Internet Access web filtering (V2)
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit dd4318a · +5 −5 lines · also on GitHub
⋯ 34 unchanged lines
3535
The two models also differ in where the action lives and in how they behave when no rule matches:
3636
3737
- In V1, a policy has no default action. It acts only when one of its rules matches, and the action is defined on the policy while its rules carry destinations only.
38
−- In V2, each rule carries its own action, and the policy defines a default action for traffic that doesn't match an enabled enforcement rule. **Allow** and **Block** stop V2 web filtering evaluation. The preview **Continue** default action passes evaluation to the web filtering policy in the next applicable security profile, in profile-priority order. It doesn't pass evaluation to a different policy type, such as TLS inspection.
38
+- In V2, each rule carries its own action, and the policy defines a default action for traffic that doesn't match an enabled enforcement rule. **Allow** and **Block** stop V2 web filtering evaluation. The **Continue** default action (in preview) passes evaluation to the web filtering policy in the next applicable security profile, in profile-priority order. It doesn't pass evaluation to a different policy type, such as TLS inspection.
3939
4040
The following table compares how policies are structured in each model.
4141
4242
| Aspect | V1 (web content filtering) | V2 (web filtering) |
4343
| --- | --- | --- |
4444
| Policies per security profile | Multiple policies can be linked. | Exactly one policy. |
45
−| Default action | None. The policy acts only if a rule matches. | Yes. Applied when no enabled enforcement rule matches. **Allow** and **Block** stop V2 web filtering evaluation. **Continue** evaluates the next applicable web filtering policy and is available in preview. |
45
+| Default action | None. The policy acts only if a rule matches. | Yes. Applied when no enabled enforcement rule matches. **Allow** and **Block** stop V2 web filtering evaluation. The **Continue** default action (in preview) evaluates the next applicable web filtering policy. |
4646
| Where the action is defined | On the policy. Rules carry destinations only. | On each rule, plus a policy default action. |
4747
4848
### FQDN destinations are handled as URLs
⋯ 20 unchanged lines
6969
7070
V2 web filtering rules don't currently support user or group targeting. Apply user and group assignments to the security profile through Conditional Access.
7171
72
−## Use the Continue default action (preview)
72
+## Use the Continue default action (in preview)
7373
7474
Use **Continue** when you need independently managed web filtering policies to work together across security profiles. If no enabled enforcement rule matches in the current policy, **Continue** evaluates the web filtering policy in the next applicable security profile, in profile-priority order. Profiles without a V2 web filtering policy are skipped.
7575
⋯ 23 unchanged lines
9999
- On the **Review** tab, you confirm the policy configuration before you create it.
100100
101101
> [!NOTE]
102
−> The **Continue** default action is available in preview. When no enabled enforcement rule matches, it evaluates the web filtering policy in the next applicable security profile in profile-priority order. You can't use **Continue** for the Baseline Profile because the Baseline Profile evaluates last and must produce an **Allow** or **Block** outcome.
102
+> The **Continue** default action (in preview) passes evaluation to the web filtering policy in the next applicable security profile in profile-priority order when no enabled enforcement rule matches. You can't use **Continue** for the Baseline Profile because the Baseline Profile evaluates last and must produce an **Allow** or **Block** outcome.
103103
104104
> [!NOTE]
105105
> A new policy is created without any rules. After you create the policy, add rules to define the destinations and actions it enforces.
⋯ 71 unchanged lines
177177
178178
### What if I rely on multiple security profiles?
179179
180
−Use the preview **Continue** default action on non-Baseline V2 policies that need to pass unmatched traffic to the web filtering policy in the next applicable security profile. Keep an **Allow** or **Block** default action on the Baseline Profile so evaluation always ends with a terminal outcome.
180
+Use the **Continue** default action (in preview) on non-Baseline V2 policies that need to pass unmatched traffic to the web filtering policy in the next applicable security profile. Keep an **Allow** or **Block** default action on the Baseline Profile so evaluation always ends with a terminal outcome.
181181
182182
### How do I create equivalent behavior in V2?
183183
⋯ 10 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 30 Oct 00:43 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.