Internet Access network content filtering
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit cc15c36 · +36 −32 lines · also on GitHub
⋯ 2 unchanged lines
33
description: "Discover how to configure network content filtering with Global Secure Access to enforce data protection policies for files and text content in real time."
44
ms.topic: how-to
55
ms.date: 06/30/2026
6
−ms.reviewer: buzaher,shkhalid
6
+ms.reviewer: absinh
77
ms.custom: sfi-image-nochange
88
ai-usage: ai-assisted
99
⋯ 5 unchanged lines
1515
1616
Microsoft Entra Global Secure Access content policies provide real-time control over what users and agents share with generative AI applications, unmanaged cloud apps, and other internet destinations. These controls apply to content shared from managed endpoints through browsers, applications, add-ins, APIs, and more.
1717
**Basic content filtering** lets you block specific content types from being shared with selected destinations.
18
−**Scan with Purview** enables network data security by combining Microsoft Purview's data classification with identity-centric Global Secure Access policies. It inspects files and text for sensitive information and helps prevent data loss by blocking its sharing based on your Purview policies. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.
19
−
18
+**Scan with Purview** enables network data security by combining Microsoft Purview's data loss prevention (DLP) with identity-centric Global Secure Access policies. It inspects files and text for sensitive information and helps prevent data loss by blocking its sharing based on your *Purview DLP policies*. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.
2019
2120
### High-level architecture
2221
:::image type="content" source="media/how-to-network-content-filtering/network-content-filtering-architecture.png" alt-text="Diagram showing the architecture of network content filtering with Global Secure Access and Microsoft Purview." lightbox="media/how-to-network-content-filtering/network-content-filtering-architecture.png":::
⋯ 1 unchanged line
2423
This article explains how to create a content policy to filter internet traffic flowing through Global Secure Access.
2524
2625
> [!NOTE]
27
−> Basic content policy detects the file MIME type and enforces the **Allow** or **Block** action in Global Secure Access. Microsoft Purview is only involved when you choose **Scan with Purview**. Text content type inspection requires **Scan with Purview** and a corresponding Microsoft Purview DLP policy.
26
+> Basic content policy detects the file MIME type and text type in payload and enforces the **Allow** or **Block** action in Global Secure Access. Microsoft Purview is only involved when you choose **Scan with Purview**.
2827
28
+> [!CAUTION]
29
+> Use the **Block** action for HTML or JSON text types with caution. Web requests and responses commonly use HTML or JSON payloads, so blocking these text types can unintentionally block normal web and API traffic, including GET, POST, and PUT operations.
30
+
2931
## Supported scenarios
3032
31
−Network content filtering supports the following key scenarios and outcomes for HTTP/1.1 traffic:
32
−- Using **Basic content policy**, you can block files based on supported file MIME types.
33
−- Using the **Scan with Purview** action (preview) in content policy, you can audit and block selected file and text content based on:
33
+Network content filtering supports the following key scenarios and outcomes for HTTP/S traffic:
34
+- **Basic content filtering** is modeled in Content rule with action = **Allow** or **Block**. It lets you allow or block upload or download of files based on supported file MIME types. The same can be done for supported text types as well. This does not need Purview.
35
+- **Scan with Purview** is modeled in Content rule with action = **Scan with purview**. Using this, you can audit and block selected file and text content based on:
3436
- Microsoft Purview sensitivity labels
3537
- Sensitive content in files or text
3638
- The user's risk level
3739
- When you use **Scan with Purview**, you can generate Data Loss Prevention (DLP) admin alerts for rule matches.
3840
3941
> [!IMPORTANT]
40
−> Basic content policy doesn't inspect text. To inspect text sent to or received from cloud or AI apps, use **Scan with Purview** and configure the matching text activities in Microsoft Purview.
42
+> We recommend you to inspect text sent to or received from cloud or AI apps using **Scan with Purview** and configure the matching text activities in Microsoft Purview.
4143
4244
## Prerequisites
4345
⋯ 2 unchanged lines
4648
- Licensing for the product. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
4749
- A valid Microsoft Entra Internet Access license.
4850
- A valid Microsoft Purview license, required for **Scan with Purview** inspection.
49
− - Network data security requires Microsoft Purview pay-as-you-go billing to be configured before you create Purview collection or DLP policies. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
50
− - You can use basic content policy without a Purview license.
51
+ - You can use basic content filtering without a Purview license.
5152
- A user with the [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID to configure Global Secure Access settings.
5253
- A [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role to configure Conditional Access policies.
5354
- The Global Secure Access client requires a device (or virtual machine) that is either Microsoft Entra ID joined or Microsoft Entra ID Hybrid joined.
54
−- To use **web categories** as a content policy destination, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md).
55
+- To use **web categories** as a content policy destination, you must also configure any [web content filtering policy](how-to-configure-web-content-filtering.md).
5556
- User Datagram Protocol (UDP) traffic (that is, QUIC) isn't supported. Most websites support fallback to Transmission Control Protocol (TCP) when QUIC can't be established. For an improved user experience, you can deploy a Windows Firewall rule that blocks outbound UDP 443:
5657
5758
```powershell
⋯ 38 unchanged lines
9697
1. Add a new rule.
9798
1. Enter the **Rule name**, **Description**, **Priority**, and **Status** as appropriate.
9899
1. Select the appropriate option for the **Action** menu:
99
− - To configure a basic data policy, select **Allow** or **Block**.
100
− - To use data policies configured in Microsoft Purview, select **Scan with Purview** (preview).
100
+ - To configure a basic content filtering, select **Allow** or **Block**.
101
+ - To use data policies configured in Microsoft Purview, select **Scan with Purview**.
101102
:::image type="content" source="media/how-to-network-content-filtering/scan-with-purview.png" alt-text="Screenshot of the content rule screen with the Action menu expanded and the Scan with Purview option selected." lightbox="media/how-to-network-content-filtering/scan-with-purview.png":::
102103
1. For **Matching conditions**, select the appropriate **Activities** and **Content types**.
103
− - For basic content policy, select the file content types to allow or block.
104
+ - For basic **content filtering**, select the file content types to allow or block.
105
+ - (Optional) You can choose text type as well, but exercise caution as you should not end up blocking HTML or JSON text type that blocks your web traffic.
104106
- For **Scan with Purview**, select the file content types and text content types that you want Microsoft Purview to inspect. File content type selection is optional for text-only scenarios.
105107
:::image type="content" source="media/how-to-network-content-filtering/content-rule-content-types.png" alt-text="Screenshot of the Add Content Rule page showing the Matching conditions section with Activities set to Upload, and the Content types dropdown expanded with PDF selected." lightbox="media/how-to-network-content-filtering/content-rule-content-types.png":::
106108
1. (Optional) Configure the **Source type** condition (preview) to scope the rule by traffic origin. Select **Agent** to match traffic classified as AI agent traffic. Traffic that is not classified as agent traffic is treated as **User** traffic. If not configured, the rule applies to all traffic.
⋯ 16 unchanged lines
123125
1. Configure the link content policy:
124126
1. Select **+ Link a policy** > **Existing Content policy**.
125127
1. From the **Policy name** menu, select the content policy you created.
126
− 1. Keep the default values for **Position** and **State**.
128
+ 1. Keep the default values for **State**.
127129
1. Select **Add**.
128130
1. Close the security profile.
129131
⋯ 19 unchanged lines
149151
150152
If you selected the **Scan with Purview** action in your content policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on file and text content that Global Secure Access routes for inspection.
151153
152
−> [!IMPORTANT]
153
−> The **Scan with Purview** integration for Global Secure Access is currently in preview.
154
−> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
155
−
156
−### Prerequisites for Purview integration
157
−
158
−- Microsoft Purview pay-as-you-go billing configured for your tenant. You must configure pay-as-you-go billing before you set up Microsoft Purview collection or DLP policies for network data security. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
159
−
160154
> [!NOTE]
161155
> If you don't see **Data loss prevention** in Microsoft Purview, your account might not have the required permissions or your tenant might not have the required licensing. You need a role such as **DLP Compliance Management** or **Information Protection Admin**, and a Microsoft 365 E5/A5 subscription or a Microsoft Purview DLP add-on. For more information, see [Permissions in the Microsoft Purview portal](/purview/purview-permissions).
162156
⋯ 10 unchanged lines
173167
1. On the **Adaptive app scopes** tab, choose the app categories you want to protect against (for example, **All unmanaged AI apps**).
174168
1. Select **Add**.
175169
1. Select **Next**.
176
−1. On the **Choose where to enforce the policy** page, ensure **Network and non-Microsoft secure browsers** is enabled, then select **Next**. You can only select network enforcement when pay-as-you-go billing is set up. For more information, see [Learn about Microsoft Purview billing models](/purview/purview-billing-models).
170
+1. On the **Choose where to enforce the policy** page, ensure **Network and non-Microsoft secure browsers** is enabled, then select **Next**.
177171
1. Select **Create or customize advanced DLP rules** and select **Next**.
178172
1. Select **+ Create rule** and configure the rule:
179173
1. Enter a **Name** and optional description.
⋯ 16 unchanged lines
196190
197191
For a detailed walkthrough with example configurations, see [Use Network Data Security to help prevent sharing sensitive information with unmanaged AI](/purview/dlp-create-policy-ai-network-data-security).
198192
199
−## Test the content policy
193
+## Test the network content filtering with Purview
200194
Test the configuration by attempting to upload or download files, or send text content, that matches the content policy conditions. Verify that the policy settings audit or block the actions.
201195
202196
### Example: Block sensitive text sent through Gmail
⋯ 4 unchanged lines
207201
208202
When you create or edit your content policy rule, configure the following settings:
209203
210
−- **Action**: Select **Scan with Purview** (preview).
204
+- **Action**: Select **Scan with Purview**.
211205
- **Activities**: Select **Upload**.
212206
- **Text content types**: Select the text content types that you want Microsoft Purview to inspect.
213207
- **Destination**: Add `mail.google.com` as an FQDN.
⋯ 52 unchanged lines
266260
For more information about Purview DLP policies for network traffic, see [Learn about Microsoft Purview Network Data Security](/purview/dlp-network-data-security-learn).
267261
268262
> [!NOTE]
269
−> Network DLP with Global Secure Access integration is currently in preview. Global Secure Access forwards matching upload traffic to Microsoft Purview for content inspection. Purview evaluates the content against your DLP policy and returns a decision based on your DLP rule action. Global Secure Access then enforces the result.
263
+> Global Secure Access forwards matching upload traffic to Microsoft Purview for content inspection. Purview evaluates the content against your DLP policy and returns a decision based on your DLP rule action. Global Secure Access then enforces the result.
270264
271265
#### Step 3: Validate the policy
272266
⋯ 6 unchanged lines
279273
280274
## Known limitations
281275
282
−- Basic content policy doesn't inspect text. Text content type inspection requires **Scan with Purview** and a matching Purview DLP policy.
276
+- Network content filtering is supported with the Internet access profile only
283277
- Network content filtering doesn't support User Datagram Protocol (UDP) traffic, including QUIC.
284
−- Compressed content is detected in ZIP format. The content isn't decompressed.
285
−- True file type detection might not be 100% accurate.
286
−- Top-level and second-level domains don't support wildcards (like `*`, `*.com`, `*contoso.com`) while configuring FQDNs.
287
−- Microsoft Purview network data security policies don't apply to B2B guest users.
278
+- When using web categories as destinations within Content rules, you must have a web filtering policy in place applied to one or more web categories (allow or block).
279
+- When using wildcards (*) in Content rule destinations, they cannot be used for top-level domains (TLD) or second-level domains (SLD). For example, *.contoso.com is supported, however *.com and contoso.* are not supported.
280
+- File detection is limited to files transferred as request/response bodies unencoded and with multipart encoding. Certain file transfer methods may prevent inspection, such as if an application encodes a file within a JSON, or the file is broken up into multiple encrypted requests.
281
+- WebSocket traffic bypasses content-type filtering in Content policy rules. When destination and activity conditions are met, the rule is evaluated regardless of the configured content type.
282
+- Requests are subject to rate limiting based on usage. When limits are exceeded, traffic is automatically blocked (fail-closed).
283
+
284
+
285
+### Known limitations for Scan with Purview include:
286
+
287
+- The maximum supported content size for Scan with Purview is 3 MB for both file and text content types.
288
+- OCR is not yet supported for traffic sent to Purview.
289
+- Scan with Purview only applies to traffic associated with an Entra user identity. Traffic that cannot be mapped to an Entra user identity is not sent to Purview for inspection.
290
+- In scenarios where Purview inspection is unable to complete, such as a payload that is too large to inspect, an unsupported codec, or an internal error, the traffic is allowed (fail-open). Transactions that have skipped inspection can be identified in Traffic logs using **PurviewStatus** field.
291
+
288292
289293
## Monitoring and logging
290294
⋯ 26 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:35 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.