Internet Access web content filtering
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 72d07eb · +6 −8 lines · also on GitHub
⋯ 23 unchanged lines
2424
2525
Web content filtering also supports two optional rule conditions that enable traffic-aware policy enforcement:
2626
27
−- **Source traffic type filtering (preview)**: Scope rules to specific traffic types, such as agent, browser, or application.
27
+- **Source traffic type filtering (preview)**: Scope rules to specific traffic types, either agent or non-agent.
2828
- **HTTP method request filtering (preview)**: Block or allow specific HTTP methods, such as GET, POST, PUT, PATCH, and DELETE.
2929
3030
> [!TIP]
⋯ 47 unchanged lines
7878
7979
## Configure source traffic type filtering (preview)
8080
81
−Source traffic type filtering lets you scope web content filtering rules to specific types of network traffic. You can enforce differentiated policies based on whether traffic originates from an AI agent, a web browser, or an application.
81
+Source traffic type filtering lets you scope web content filtering rules to specific types of network traffic. You can enforce differentiated policies based on whether traffic originates from an AI agent or a non-agent source.
8282
8383
### Supported source traffic types
8484
8585
| Source type | Description |
8686
| --- | --- |
8787
| Agent | Traffic that originates from AI agents, such as Copilot agents or autonomous AI tools. |
88
−| Browser | Traffic that originates from web browsers. |
89
−| Application | Traffic that originates from desktop or mobile applications. |
90
−| Unknown | Traffic where the source type can't be determined. |
88
+| Non-agent | Traffic that originates from any source other than an AI agent, such as web browsers and applications. |
9189
9290
### Configure the source traffic type condition
9391
⋯ 5 unchanged lines
9997
> Source traffic type filtering is available only for client-based Global Secure Access connections. This capability depends on the Global Secure Access client sending task and processor metadata to classify traffic. Remote networks don't support source traffic type rules.
10098
10199
> [!NOTE]
102
−> When a request's traffic type can't be determined, traffic is classified as **Unknown**. Traffic-type-specific rules don't match unless you explicitly target **Unknown** in a rule.
100
+> When a request doesn't originate from an AI agent, traffic is classified as **Non-agent**. To match this traffic, explicitly target **Non-agent** in a rule.
103101
104102
### Example: Block AI agents from accessing social networking sites
105103
106
−To prevent AI agents from accessing social networking websites while allowing browser and application traffic:
104
+To prevent AI agents from accessing social networking websites while allowing non-agent traffic:
107105
108106
1. Create a web content filtering policy rule.
109107
1. Select the **SocialNetworking** web category.
110108
1. Enable **Source type** and select **Agent**.
111109
1. Set the policy action to **Block**.
112110
113
−This configuration blocks AI agent traffic to social networking sites while allowing browser and application users to access the same sites.
111
+This configuration blocks AI agent traffic to social networking sites while allowing non-agent traffic to access the same sites.
114112
115113
## Configure HTTP method request filtering (preview)
116114
⋯ 223 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.