ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 23:56 UTC Customize Public modeDiscuss ChangeIntel on Discord

Internet Access network content filtering

This page's changes and edits · All guidance changes

Microsoft's edit ·

Address PM feedback: rename file policy to content policy, move GA statement, remove multipart limitation

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8d39355 · +38 −37 lines · also on GitHub

11 ---
2 −title: Create File Policies for Network Content Filtering
2 +title: Create content policies for network content filtering
33 description: "Discover how to configure network content filtering with Global Secure Access to enforce data protection policies and secure sensitive files in real time."
44 ms.topic: how-to
5 −ms.date: 03/09/2026
5 +ms.date: 04/01/2026
66 ms.author: jayrusso
77 author: HULKsmashGithub
88 ms.reviewer: buzaher,shkhalid
⋯ 4 unchanged lines
1313
1414 ---
1515
16 −# Create a file policy to filter network file content
16 +# Create a content policy to filter network file content
1717
18 −Global Secure Access supports network content filtering through file policies. This feature helps you safeguard against unintended data exposure and prevents inline data leaks to generative AI applications and internet destinations. By extending data protection capabilities to the network layer through Global Secure Access, network content filtering enables your organization to enforce data policies on network traffic in real time. You can discover and protect files shared with unsanctioned destinations, such as generative AI and unmanaged cloud apps, from managed endpoints through browsers, applications, add-ins, APIs, and more.
18 +Global Secure Access supports network content filtering through content policies. This feature helps you safeguard against unintended data exposure and prevents inline data leaks to generative AI applications and internet destinations. By extending data protection capabilities to the network layer through Global Secure Access, network content filtering enables your organization to enforce data policies on network traffic in real time. You can discover and protect files shared with unsanctioned destinations, such as generative AI and unmanaged cloud apps, from managed endpoints through browsers, applications, add-ins, APIs, and more.
1919
2020 The network content filtering solution brings together Microsoft Purview's data classification service and the identity-centric network security policies in Global Secure Access. This combination creates an advanced network-layer data security solution, Data Loss Prevention (DLP), that's identity-centric and policy-driven. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.
2121
22 +> [!NOTE]
23 +> Basic content policy (block or allow by file MIME type) is generally available. The **Scan with Purview** action in content policies is currently in preview.
24 +
2225 ### High-level architecture
2326 :::image type="content" source="media/how-to-network-content-filtering/network-content-filtering-architecture.png" alt-text="Diagram showing the architecture of network content filtering with Global Secure Access and Microsoft Purview." lightbox="media/how-to-network-content-filtering/network-content-filtering-architecture.png":::
2427
25 −This article explains how to create a file policy to filter internet traffic flowing through Global Secure Access.
28 +This article explains how to create a content policy to filter internet traffic flowing through Global Secure Access.
2629
2730 > [!NOTE]
28 −> Basic file policy detects the file MIME type and enforces the **Allow** or **Block** action in Global Secure Access. Microsoft Purview is only involved when you choose **Scan with Purview**.
31 +> Basic content policy detects the file MIME type and enforces the **Allow** or **Block** action in Global Secure Access. Microsoft Purview is only involved when you choose **Scan with Purview**.
2932
3033 > [!IMPORTANT]
31 −> The **Scan with Purview** action in file policies is currently in PREVIEW.
34 +> The **Scan with Purview** action in content policies is currently in PREVIEW.
3235 > This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
33 −> Basic file policy (block or allow by file MIME type) is generally available.
3436
3537 ## Supported scenarios
3638
3739 Network content filtering supports the following key scenarios and outcomes for HTTP/1.1 traffic:
38 −- Using **Basic file policy**, you can block files based on supported file MIME types.
39 −- Using the **Scan with Purview** action (preview) in file policy, you can audit and block files based on:
40 +- Using **Basic content policy**, you can block files based on supported file MIME types.
41 +- Using the **Scan with Purview** action (preview) in content policy, you can audit and block files based on:
4042 - Microsoft Purview sensitivity labels
4143 - Sensitive content in the file
4244 - The user's risk level
⋯ 4 unchanged lines
4749
4850 ## Prerequisites
4951
50 −To use the File Policy feature, you need the following prerequisites:
52 +To use the content policy feature, you need the following prerequisites:
5153 - A valid Microsoft Entra tenant.
5254 - Licensing for the product. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
5355 - A valid Microsoft Entra Internet Access license.
5456 - A valid Microsoft Purview license, required for **Scan with Purview** inspection.
5557 - You must set up [pay-as-you-go billing](/purview/purview-billing-models#pay-as-you-go-billing-model) to use **Scan with Purview**.
56 − - You can use basic file policy without a Purview license.
58 + - You can use basic content policy without a Purview license.
5759 - A user with the [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID to configure Global Secure Access settings.
5860 - A [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role to configure Conditional Access policies.
5961 - The Global Secure Access client requires a device (or virtual machine) that is either Microsoft Entra ID joined or Microsoft Entra ID Hybrid joined.
⋯ 1 unchanged line
6163
6264 ## Initial configuration
6365
64 −To configure file policies, complete the following initial setup steps:
66 +To configure content policies, complete the following initial setup steps:
6567 1. [Enable the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md#enable-the-internet-access-traffic-forwarding-profile) and ensure correct user assignments.  
6668 1. [Configure the Transport Layer Security (TLS) inspection](how-to-transport-layer-security.md) policy.
6769 1. Install and configure the Global Secure Access client:
⋯ 5 unchanged lines
7375 1. In the Global Secure Access Advanced Diagnostics window, select the **Forwarding Profile** tab. 
7476 1. Verify that **Internet Access** rules are present in the **Rules** section. This configuration might take up to 15 minutes to apply to clients after enabling the Internet Access traffic profile in the Microsoft Entra admin center.
7577 :::image type="content" source="media/how-to-network-content-filtering/internet-access-rules.png" alt-text="Screenshot of the Global Secure Access Advanced Diagnostics window on the Forwarding Profile tab, showing Internet Access rules in the Rules section." lightbox="media/how-to-network-content-filtering/internet-access-rules.png":::
76 −1. Confirm access to web applications you plan for file policies.
78 +1. Confirm access to web applications you plan for content policies.
7779
78 −## Configure a file policy
80 +## Configure a content policy
7981
80 −To configure a file policy in Global Secure Access, complete the following steps:
81 −1. [Create a file policy](#create-a-file-policy).
82 −1. [Link the file policy to a security profile](#link-the-file-policy-to-a-security-profile).
82 +To configure a content policy in Global Secure Access, complete the following steps:
83 +1. [Create a content policy](#create-a-content-policy).
84 +1. [Link the content policy to a security profile](#link-the-content-policy-to-a-security-profile).
8385 1. [Configure a Conditional Access policy](#configure-a-conditional-access-policy).
8486
85 −### Create a file policy
87 +### Create a content policy
8688
8789 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator).
88 −1. Browse to **Global Secure Access** > **Secure** > **File policies**.
89 − :::image type="content" source="media/how-to-network-content-filtering/file-policies-create.png" alt-text="Screenshot of the File policies page in the Microsoft Entra admin center showing the Create policy button." lightbox="media/how-to-network-content-filtering/file-policies-create.png":::
90 +1. Browse to **Global Secure Access** > **Secure** > **Content policies**.
91 + :::image type="content" source="media/how-to-network-content-filtering/file-policies-create.png" alt-text="Screenshot of the Content policies page in the Microsoft Entra admin center showing the Create policy button." lightbox="media/how-to-network-content-filtering/file-policies-create.png":::
9092 1. Select **+ Create Policy**. Pick the options that fit your needs.
9193 1. On the **Basics** tab:
9294 1. Enter the policy **Name**.
9395 1. Enter the policy **Description**.
9496 1. Select **Next**.
95 − :::image type="content" source="media/how-to-network-content-filtering/file-policy-basics-tab.png" alt-text="Screenshot of the Basics tab for a new file policy showing the Policy name and Description fields." lightbox="media/how-to-network-content-filtering/file-policy-basics-tab.png":::
97 + :::image type="content" source="media/how-to-network-content-filtering/file-policy-basics-tab.png" alt-text="Screenshot of the Basics tab for a new content policy showing the Policy name and Description fields." lightbox="media/how-to-network-content-filtering/file-policy-basics-tab.png":::
9698 1. On the **Rules** tab:
9799 1. Add a new rule.
98100 1. Enter the **Rule name**, **Description**, **Priority**, and **Status** as appropriate.
⋯ 8 unchanged lines
107109 - You can also select web categories as a destination. If you select web categories, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md) for those categories.
108110 1. Select **Next**.
109111 1. On the **Review** tab, review your settings.
110 − :::image type="content" source="media/how-to-network-content-filtering/file-policy-review-tab.png" alt-text="Screenshot of the Review tab showing a summary of the file policy settings including policy name, description, and number of rules before creation." lightbox="media/how-to-network-content-filtering/file-policy-review-tab.png":::
112 + :::image type="content" source="media/how-to-network-content-filtering/file-policy-review-tab.png" alt-text="Screenshot of the Review tab showing a summary of the content policy settings including policy name, description, and number of rules before creation." lightbox="media/how-to-network-content-filtering/file-policy-review-tab.png":::
111113 1. Select **Create** to create the policy.
112114
113115 > [!IMPORTANT]
114 −> If you choose the **Scan with Purview** action in a file policy rule, you must also configure a corresponding DLP policy in Microsoft Purview that targets inline web traffic. Without a matching Purview DLP policy, the file policy can't inspect file content or enforce allow or deny decisions. See [Configure a Purview DLP policy for network data security](#configure-a-purview-dlp-policy-for-network-data-security) for step-by-step guidance and [Example: Block sensitive PDF uploads to ChatGPT](#example-block-sensitive-pdf-uploads-to-chatgpt) for a concrete scenario.
116 +> If you choose the **Scan with Purview** action in a content policy rule, you must also configure a corresponding DLP policy in Microsoft Purview that targets inline web traffic. Without a matching Purview DLP policy, the content policy can't inspect file content or enforce allow or deny decisions. See [Configure a Purview DLP policy for network data security](#configure-a-purview-dlp-policy-for-network-data-security) for step-by-step guidance and [Example: Block sensitive PDF uploads to ChatGPT](#example-block-sensitive-pdf-uploads-to-chatgpt) for a concrete scenario.
115117
116 −### Link the file policy to a security profile
118 +### Link the content policy to a security profile
117119
118120 1. Browse to **Global Secure Access** > **Secure** > **Security profiles**.
119121 1. Select the security profile you want to modify.
120122 1. Switch to the **Link policies** view.
121 −1. Configure the link file policy:
122 − 1. Select **+ Link a policy** > **Existing File policy**.
123 − 1. From the **Policy name** menu, select the file policy you created.
123 +1. Configure the link content policy:
124 + 1. Select **+ Link a policy** > **Existing Content policy**.
125 + 1. From the **Policy name** menu, select the content policy you created.
124126 1. Keep the default values for **Position** and **State**.
125127 1. Select **Add**.
126128 1. Close the security profile.
⋯ 14 unchanged lines
141143
142144 For more information, see [Create and link a Conditional Access policy](how-to-configure-web-content-filtering.md#create-and-link-conditional-access-policy).
143145
144 −The file policy is successfully configured.
146 +The content policy is successfully configured.
145147
146148 ## Configure a Purview DLP policy for network data security
147149
148 −If you selected the **Scan with Purview** action in your file policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on files that Global Secure Access routes for inspection.
150 +If you selected the **Scan with Purview** action in your content policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on files that Global Secure Access routes for inspection.
149151
150152 > [!IMPORTANT]
151153 > The **Scan with Purview** integration for Global Secure Access is currently in PREVIEW.
⋯ 48 unchanged lines
200202
201203 For a detailed walkthrough with example configurations, see [Use Network Data Security to help prevent sharing sensitive information with unmanaged AI](/purview/dlp-create-policy-ai-network-data-security).
202204
203 −## Test the file policy
204 −Test the configuration by attempting to upload or download files that match the file policy conditions. Verify that the policy settings block or allow the actions.
205 +## Test the content policy
206 +Test the configuration by attempting to upload or download files that match the content policy conditions. Verify that the policy settings block or allow the actions.
205207
206208 ### Example: Block sensitive PDF uploads to ChatGPT
207209
208210 This example walks through an end-to-end test scenario that blocks a PDF file containing sensitive data (such as credit card numbers or Social Security numbers) from being uploaded to ChatGPT.
209211
210 −#### Step 1: Configure the file policy destinations
212 +#### Step 1: Configure the content policy destinations
211213
212 −When you create or edit your file policy rule, don't add only `chatgpt.com`. Add the specific URLs and FQDNs that match ChatGPT file upload traffic:
214 +When you create or edit your content policy rule, don't add only `chatgpt.com`. Add the specific URLs and FQDNs that match ChatGPT file upload traffic:
213215
214216 - `https://chatgpt.com/backend-api/files` (add as URL)
215217 - `https://chatgpt.com/backend-api/files/process_upload_stream` (add as URL)
⋯ 6 unchanged lines
222224
223225 #### Step 2: Configure a Purview DLP policy (for Scan with Purview action)
224226
225 −If you select **Scan with Purview** as the file policy action, you must also configure a corresponding Microsoft Purview DLP policy to inspect the file content and make the allow or deny decision.
227 +If you select **Scan with Purview** as the content policy action, you must also configure a corresponding Microsoft Purview DLP policy to inspect the file content and make the allow or deny decision.
226228
227229 1. In the [Microsoft Purview portal](https://purview.microsoft.com).
228230 1. Follow the steps in [Use Network Data Security to help prevent sharing sensitive information with unmanaged AI](/purview/dlp-create-policy-ai-network-data-security#steps-to-create-policy) to create a new DLP policy.
⋯ 19 unchanged lines
248250 ## Known limitations
249251
250252 - Network content filtering doesn't support text. It only supports files.
251 −- Multipart encoding isn't supported, so file policy doesn't work for such applications. For example, Google Drive uses multipart encoding for file upload.
252253 - Compressed content is detected in ZIP format. The content isn't decompressed.
253254 - True file type detection might not be 100% accurate.
254255 - Destination applications that use WebSocket, such as Copilot, aren't supported.
⋯ 16 unchanged lines
271272 1. To investigate matching activities, open **Activity explorer** and filter for **Network DLP activities** or the policy, user, or app you want to review. For more information, see [Get started with activity explorer](/purview/data-classification-activity-explorer).
272273
273274 > [!NOTE]
274 −> Purview alerts and Activity explorer apply when you use **Scan with Purview**. Basic file policy enforcement stays within Global Secure Access.
275 +> The Purview alerts and Activity explorer sections apply only when you configure the **Scan with Purview** action. If you use basic content policy with **Allow** or **Block** actions, all enforcement and logging happens in Global Secure Access traffic logs.
275276
276277 ## Related content
277278
⋯ 7 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 23:56 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.