Internet Access network content filtering

This page's changes and edits · All guidance changes

Microsoft's edit · 25 Sep 17:37 UTC

Update network content filtering limitations

Microsoft's commit message in MicrosoftDocs/entra-docs · commit b7859d0 · +10 ~~−10~~ lines · also on GitHub

⋯ 37 unchanged lines

3838 - The user's risk level

3939 - When you use **Scan with Purview**, you can generate Data Loss Prevention (DLP) admin alerts for rule matches.

4040

41 −> [!IMPORTANT]

42 −> We recommend you to inspect text sent to or received from cloud or AI apps using **Scan with Purview** and configure the matching text activities in Microsoft Purview.

43 −

4441 ## Prerequisites

4542

4643 To use the content policy feature, you need the following prerequisites:

⋯ 58 unchanged lines

105102 - (Optional) You can choose text type as well, but exercise caution as you should not end up blocking HTML or JSON text type that blocks your web traffic.

106103 - For **Scan with Purview**, select the file content types and text content types that you want Microsoft Purview to inspect. File content type selection is optional for text-only scenarios.

107104 :::image type="content" source="media/how-to-network-content-filtering/content-rule-content-types.png" alt-text="Screenshot of the Add Content Rule page showing the Matching conditions section with Activities set to Upload, and the Content types dropdown expanded with PDF selected." lightbox="media/how-to-network-content-filtering/content-rule-content-types.png":::

108 − 1. (Optional) Configure the **Source type** condition (preview) to scope the rule by traffic origin. Select **Agent** to match traffic classified as AI agent traffic. Traffic that is not classified as agent traffic is treated as **User** traffic. If not configured, the rule applies to all traffic.

105 + 1. (Optional) Configure the **Session type** condition to scope the rule by traffic origin. Select **Agent** to match traffic classified as AI agent traffic. Traffic that is not classified as agent traffic is treated as **User** traffic. If not configured, the rule applies to all traffic.

109106 1. Select **+ Add destination** and configure the destinations.

110107 - For application-specific control, you can add the exact URLs and related FQDNs that the app uses. Use browser developer tools or network traffic analysis to identify the endpoints used during file upload, text submission, or other protected traffic.

111108 - You can also select web categories as a destination. If you select web categories, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md).

⋯ 161 unchanged lines

273270

274271 ## Known limitations

275272

273 +### Known internet access limitations

274 +For more information, see [Current known limitations](/reference-current-known-limitations.md#internet-access-limitations)

275 +

276 +### Known GSA network content filtering limitations

276277 - Network content filtering is supported with the Internet access profile only

277 −- Network content filtering doesn't support User Datagram Protocol (UDP) traffic, including QUIC.

278278 - When using web categories as destinations within Content rules, you must have a web filtering policy in place applied to one or more web categories (allow or block).

279279 - When using wildcards (*) in Content rule destinations, they cannot be used for top-level domains (TLD) or second-level domains (SLD). For example, *.contoso.com is supported, however *.com and contoso.* are not supported.

280280 - File detection is limited to files transferred as request/response bodies unencoded and with multipart encoding. Certain file transfer methods may prevent inspection, such as if an application encodes a file within a JSON, or the file is broken up into multiple encrypted requests.

281 −- WebSocket traffic bypasses content-type filtering in Content policy rules. When destination and activity conditions are met, the rule is evaluated regardless of the configured content type.

282 −- Requests are subject to rate limiting based on usage. When limits are exceeded, traffic is automatically blocked (fail-closed).

281 +- WebSocket traffic bypasses file-type filtering in Content policy rules. Text content type is still evaluated within web sockets.

282 +- Requests are subject to API rate limiting based on usage. When limits are exceeded, traffic is automatically blocked (fail-closed).

283283

284284

285 −### Known limitations for Scan with Purview include:

285 +### Known Purview DLP limitations

286286

287 −- The maximum supported content size for Scan with Purview is 3 MB for both file and text content types.

287 +- The maximum supported content size for **Scan with Purview** is 3 MB for both file and text content types.

288288 - OCR is not yet supported for traffic sent to Purview.

289289 - Scan with Purview only applies to traffic associated with an Entra user identity. Traffic that cannot be mapped to an Entra user identity is not sent to Purview for inspection.

290 −- In scenarios where Purview inspection is unable to complete, such as a payload that is too large to inspect, an unsupported codec, or an internal error, the traffic is allowed (fail-open). Transactions that have skipped inspection can be identified in Traffic logs using **PurviewStatus** field.

290 +- In scenarios where Purview inspection is unable to complete, such as a payload that is too large to inspect, or an internal error, the traffic is allowed (fail-open). Transactions that have skipped inspection can be identified in Traffic logs using **PurviewStatus** field.

291291

292292

293293 ## Monitoring and logging

⋯ 27 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.