03-26-2026 09:22 AM
Hello All . Been wrestling with this for a week .
My starting point is to only allow connections to the entra joined domain for e,g, fred.onmicrosoft.com .
The rational is DLP - if I go to my browser and attempt to logon to another enterprise - dave.onmicrosoft.com it is blocked.
This is not consumer BTW - home tenants are blocked with the tenant restrictions I am about to describe...
For background , Entra has V1 & V2 implementations.
The palo method is :
Then create a rule with a security profile with header & URl filter - restrict it to a test user !
Basically you decrypt microsoft logins an insert a header....
Test the logins from login.microsoftonline.com
You need to setup tenant restrictions on Entra with block inwards and outwards .
The idea is you pass the header to Entra and it decides whether you connect .
Problem is it doesnt work !
I can login to eberything...
The only way I have managed to get this to psuedo work is to use SaaS endpoint for M365 on a rule with no header insertion .
Only problem is - it stops the entra joined user greg@fred.onmicrosoft.com logging into dave@onmicrosoft.com
I doesnt stop dave@onmicrosoft.com from logging into dave@onmicrosoft.com which sort of deefats the object.
Did anyone get it working ????
03-30-2026 12:57 AM
You need to put Tenant ID value on "restrict-access-context". - did you use the tenant name or the value from entra ?
I tried both with no result .
Quic is blocked already so I don't think it is that .
03-30-2026 01:13 AM
The value from Entra "Tenant ID".
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
