identity-centric Global Secure Access policies. It inspects files and text for sensitive information and helps prevent data loss by blocking its sharing based on your *Purview DLP policies*. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.

17 +- **Basic content filtering** lets you block specific content types from being shared with selected destinations.

18 +- **Scan with Purview** enables network data security by combining Microsoft Purview's data loss prevention (DLP) with identity-centric Global Secure Access policies. It inspects files and text for sensitive information and helps prevent data loss by blocking its sharing based on your *Purview DLP policies*. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.

1919

2020 ### High-level architecture

2121 :::image type="content" source="media/how-to-network-content-filtering/network-content-filtering-architecture.png" alt-text="Diagram showing the architecture of network content filtering with Global Secure Access and Microsoft Purview." lightbox="media/how-to-network-content-filtering/network-content-filtering-architecture.png":::

⋯ 10 unchanged lines

3232

3333 Network content filtering supports the following key scenarios and outcomes for HTTP/S traffic:

3434 - **Basic content filtering** is modeled in Content rule with action = **Allow** or **Block**. It lets you allow or block upload or download of files based on supported file MIME types. The same can be done for supported text types as well. This does not need Purview.

35 −- **Scan with Purview** is modeled in Content rule with action = **Scan with purview**. Using this, you can audit and block selected file and text content based on:

35 +- **Scan with Purview** is modeled in Content rule with action = **Scan with purview**. Using this, you can audit and block selected file and text content based on conditions such as:

3636 - Microsoft Purview sensitivity labels

3737 - Sensitive content in files or text

3838 - The user's risk level

⋯ 282 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.