Internet Access network content filtering
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c5924ed · +85 −44 lines · also on GitHub
11
---
22
title: Create content policies for network content filtering
3
−description: "Discover how to configure network content filtering with Global Secure Access to enforce data protection policies and secure sensitive files in real time."
3
+description: "Discover how to configure network content filtering with Global Secure Access to enforce data protection policies for files and text content in real time."
44
ms.topic: how-to
5
−ms.date: 04/18/2026
5
+ms.date: 06/30/2026
66
ms.reviewer: buzaher,shkhalid
77
ms.custom: sfi-image-nochange
88
ai-usage: ai-assisted
⋯ 2 unchanged lines
1111
1212
---
1313
14
−# Create a content policy to filter network file content
14
+# Create content policies for network content filtering
1515
16
−Global Secure Access supports network content filtering through content policies. This feature helps you safeguard against unintended data exposure and prevents inline data leaks to generative AI applications and internet destinations. By extending data protection capabilities to the network layer through Global Secure Access, network content filtering enables your organization to enforce data policies on network traffic in real time. You can discover and protect files shared with unsanctioned destinations, such as generative AI and unmanaged cloud apps, from managed endpoints through browsers, applications, add-ins, APIs, and more.
16
+Global Secure Access supports network content filtering through content policies. This feature helps you safeguard against unintended data exposure and prevents inline data leaks to generative AI applications and internet destinations. By extending data protection capabilities to the network layer through Global Secure Access, network content filtering enables your organization to enforce data policies on network traffic in real time. You can discover and protect files and text content shared with unsanctioned destinations, such as generative AI and unmanaged cloud apps, from managed endpoints through browsers, applications, add-ins, APIs, and more.
1717
1818
The network content filtering solution brings together Microsoft Purview's data classification service and the identity-centric network security policies in Global Secure Access. This combination creates an advanced network-layer data security solution, Data Loss Prevention (DLP), that's identity-centric and policy-driven. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.
1919
2020
> [!NOTE]
21
−> Basic content policy (block or allow by file MIME type) is generally available. The **Scan with Purview** action in content policies is currently in preview. This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
21
+> Basic content policy (block or allow by file MIME type) is generally available. The **Scan with Purview** action in content policies is currently in preview and supports inspection for selected file and text content types. This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
2222
2323
### High-level architecture
2424
:::image type="content" source="media/how-to-network-content-filtering/network-content-filtering-architecture.png" alt-text="Diagram showing the architecture of network content filtering with Global Secure Access and Microsoft Purview." lightbox="media/how-to-network-content-filtering/network-content-filtering-architecture.png":::
⋯ 1 unchanged line
2626
This article explains how to create a content policy to filter internet traffic flowing through Global Secure Access.
2727
2828
> [!NOTE]
29
−> Basic content policy detects the file MIME type and enforces the **Allow** or **Block** action in Global Secure Access. Microsoft Purview is only involved when you choose **Scan with Purview**.
29
+> Basic content policy detects the file MIME type and enforces the **Allow** or **Block** action in Global Secure Access. Microsoft Purview is only involved when you choose **Scan with Purview**. Text content type inspection requires **Scan with Purview** and a corresponding Microsoft Purview DLP policy.
3030
3131
## Supported scenarios
3232
3333
Network content filtering supports the following key scenarios and outcomes for HTTP/1.1 traffic:
3434
- Using **Basic content policy**, you can block files based on supported file MIME types.
35
−- Using the **Scan with Purview** action (preview) in content policy, you can audit and block files based on:
35
+- Using the **Scan with Purview** action (preview) in content policy, you can audit and block selected file and text content based on:
3636
- Microsoft Purview sensitivity labels
37
− - Sensitive content in the file
37
+ - Sensitive content in files or text
3838
- The user's risk level
3939
- When you use **Scan with Purview**, you can generate Data Loss Prevention (DLP) admin alerts for rule matches.
4040
4141
> [!IMPORTANT]
42
−> Network content filtering supports only files over HTTP/1.1. It doesn't support network content filtering for text.
42
+> Basic content policy doesn't inspect text. To inspect text sent to or received from cloud or AI apps, use **Scan with Purview** and configure the matching text activities in Microsoft Purview.
4343
4444
## Prerequisites
4545
⋯ 1 unchanged line
4747
- A valid Microsoft Entra tenant.
4848
- Licensing for the product. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
4949
- A valid Microsoft Entra Internet Access license.
50
− - A valid Microsoft Purview license, required for **Scan with Purview** inspection.
51
− - You must set up [pay-as-you-go billing](/purview/purview-billing-models#pay-as-you-go-billing-model) to use **Scan with Purview**.
50
+ - A valid Microsoft Purview license, required for **Scan with Purview** inspection.
51
+ - Network data security requires Microsoft Purview pay-as-you-go billing to be configured before you create Purview collection or DLP policies. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
5252
- You can use basic content policy without a Purview license.
53
−- A user with the [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID to configure Global Secure Access settings.
54
−- A [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role to configure Conditional Access policies.
55
−- The Global Secure Access client requires a device (or virtual machine) that is either Microsoft Entra ID joined or Microsoft Entra ID Hybrid joined.
53
+- A user with the [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID to configure Global Secure Access settings.
54
+- A [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role to configure Conditional Access policies.
55
+- The Global Secure Access client requires a device (or virtual machine) that is either Microsoft Entra ID joined or Microsoft Entra ID Hybrid joined.
5656
- To use **web categories** as a content policy destination, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md).
5757
- User Datagram Protocol (UDP) traffic (that is, QUIC) isn't supported. Most websites support fallback to Transmission Control Protocol (TCP) when QUIC can't be established. For an improved user experience, you can deploy a Windows Firewall rule that blocks outbound UDP 443:
5858
⋯ 4 unchanged lines
6363
## Initial configuration
6464
6565
To configure content policies, complete the following initial setup steps:
66
−1. [Enable the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md#enable-the-internet-access-traffic-forwarding-profile) and ensure correct user assignments.
66
+1. [Enable the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md#enable-the-internet-access-traffic-forwarding-profile) and ensure correct user assignments.
6767
1. [Configure the Transport Layer Security (TLS) inspection](how-to-transport-layer-security.md) policy.
6868
1. Install and configure the Global Secure Access client:
6969
1. Install the Global Secure Access client on Windows or macOS.
7070
> [!IMPORTANT]
7171
> Before you continue, test and ensure your client's internet traffic is routed through Global Secure Access. To verify the client configuration, see the steps in the following section.
7272
1. Select the **Global Secure Access** icon and select the Troubleshooting tab.
73
− 1. Under **Advanced Diagnostics**, select **Run tool**.
74
− 1. In the Global Secure Access Advanced Diagnostics window, select the **Forwarding Profile** tab.
75
− 1. Verify that **Internet Access** rules are present in the **Rules** section. This configuration might take up to 15 minutes to apply to clients after enabling the Internet Access traffic profile in the Microsoft Entra admin center.
73
+ 1. Under **Advanced Diagnostics**, select **Run tool**.
74
+ 1. In the Global Secure Access Advanced Diagnostics window, select the **Forwarding Profile** tab.
75
+ 1. Verify that **Internet Access** rules are present in the **Rules** section. This configuration might take up to 15 minutes to apply to clients after enabling the Internet Access traffic profile in the Microsoft Entra admin center.
7676
:::image type="content" source="media/how-to-network-content-filtering/internet-access-rules.png" alt-text="Screenshot of the Global Secure Access Advanced Diagnostics window on the Forwarding Profile tab, showing Internet Access rules in the Rules section." lightbox="media/how-to-network-content-filtering/internet-access-rules.png":::
7777
1. Confirm access to web applications you plan for content policies.
7878
⋯ 23 unchanged lines
102102
- To use data policies configured in Microsoft Purview, select **Scan with Purview** (preview).
103103
:::image type="content" source="media/how-to-network-content-filtering/scan-with-purview.png" alt-text="Screenshot of the content rule screen with the Action menu expanded and the Scan with Purview option selected." lightbox="media/how-to-network-content-filtering/scan-with-purview.png":::
104104
1. For **Matching conditions**, select the appropriate **Activities** and **Content types**.
105
+ - For basic content policy, select the file content types to allow or block.
106
+ - For **Scan with Purview**, select the file content types and text content types that you want Microsoft Purview to inspect. File content type selection is optional for text-only scenarios.
105107
:::image type="content" source="media/how-to-network-content-filtering/content-rule-content-types.png" alt-text="Screenshot of the Add Content Rule page showing the Matching conditions section with Activities set to Upload, and the Content types dropdown expanded with PDF selected." lightbox="media/how-to-network-content-filtering/content-rule-content-types.png":::
106108
1. Select **+ Add destination** and configure the destinations.
107
− - For application-specific control, you can add the exact upload URLs and related FQDNs that the app uses. Use browser developer tools or network traffic analysis to identify the endpoints used during file upload.
109
+ - For application-specific control, you can add the exact URLs and related FQDNs that the app uses. Use browser developer tools or network traffic analysis to identify the endpoints used during file upload, text submission, or other protected traffic.
108110
- You can also select web categories as a destination. If you select web categories, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md).
109111
1. Select **Next**.
110112
1. On the **Review** tab, review your settings.
⋯ 1 unchanged line
112114
1. Select **Create** to create the policy.
113115
114116
> [!IMPORTANT]
115
−> If you choose the **Scan with Purview** action in a content policy rule, you must also configure a corresponding DLP policy in Microsoft Purview that targets inline web traffic. Without a matching Purview DLP policy, the content policy can't inspect file content or enforce allow or deny decisions. See [Configure a Purview DLP policy for network data security](#configure-a-purview-dlp-policy-for-network-data-security) for step-by-step guidance and [Example: Block sensitive PDF uploads to ChatGPT](#example-block-sensitive-pdf-uploads-to-chatgpt) for a concrete scenario.
117
+> If you choose the **Scan with Purview** action in a content policy rule, you must also configure a corresponding DLP policy in Microsoft Purview that targets inline web traffic. Without a matching Purview DLP policy, the content policy can't inspect selected file or text content or enforce audit or block decisions. See [Configure a Purview DLP policy for network data security](#configure-a-purview-dlp-policy-for-network-data-security) for step-by-step guidance and [Example: Block sensitive text sent through Gmail](#example-block-sensitive-text-sent-through-gmail) for a concrete scenario.
116118
117119
### Link the content policy to a security profile
118120
⋯ 1 unchanged line
120122
1. Select the security profile you want to modify.
121123
1. Switch to the **Link policies** view.
122124
1. Configure the link content policy:
123
− 1. Select **+ Link a policy** > **Existing Content policy**.
124
− 1. From the **Policy name** menu, select the content policy you created.
125
− 1. Keep the default values for **Position** and **State**.
126
− 1. Select **Add**.
125
+ 1. Select **+ Link a policy** > **Existing Content policy**.
126
+ 1. From the **Policy name** menu, select the content policy you created.
127
+ 1. Keep the default values for **Position** and **State**.
128
+ 1. Select **Add**.
127129
1. Close the security profile.
128130
129131
### Configure a Conditional Access policy
⋯ 10 unchanged lines
140142
1. Under **Session**, select **Use Global Secure Access Security Profile** and select the security profile you created.
141143
1. To create the policy, select **Create**.
142144
143
−For more information, see [Create and link a Conditional Access policy](how-to-configure-web-content-filtering.md#create-and-link-conditional-access-policy).
145
+For more information, see [Create and link a Conditional Access policy](how-to-configure-web-content-filtering.md#create-and-link-conditional-access-policy).
144146
145147
The content policy is successfully configured.
146148
147149
## Configure a Purview DLP policy for network data security
148150
149
−If you selected the **Scan with Purview** action in your content policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on files that Global Secure Access routes for inspection.
151
+If you selected the **Scan with Purview** action in your content policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on file and text content that Global Secure Access routes for inspection.
150152
151153
> [!IMPORTANT]
152
−> The **Scan with Purview** integration for Global Secure Access is currently in PREVIEW.
154
+> The **Scan with Purview** integration for Global Secure Access is currently in preview.
153155
> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
154156
155157
### Prerequisites for Purview integration
156158
157
−- Microsoft Purview pay-as-you-go billing configured for your tenant. For network data security DLP scenarios, the pay-as-you-go subscription is all you need. If you use other DLP functionality, per-seat licensing is required. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
159
+- Microsoft Purview pay-as-you-go billing configured for your tenant. You must configure pay-as-you-go billing before you set up Microsoft Purview collection or DLP policies for network data security. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
158160
159161
> [!NOTE]
160
−> If you don't see **Data loss prevention** under **Settings**, your account might not have the required permissions or your tenant might not have the required licensing. You need a role such as **DLP Compliance Management** or **Information Protection Admin**, and a Microsoft 365 E5/A5 subscription or a Microsoft Purview DLP add-on. For more information, see [Permissions in the Microsoft Purview portal](/purview/purview-permissions).
161
−
162
−For detailed steps on SASE provider integration, see [Use Network Data Security to help prevent sharing sensitive information with unmanaged AI -- SASE provider integration](/purview/dlp-create-policy-ai-network-data-security#sase-provider-integration).
162
+> If you don't see **Data loss prevention** in Microsoft Purview, your account might not have the required permissions or your tenant might not have the required licensing. You need a role such as **DLP Compliance Management** or **Information Protection Admin**, and a Microsoft 365 E5/A5 subscription or a Microsoft Purview DLP add-on. For more information, see [Permissions in the Microsoft Purview portal](/purview/purview-permissions).
163163
164164
### Create a DLP policy for network data security
165165
⋯ 8 unchanged lines
174174
1. On the **Adaptive app scopes** tab, choose the app categories you want to protect against (for example, **All unmanaged AI apps**).
175175
1. Select **Add**.
176176
1. Select **Next**.
177
−1. On the **Choose where to enforce the policy** page, ensure **Network** is enabled, then select **Next**. You can only select **Network** when pay-as-you-go billing is set up. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
177
+1. On the **Choose where to enforce the policy** page, ensure **Network and non-Microsoft secure browsers** is enabled, then select **Next**. You can only select network enforcement when pay-as-you-go billing is set up. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
178178
1. Select **Create or customize advanced DLP rules** and select **Next**.
179179
1. Select **+ Create rule** and configure the rule:
180180
1. Enter a **Name** and optional description.
181181
1. Under **Conditions**, select **+ Add condition** > **Content contains**.
182182
1. Add the **sensitive information types** or **sensitivity labels** that match your organization's data protection requirements.
183183
1. Under **Actions**, select **+ Add an action** > **Restrict browser and network activities**.
184
− 1. Select **File uploaded to or shared with cloud or AI apps** and set the action to **Audit** or **Block** as appropriate.
184
+ 1. Select the actions that match your content policy scenario and set each action to **Audit** or **Block** as appropriate:
185
+ - **Text sent to or shared with cloud or AI apps**
186
+ - **Text received from cloud or AI apps**
187
+ - **File uploaded to or shared with cloud or AI apps**
188
+ - **File downloaded from cloud or AI apps**
185189
1. Configure **Incident reports** and alert settings as needed.
186190
1. Select **Save**.
187191
1. Review the rule, ensure its status is **On**, and select **Next**.
⋯ 1 unchanged line
189193
1. Select **Next**, review the policy, and select **Submit**.
190194
191195
> [!NOTE]
192
−> Global Secure Access supports file activities only. Text-based activities in the DLP policy apply to other integrated SASE solutions but not to Global Secure Access.
196
+> The actions you select in the Purview DLP rule should match the content types and activities you selected in the Global Secure Access content policy. For text inspection scenarios, include the applicable text actions in the Purview DLP rule.
193197
194198
For a detailed walkthrough with example configurations, see [Use Network Data Security to help prevent sharing sensitive information with unmanaged AI](/purview/dlp-create-policy-ai-network-data-security).
195199
196200
## Test the content policy
197
−Test the configuration by attempting to upload or download files that match the content policy conditions. Verify that the policy settings block or allow the actions.
201
+Test the configuration by attempting to upload or download files, or send text content, that matches the content policy conditions. Verify that the policy settings audit or block the actions.
198202
203
+### Example: Block sensitive text sent through Gmail
204
+
205
+This example walks through an end-to-end test scenario that blocks text containing sensitive data, such as credit card numbers or Social Security numbers, from being sent in a Gmail message body.
206
+
207
+#### Step 1: Configure the content policy destination
208
+
209
+When you create or edit your content policy rule, configure the following settings:
210
+
211
+- **Action**: Select **Scan with Purview** (preview).
212
+- **Activities**: Select **Upload**.
213
+- **Text content types**: Select the text content types that you want Microsoft Purview to inspect.
214
+- **Destination**: Add `mail.google.com` as an FQDN.
215
+
216
+For text-only scenarios, you don't need to select a file content type.
217
+
218
+#### Step 2: Configure a Purview DLP policy
219
+
220
+If you select **Scan with Purview** as the content policy action, you must also configure a corresponding Microsoft Purview DLP policy to inspect the text content and make the audit or block decision.
221
+
222
+1. In the [Microsoft Purview portal](https://purview.microsoft.com), create an **Inline web traffic** DLP policy.
223
+1. On the **Choose where to enforce the policy** page, ensure **Network and non-Microsoft secure browsers** is enabled.
224
+1. Configure the DLP rule to detect the sensitive information types you want to block, such as credit card numbers or Social Security numbers.
225
+1. Under **Actions**, select **Restrict browser and network activities**.
226
+1. Select **Text sent to or shared with cloud or AI apps** and set the action to **Block**.
227
+1. Configure incident reports and alert settings as needed.
228
+1. Save and apply the policy.
229
+
230
+#### Step 3: Validate the policy
231
+
232
+1. On a managed device with the Global Secure Access client installed, open a browser and go to [Gmail](https://mail.google.com).
233
+1. Create a message that contains sensitive data, such as sample credit card numbers or Social Security numbers.
234
+1. Attempt to send the message.
235
+1. Verify that the message is blocked.
236
+1. To confirm the block, check the traffic logs in the Microsoft Entra admin center under **Global Secure Access** > **Monitor** > **Traffic logs**.
237
+1. Review the corresponding alert or activity details in Microsoft Purview.
238
+
199239
### Example: Block sensitive PDF uploads to ChatGPT
200240
201241
This example walks through an end-to-end test scenario that blocks a PDF file containing sensitive data (such as credit card numbers or Social Security numbers) from being uploaded to ChatGPT.
⋯ 6 unchanged lines
208248
- `https://chatgpt.com/backend-api/files/process_upload_stream` (add as URL)
209249
- `*.oaiusercontent.com` (add as FQDN)
210250
211
−For **Content types**, select **PDF** (and other file types you want to inspect).
251
+For **Content types**, select **PDF** and other file types you want to inspect.
212252
213253
> [!TIP]
214254
> Web applications often use multiple URLs and FQDNs under the hood. Use browser developer tools or network traffic analysis to identify the correct upload endpoints for your target destination. For ChatGPT, the URLs listed here are the endpoints used for file upload operations.
215255
216256
#### Step 2: Configure a Purview DLP policy (for Scan with Purview action)
217257
218
−If you select **Scan with Purview** as the content policy action, you must also configure a corresponding Microsoft Purview DLP policy to inspect the file content and make the allow or deny decision.
258
+If you select **Scan with Purview** as the content policy action, you must also configure a corresponding Microsoft Purview DLP policy to inspect the file content and make the audit or block decision.
219259
220
−1. In the [Microsoft Purview portal](https://purview.microsoft.com).
260
+1. Sign in to the [Microsoft Purview portal](https://purview.microsoft.com).
221261
1. Follow the steps in [Use Network Data Security to help prevent sharing sensitive information with unmanaged AI](/purview/dlp-create-policy-ai-network-data-security#steps-to-create-policy) to create a new DLP policy.
222262
1. In the **Cloud apps** step, search for and add **ChatGPT**.
223263
1. Configure the DLP rule to detect the sensitive information types you want to block (for example, credit card numbers or Social Security numbers).
⋯ 2 unchanged lines
226266
227267
For more information about Purview DLP policies for network traffic, see [Learn about Microsoft Purview Network Data Security](/purview/dlp-network-data-security-learn).
228268
229
−> [!Note]
230
−> Network DLP with Global Secure Access integration is currently in preview. Global Secure Access forwards matching upload traffic to Microsoft Purview for content inspection. Purview evaluates the content against your DLP policy and returns an allow or deny decision. Global Secure Access then enforces the result.
269
+> [!NOTE]
270
+> Network DLP with Global Secure Access integration is currently in preview. Global Secure Access forwards matching upload traffic to Microsoft Purview for content inspection. Purview evaluates the content against your DLP policy and returns a decision based on your DLP rule action. Global Secure Access then enforces the result.
231271
232272
#### Step 3: Validate the policy
233273
⋯ 6 unchanged lines
240280
241281
## Known limitations
242282
243
−- Network content filtering doesn't support text. It only supports files.
283
+- Basic content policy doesn't inspect text. Text content type inspection requires **Scan with Purview** and a matching Purview DLP policy.
284
+- Network content filtering doesn't support User Datagram Protocol (UDP) traffic, including QUIC.
244285
- Compressed content is detected in ZIP format. The content isn't decompressed.
245286
- True file type detection might not be 100% accurate.
246
−- Destination applications that use WebSocket, such as Copilot, aren't supported.
247
−- Top level and second level domains don't support wildcards (like `*`, `*.com`, `*contoso.com`) while configuring FQDNs.
287
+- Top-level and second-level domains don't support wildcards (like `*`, `*.com`, `*contoso.com`) while configuring FQDNs.
288
+- Microsoft Purview network data security policies don't apply to B2B guest users.
248289
249290
## Monitoring and logging
250291
⋯ 21 unchanged lines
272313
- [Get started with the data loss prevention Alerts dashboard](/purview/dlp-alerts-dashboard-get-started)
273314
- [Get started with activity explorer](/purview/data-classification-activity-explorer)
274315
- [How to configure Global Secure Access web content filtering](how-to-configure-web-content-filtering.md)
275
−- [Enable the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md)
316
+- [Enable the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md)
276317
- [Configure Transport Layer Security inspection](how-to-transport-layer-security.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.