Internet Access web filtering (V2)

In V2, each rule carries its own action, and the policy defines a default action for traffic that doesn't match [removed: a] [added: an enabled enforcement] rule. Allow and Block [removed: produce an outcome.] [added: stop V2 web filtering evaluation.] The [removed: preview] Continue [removed: Evaluation] [added: default] action [added: (in preview)] passes evaluation to the web filtering policy in the next applicable security [removed: profile.] [added: profile, in profile-priority order. It doesn't pass evaluation to a different policy type, such as TLS inspection.]

Before: In V2, each rule carries its own action, and the policy defines a default action for traffic that doesn't match a rule. Allow and Block produce an outcome. The preview Continue Evaluation action passes evaluation to the web filtering policy in the next applicable security profile.

After: In V2, each rule carries its own action, and the policy defines a default action for traffic that doesn't match an enabled enforcement rule. Allow and Block stop V2 web filtering evaluation. The Continue default action (in preview) passes evaluation to the web filtering policy in the next applicable security profile, in profile-priority order. It doesn't pass evaluation to a different policy type, such as TLS inspection.

Aspect V1 (web content filtering) V2 (web filtering) Policies per security profile Multiple policies can be linked. Exactly one policy. Default action None. The policy acts only if a rule matches. Yes. Applied when no [added: enabled enforcement] rule matches. Allow and Block [removed: are terminal.] [added: stop V2 web filtering evaluation. The] Continue [removed: Evaluation is nonterminal and available in preview.] [added: default action (in preview) evaluates the next applicable web filtering policy.] Where the action is defined On the policy. Rules carry destinations only. On each rule, plus a policy default action.

Before: Aspect V1 (web content filtering) V2 (web filtering) Policies per security profile Multiple policies can be linked. Exactly one policy. Default action None. The policy acts only if a rule matches. Yes. Applied when no rule matches. Allow and Block are terminal. Continue Evaluation is nonterminal and available in preview. Where the action is defined On the policy. Rules carry destinations only. On each rule, plus a policy default action.

After: Aspect V1 (web content filtering) V2 (web filtering) Policies per security profile Multiple policies can be linked. Exactly one policy. Default action None. The policy acts only if a rule matches. Yes. Applied when no enabled enforcement rule matches. Allow and Block stop V2 web filtering evaluation. The Continue default action (in preview) evaluates the next applicable web filtering policy. Where the action is defined On the policy. Rules carry destinations only. On each rule, plus a policy default action.

Policy: A single web filtering policy contains one or more rules once configured. In V2, a security profile contains one web filtering policy. Each policy also defines a default action for traffic that doesn't match [removed: a] [added: an enabled enforcement] rule. The action can produce an Allow or Block outcome or [removed: continue evaluation with another] [added: use Continue to evaluate the web filtering policy in the next] applicable security profile.

Before: Policy: A single web filtering policy contains one or more rules once configured. In V2, a security profile contains one web filtering policy. Each policy also defines a default action for traffic that doesn't match a rule. The action can produce an Allow or Block outcome or continue evaluation with another applicable security profile.

After: Policy: A single web filtering policy contains one or more rules once configured. In V2, a security profile contains one web filtering policy. Each policy also defines a default action for traffic that doesn't match an enabled enforcement rule. The action can produce an Allow or Block outcome or use Continue to evaluate the web filtering policy in the next applicable security profile.

[added: Use Continue when you need independently managed web filtering policies to work together across security profiles. If no enabled enforcement rule matches in the current policy, Continue evaluates the web filtering policy in the next applicable security profile, in profile-priority order. Profiles without a V2 web filtering policy are skipped.]

Before: No saved wording on this side.

After: Use Continue when you need independently managed web filtering policies to work together across security profiles. If no enabled enforcement rule matches in the current policy, Continue evaluates the web filtering policy in the next applicable security profile, in profile-priority order. Profiles without a V2 web filtering policy are skipped.

[added: Continue is a policy default action, not a rule action. It doesn't allow or block traffic itself, change which profiles apply to the user, or move evaluation to another policy type. It isn't Continuous Access Evaluation (CAE).]

Before: No saved wording on this side.

After: Continue is a policy default action, not a rule action. It doesn't allow or block traffic itself, change which profiles apply to the user, or move evaluation to another policy type. It isn't Continuous Access Evaluation (CAE).

[added: For example, you can maintain separate Claude and ChatGPT override profiles instead of creating a profile for every combination of applications a user needs. Each profile contains its own V2 web filtering policy:]

Before: No saved wording on this side.

After: For example, you can maintain separate Claude and ChatGPT override profiles instead of creating a profile for every combination of applications a user needs. Each profile contains its own V2 web filtering policy:

[added: Security profile, in evaluation order Web filtering rules Default action Claude override Allow Claude destinations. Continue ChatGPT override Allow ChatGPT destinations. Continue Baseline Enterprise web filtering rules. Block]

Before: No saved wording on this side.

After: Security profile, in evaluation order Web filtering rules Default action Claude override Allow Claude destinations. Continue ChatGPT override Allow ChatGPT destinations. Continue Baseline Enterprise web filtering rules. Block

[added: Assign both override profiles to a user through Conditional Access, with the Claude profile at a higher priority than the ChatGPT profile. When the user visits ChatGPT, no rule in the Claude policy matches, so its Continue default action passes evaluation to the ChatGPT policy. The ChatGPT Allow rule matches and stops V2 web filtering evaluation. Traffic that matches neither override reaches the Baseline, which applies its rules or its Block default action.]

Before: No saved wording on this side.

After: Assign both override profiles to a user through Conditional Access, with the Claude profile at a higher priority than the ChatGPT profile. When the user visits ChatGPT, no rule in the Claude policy matches, so its Continue default action passes evaluation to the ChatGPT policy. The ChatGPT Allow rule matches and stops V2 web filtering evaluation. Traffic that matches neither override reaches the Baseline, which applies its rules or its Block default action.

[added: A matching Allow or Block rule, or an Allow or Block default action, stops V2 web filtering evaluation before later profiles. The Baseline is a final fallback, not an additional check after an earlier Allow. It evaluates last and can't use Continue because it must produce an Allow or Block outcome. Existing policies aren't changed automatically; select Continue on each policy that needs this behavior.]

Before: No saved wording on this side.

After: A matching Allow or Block rule, or an Allow or Block default action, stops V2 web filtering evaluation before later profiles. The Baseline is a final fallback, not an additional check after an earlier Allow. It evaluates last and can't use Continue because it must produce an Allow or Block outcome. Existing policies aren't changed automatically; select Continue on each policy that needs this behavior.

[added: Important An Allow outcome stops V2 web filtering evaluation, but it doesn't override a V1 Block when both models are configured. For more information, see How evaluation works across V1 and V2.]

Before: No saved wording on this side.

After: Important An Allow outcome stops V2 web filtering evaluation, but it doesn't override a V1 Block when both models are configured. For more information, see How evaluation works across V1 and V2.

On the Policy settings tab, you set the Default action, which is the predefined behavior applied when no [removed: rules] [added: enabled enforcement rule] in the policy match[added: es]. You can set the default action to Allow, Block, or [removed: Continue Evaluation.] [added: Continue.]

Before: On the Policy settings tab, you set the Default action, which is the predefined behavior applied when no rules in the policy match. You can set the default action to Allow, Block, or Continue Evaluation.

After: On the Policy settings tab, you set the Default action, which is the predefined behavior applied when no enabled enforcement rule in the policy matches. You can set the default action to Allow, Block, or Continue.

Note [added: The] Continue [removed: Evaluation is available in preview. When no rule matches, it evaluates] [added: default action (in preview) passes evaluation to] the web filtering policy in the next applicable security profile in profile-priority [removed: order.] [added: order when no enabled enforcement rule matches.] You can't use Continue [removed: Evaluation] for the Baseline Profile because the Baseline Profile evaluates last and must produce an Allow or Block outcome.

Before: Note Continue Evaluation is available in preview. When no rule matches, it evaluates the web filtering policy in the next applicable security profile in profile-priority order. You can't use Continue Evaluation for the Baseline Profile because the Baseline Profile evaluates last and must produce an Allow or Block outcome.

After: Note The Continue default action (in preview) passes evaluation to the web filtering policy in the next applicable security profile in profile-priority order when no enabled enforcement rule matches. You can't use Continue for the Baseline Profile because the Baseline Profile evaluates last and must produce an Allow or Block outcome.

V2 can compose enforcement across profiles: Set the default action to Continue [removed: Evaluation] on a non-Baseline policy to pass unmatched traffic to the web filtering policy in the next applicable security profile. A matching rule or an Allow or Block default action stops V2 web filtering evaluation.

Before: V2 can compose enforcement across profiles: Set the default action to Continue Evaluation on a non-Baseline policy to pass unmatched traffic to the web filtering policy in the next applicable security profile. A matching rule or an Allow or Block default action stops V2 web filtering evaluation.

After: V2 can compose enforcement across profiles: Set the default action to Continue on a non-Baseline policy to pass unmatched traffic to the web filtering policy in the next applicable security profile. A matching rule or an Allow or Block default action stops V2 web filtering evaluation.

Use Continue [removed: Evaluation] when independently managed V2 policies need to contribute in profile-priority order. You can also consolidate intended outcomes into one V2 policy with ordered rules when separate profile assignments aren't required.

Before: Use Continue Evaluation when independently managed V2 policies need to contribute in profile-priority order. You can also consolidate intended outcomes into one V2 policy with ordered rules when separate profile assignments aren't required.

After: Use Continue when independently managed V2 policies need to contribute in profile-priority order. You can also consolidate intended outcomes into one V2 policy with ordered rules when separate profile assignments aren't required.

… module runs first. It evaluates applicable security profiles in profile-priority order and skips profiles that don't contain a V2 web filtering policy. In each policy, a matched rule or an Allow or Block default action stops V2 evaluation. If no [added: enabled enforcement] rule matches and the default action is [removed: Continue Evaluation,] [added: Continue,] the module evaluates the web filtering policy in the next applicable security profile. The Baseline Profile evaluates last and produces a terminal outcome.

Before: … module runs first. It evaluates applicable security profiles in profile-priority order and skips profiles that don't contain a V2 web filtering policy. In each policy, a matched rule or an Allow or Block default action stops V2 evaluation. If no rule matches and the default action is Continue Evaluation, the module evaluates the web filtering policy in the next applicable security profile. The Baseline Profile evaluates last and produces a terminal outcome.

After: … module runs first. It evaluates applicable security profiles in profile-priority order and skips profiles that don't contain a V2 web filtering policy. In each policy, a matched rule or an Allow or Block default action stops V2 evaluation. If no enabled enforcement rule matches and the default action is Continue, the module evaluates the web filtering policy in the next applicable security profile. The Baseline Profile evaluates last and produces a terminal outcome.

Use the [removed: preview] Continue [removed: Evaluation] default action [added: (in preview)] on non-Baseline V2 policies that need to pass unmatched traffic to [removed: another] [added: the web filtering policy in the next] applicable security profile. Keep an Allow or Block default action on the Baseline Profile so evaluation always ends with a terminal outcome.

Before: Use the preview Continue Evaluation default action on non-Baseline V2 policies that need to pass unmatched traffic to another applicable security profile. Keep an Allow or Block default action on the Baseline Profile so evaluation always ends with a terminal outcome.

After: Use the Continue default action (in preview) on non-Baseline V2 policies that need to pass unmatched traffic to the web filtering policy in the next applicable security profile. Keep an Allow or Block default action on the Baseline Profile so evaluation always ends with a terminal outcome.

Use Continue [removed: Evaluation] to keep policies in separate security profiles and evaluate them in profile-priority order, or consolidate the required destinations and actions into one V2 policy and use rule priority to control evaluation order. V2 rules don't support individual user or group …

Before: Use Continue Evaluation to keep policies in separate security profiles and evaluate them in profile-priority order, or consolidate the required destinations and actions into one V2 policy and use rule priority to control evaluation order. V2 rules don't support individual user or group …

After: Use Continue to keep policies in separate security profiles and evaluate them in profile-priority order, or consolidate the required destinations and actions into one V2 policy and use rule priority to control evaluation order. V2 rules don't support individual user or group …