Entra.News Dailydaily.entra.news
Aboutmerill.net
Microsoft Entra Global Secure Access

Universal Tenant Restrictions

22 July 2026Updated+9 / −53 lines

In brief

- They work with all Microsoft Entra-integrated third-party apps at the authentication plane during sign-in.

Documentation change

  • They work with all Microsoft Entra-integrated third-party apps at the authentication plane during sign-in.
  • They help protect Microsoft Graph.

Enforcement points for universal tenant restrictions

Supported scenarios

Authentication plane (Microsoft Entra ID)

Microsoft Entra ID

Authentication plane enforcement happens at the time of Microsoft Entra ID or Microsoft account authentication.

Enforcement of tenant restrictions happens at the time of Microsoft Entra ID or Microsoft account authentication. When the user is connected with the Global Secure Access client or via remote network connectivity, the tenant restrictions v2 policy is checked to determine if authentication should be allowed. If the user is signing in to the organization's tenant, the tenant restrictions v2 policy isn't applied. If the user is signing in to a different tenant, the policy is enforced. This works for any application that uses the Entra ID (Work/School account) or Microsoft Account as its identity provider.

When the user is connected with the Global Secure Access client or via remote network connectivity, the tenant restrictions v2 policy is checked to determine if authentication should be allowed. If the user is signing in to the organization's tenant, the tenant restrictions v2 policy isn't applied. If the user is signing in to a different tenant, the policy is enforced.

Microsoft Graph

Any application that's integrated with Microsoft Entra ID or that uses a Microsoft account for authentication supports universal tenant restrictions at the authentication plane.

Data plane (Microsoft Graph)

Data plane enforcement is currently supported for Microsoft Graph. Data plane protection ensures that imported authentication artifacts can't be replayed from your organization's devices to exfiltrate data. An example of such an artifact is an access token that's obtained on another device and bypasses authentication plane enforcements defined in your tenant restrictions v2 policy.

Tenant restrictions for Microsoft Graph ensures that tokens obtained on other devices can't be replayed from your organization's devices to exfiltrate data. If the malicious user signs in to their own tenant from their personal computer while connected to the public internet, extracts the access token for Microsoft Graph, and copies this token to their work device, tenant restrictions will block access with that token, since the token was not acquired from a trusted GSA network.

Prerequisites

For more information about configuring these policies, see Set up tenant restrictions v2.

Enable Global Secure Access signaling for tenant restrictions

Enable Universal Tenant Restrictions

After you create the tenant restriction v2 policies, you can use Global Secure Access to apply tagging for tenant restrictions v2. An administrator who has both the Global Secure Access Administrator and Security Administrator roles must take the following steps to enable enforcement with Global Secure Access:

|[email protected]|Member|northwindtraders.com|Yes|No (tenant not allowed by policy)| |bob_northwindtraders.com#EXT#@contoso.com|Guest|contoso.com|No (guest user)|Yes|

Validate the authentication plane protection

  1. Ensure that signaling for universal tenant restrictions is turned off in Global Secure Access settings.

  2. In a browser, go to the My Apps portal. Sign in with the identity from a tenant that's different from yours and that isn't on the allow list in a tenant restrictions v2 policy. You might need to use a private browser window and/or sign out of your primary account to perform this step.

    For example, if your tenant is Contoso, sign in as a Fabrikam user in the Fabrikam tenant. The Fabrikam user should be able to access the My Apps portal, because signaling for universal tenant restrictions is turned off in Global Secure Access.

Validate tenant restrictions enforcement

  1. Turn on universal tenant restrictions in the Microsoft Entra admin center.
  1. Turn on universal tenant restrictions in the Microsoft Entra Admin Center.
1. Go to **Global Secure Access** > **Settings** > **Session Management**.
1. On the **Universal Tenant Restrictions** tab, turn on the **Enable Tenant Restrictions for Microsoft Entra ID and Microsoft Graph** toggle.
  1. Sign out of the My Apps portal and restart your browser.
  1. With the Global Secure Access client running, go to the My Apps portal by using the same identity (in the preceding example, the Fabrikam user in the Fabrikam tenant).
  1. With the Global Secure Access client enabled and connected, go to the My Apps portal by using the same identity (in the preceding example, the Fabrikam user in the Fabrikam tenant).

You're blocked from authenticating to the My Apps portal. An error message like this one appears: "Access is blocked. The Contoso IT department has restricted which organizations can be accessed. Contact the Contoso IT department to gain access."

Validate the data plane protection

  1. Ensure that signaling for universal tenant restrictions is turned off in Global Secure Access settings.

  2. In a browser, go to Graph Explorer. Sign in with the identity from a tenant that's different from yours and that isn't on the allow list in a tenant restrictions v2 policy. To perform this step, you might need to use a private browser window and/or sign out of your primary account.

    For example, if your tenant is Contoso, sign in as a Fabrikam user in the Fabrikam tenant. The Fabrikam user should be able to access Graph Explorer, because signaling in tenant restrictions v2 is turned off in Global Secure Access.

  3. Optionally, in the same browser with Graph Explorer open, open Developer Tools by selecting F12 on the keyboard. Start capturing the network logs.

    You should see HTTP requests returning status 200 as you interact with Graph Explorer when everything is working as expected. For example, send a GET request to retrieve users in your tenant.

  4. Ensure that the Preserve log option is selected.

  5. Keep the browser window open with the logs.

  6. Turn on universal tenant restrictions in the Microsoft Entra admin center.

    1. Go to Global Secure Access > Settings > Session Management.
    2. On the Universal Tenant Restrictions tab, turn on the Enable Tenant Restrictions for Microsoft Entra ID and Microsoft Graph toggle.

  7. While you're signed in as the other user (the Fabrikam user in the preceding example), new logs appear in the browser with Graph Explorer open. The process might take a few minutes. Also, the browser might refresh itself, based on the request and responses happening in the back end. If the browser doesn't refresh itself after a couple of minutes, refresh the page.

    Your access is now blocked with this message: "Access is blocked. The Contoso IT department has restricted which organizations can be accessed. Contact the Contoso IT department to gain access."

  8. In the logs, look for a Status value of 302. This row shows universal tenant restrictions being applied to the traffic.

    In the same response, check the headers for the following information to confirm that universal tenant restrictions were applied:

    • Restrict-Access-Confirm: 1
    • x-ms-diagnostics: 2000020;reason="xms_trpid claim was not present but sec-tenant-restriction-access-policy header was in requires";error_category="insufficient_claims"

Known limitations

If you enabled universal tenant restrictions and you access the Microsoft Entra admin center for a tenant on the tenant restrictions v2 allow list, you might get an "Access denied" error. To correct this error, add the following feature flag to the Microsoft Entra admin center: ?feature.msaljs=true&exp.msaljsexp=true.