Microsoft Entra Global Secure Access

Network Content Filtering

5 August 2026Updated+1 / −1 lines

In brief

The documentation now states that **Agent** matches traffic classified as AI agent traffic, while traffic not classified as agent traffic is treated as **User** traffic. If the condition is omitted, the rule applies to all traffic. The condition remains in preview.

What Entra admins need to know

Review existing or planned rules to ensure their source-type scope matches this clarified classification behavior.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

    - For basic content policy, select the file content types to allow or block.
    - For **Scan with Purview**, select the file content types and text content types that you want Microsoft Purview to inspect. File content type selection is optional for text-only scenarios.
    :::image type="content" source="media/how-to-network-content-filtering/content-rule-content-types.png" alt-text="Screenshot of the Add Content Rule page showing the Matching conditions section with Activities set to Upload, and the Content types dropdown expanded with PDF selected." lightbox="media/how-to-network-content-filtering/content-rule-content-types.png":::
1. (Optional) Configure the **Source type** condition (preview) to scope the rule by traffic origin. Select **Agent** to match traffic fromclassified as AI agents, suchagent traffic. Traffic that is not classified as Microsoft Copilot Studio agents and autonomous AI tools, oragent traffic is treated as **User** to match traffic from signed-in users, browsers, and applications. When a request doesn't originate from an AI agent, traffic is classified as **User**.traffic. If you don't configure a source type,not configured, the rule applies to all traffic.
1. Select **+ Add destination** and configure the destinations.
    - For application-specific control, you can add the exact URLs and related FQDNs that the app uses. Use browser developer tools or network traffic analysis to identify the endpoints used during file upload, text submission, or other protected traffic.
    - You can also select web categories as a destination. If you select web categories, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md).

@@ -105,7 +105,7 @@ To configure a content policy in Global Secure Access, complete the following st         - For basic content policy, select the file content types to allow or block.         - For **Scan with Purview**, select the file content types and text content types that you want Microsoft Purview to inspect. File content type selection is optional for text-only scenarios.         :::image type="content" source="media/how-to-network-content-filtering/content-rule-content-types.png" alt-text="Screenshot of the Add Content Rule page showing the Matching conditions section with Activities set to Upload, and the Content types dropdown expanded with PDF selected." lightbox="media/how-to-network-content-filtering/content-rule-content-types.png":::-    1. (Optional) Configure the **Source type** condition (preview) to scope the rule by traffic origin. Select **Agent** to match traffic from AI agents, such as Microsoft Copilot Studio agents and autonomous AI tools, or **User** to match traffic from signed-in users, browsers, and applications. When a request doesn't originate from an AI agent, traffic is classified as **User**. If you don't configure a source type, the rule applies to all traffic.+    1. (Optional) Configure the **Source type** condition (preview) to scope the rule by traffic origin. Select **Agent** to match traffic classified as AI agent traffic. Traffic that is not classified as agent traffic is treated as **User** traffic. If not configured, the rule applies to all traffic.     1. Select **+ Add destination** and configure the destinations.         - For application-specific control, you can add the exact URLs and related FQDNs that the app uses. Use browser developer tools or network traffic analysis to identify the endpoints used during file upload, text submission, or other protected traffic.         - You can also select web categories as a destination. If you select web categories, you must also configure a [web content filtering policy](how-to-configure-web-content-filtering.md).