Prisma Access and Microsoft Tenant Restrictions

gcollins5 — Thu, 26 Mar 2026 16:22:04 GMT

Hello All . Been wrestling with this for a week .

My starting point is to only allow connections to the entra joined domain for e,g, fred.onmicrosoft.com .

The rational is DLP - if I go to my browser and attempt to logon to another enterprise - dave.onmicrosoft.com it is blocked.

This is not consumer BTW - home tenants are blocked with the tenant restrictions I am about to describe...

For background , Entra has V1 & V2 implementations.

The palo method is :

Create a URL filter with the correct microsoft login domain .
Decrypt them
For V1 use header insertion -
- restrict-access-context : tenant value (login.microsoftoneline.com/login.microsoft.com/login windows.net )
- restrict-access-to-tenant : tenantvalue (same as above
- sec-restrict-tenant-access: restrict msa
V2 is just
- sec-restrict-tenant-access-policy : tenant value (same microsoft logins as above)

Then create a rule with a security profile with header & URl filter - restrict it to a test user !

Basically you decrypt microsoft logins an insert a header....

Test the logins from login.microsoftonline.com

You need to setup tenant restrictions on Entra with block inwards and outwards .

The idea is you pass the header to Entra and it decides whether you connect .

Problem is it doesnt work !

I can login to eberything...

The only way I have managed to get this to psuedo work is to use SaaS endpoint for M365 on a rule with no header insertion .

Only problem is - it stops the entra joined user greg@fred.onmicrosoft.com logging into dave@onmicrosoft.com

I doesnt stop dave@onmicrosoft.com from logging into dave@onmicrosoft.com which sort of deefats the object.

Did anyone get it working ????

Re: Prisma Access and Microsoft Tenant Restrictions

acsebav — Fri, 27 Mar 2026 18:28:02 GMT

You need to put Tenant ID value on "restrict-access-context".

P.S. Ensure you block QUIC.

gcollins5 — Mon, 30 Mar 2026 07:57:07 GMT

You need to put Tenant ID value on "restrict-access-context". - did you use the tenant name or the value from entra ?

I tried both with no result .

Quic is blocked already so I don't think it is that .

acsebav — Mon, 30 Mar 2026 08:13:15 GMT

The value from Entra "Tenant ID".