{
  "format": "changeintel.gsa-web-filtering-v2",
  "graphShapeDocumented": false,
  "note": "Neutral review format. Create the rule in the Microsoft Entra admin center: Global Secure Access \u003E Secure \u003E Web Filtering Policies (V2).",
  "rules": [
    {
      "name": "ChangeIntel Defender for Cloud Apps portal",
      "action": "Allow",
      "destinations": [
        {
          "type": "url",
          "value": "cdn.cloudappsecurity.com",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "cdn-discovery.cloudappsecurity.com",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "adaproddiscovery.azureedge.net",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.s-microsoft.com",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of s-microsoft.com but not s-microsoft.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.msecnd.net",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of msecnd.net but not msecnd.net itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "dev.virtualearth.net",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "flow.microsoft.com",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "static2.sharepointonline.com",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.blob.core.windows.net",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of blob.core.windows.net but not blob.core.windows.net itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "discoveryresources-cdn-prod.cloudappsecurity.com",
          "purpose": "Portal access",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.us1.portal.cloudappsecurity.us",
          "purpose": "Gov US1",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/defender-cloud-apps/network-requirements#portal-access"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of us1.portal.cloudappsecurity.us but not us1.portal.cloudappsecurity.us itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        }
      ]
    }
  ],
  "notes": [
    "In V2 a security profile contains exactly one web filtering policy. Each rule carries its own Allow or Block action and the policy has a default action (Allow, Block, or the preview Continue Evaluation).",
    "V2 has no standalone FQDN type: FQDNs are expressed as URL destinations, and a URL destination matches the address and its sub-paths.",
    "A former exact-host FQDN evaluated with URL logic can match sub-paths of the address rather than only the exact host; review destinations to confirm they match the intended traffic.",
    "V2 runs before V1. A V2 Block is terminal; a V2 Allow isn\u0027t, so a V1 policy can still block the same traffic.",
    "Without TLS inspection, HTTPS traffic is evaluated by Server Name Indication (SNI); only unencrypted HTTP exposes the full URL."
  ]
}