Daily.Entra.News
Aboutmerill.net
Microsoft Entra Global Secure Access
Security

Network Content Filtering

25 September 2026Doc update+36 / −32 lines

In brief

The documentation now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It adds a warning that blocking HTML or JSON can disrupt normal web and API traffic, and updates the stated coverage from HTTP/1.1 to HTTP/S.

What Entra admins need to know

Review content rules carefully before blocking HTML or JSON text types, as this may affect GET, POST, and PUT traffic.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Entra Global Secure Access content policies provide real-time control over what users and agents share with generative AI applications, unmanaged cloud apps, and other internet destinations. These controls apply to content shared from managed endpoints through browsers, applications, add-ins, APIs, and more. Basic content filtering lets you block specific content types from being shared with selected destinations. Scan with Purview enables network data security by combining Microsoft Purview's data classificationloss prevention (DLP) with identity-centric Global Secure Access policies. It inspects files and text for sensitive information and helps prevent data loss by blocking its sharing based on your Purview policies.DLP policies. By combining content inspection with real-time user risk evaluation, you can enforce granular controls over sensitive data movement across the network without compromising user productivity or security posture.

High-level architecture

:::image type="content" source="media/how-to-network-content-filtering/network-content-filtering-architecture.png" alt-text="Diagram showing the architecture of network content filtering with Global Secure Access and Microsoft Purview." lightbox="media/how-to-network-content-filtering/network-content-filtering-architecture.png"::: This article explains how to create a content policy to filter internet traffic flowing through Global Secure Access.

Supported scenarios

Network content filtering supports the following key scenarios and outcomes for HTTP/S traffic:

  • Basic content filtering is modeled in Content rule with action = Allow or Block. It lets you allow or block upload or download of files based on supported file MIME types. The same can be done for supported text types as well. This does not need Purview.
  • Scan with Purview is modeled in Content rule with action = Scan with purview. Using this, you can audit and block selected file and text content based on:
    • Microsoft Purview sensitivity labels
    • Sensitive content in files or text
    • The user's risk level
  • When you use Scan with Purview, you can generate Data Loss Prevention (DLP) admin alerts for rule matches.

Prerequisites

  • Licensing for the product. For details, see the licensing section of What is Global Secure Access. If needed, you can purchase licenses or get trial licenses.

    • A valid Microsoft Entra Internet Access license.
    • A valid Microsoft Purview license, required for Scan with Purview inspection.
      • Network data security requires Microsoft Purview pay-as-you-go billing to be configured before you create Purview collection or DLP policies. For more information, see Learn about Microsoft Purview billing models.
      • You can use basic content policyfiltering without a Purview license.

  • A user with the Global Secure Access Administrator role in Microsoft Entra ID to configure Global Secure Access settings.

  • A Conditional Access Administrator role to configure Conditional Access policies.

  • The Global Secure Access client requires a device (or virtual machine) that is either Microsoft Entra ID joined or Microsoft Entra ID Hybrid joined.

  • To use web categories as a content policy destination, you must also configure aany web content filtering policy.

  • User Datagram Protocol (UDP) traffic (that is, QUIC) isn't supported. Most websites support fallback to Transmission Control Protocol (TCP) when QUIC can't be established. For an improved user experience, you can deploy a Windows Firewall rule that blocks outbound UDP 443: 

    1. Add a new rule.
1. Enter the **Rule name**, **Description**, **Priority**, and **Status** as appropriate.
1. Select the appropriate option for the **Action** menu:
    - To configure a basic data policy,content filtering, select **Allow** or **Block**.
    - To use data policies configured in Microsoft Purview, select **Scan with Purview** (preview).
        :::image type="content" source="media/how-to-network-content-filtering/scan-with-purview.png" alt-text="Screenshot of the content rule screen with the Action menu expanded and the Scan with Purview option selected." lightbox="media/how-to-network-content-filtering/scan-with-purview.png":::
1. For **Matching conditions**, select the appropriate **Activities** and **Content types**.
    - For basic **content policy,filtering**, select the file content types to allow or block.
        - (Optional) You can choose text type as well, but exercise caution as you should not end up blocking HTML or JSON text type that blocks your web traffic.
    - For **Scan with Purview**, select the file content types and text content types that you want Microsoft Purview to inspect. File content type selection is optional for text-only scenarios.
    :::image type="content" source="media/how-to-network-content-filtering/content-rule-content-types.png" alt-text="Screenshot of the Add Content Rule page showing the Matching conditions section with Activities set to Upload, and the Content types dropdown expanded with PDF selected." lightbox="media/how-to-network-content-filtering/content-rule-content-types.png":::
1. (Optional) Configure the **Source type** condition (preview) to scope the rule by traffic origin. Select **Agent** to match traffic classified as AI agent traffic. Traffic that is not classified as agent traffic is treated as **User** traffic. If not configured, the rule applies to all traffic.
  1. Configure the link content policy:
    1. Select + Link a policy > Existing Content policy.
    2. From the Policy name menu, select the content policy you created.
    3. Keep the default values for Position and State.
    4. Select Add.
  2. Close the security profile.

If you selected the Scan with Purview action in your content policy, you must configure a corresponding data loss prevention (DLP) policy in Microsoft Purview. The DLP policy defines how Purview classifies and acts on file and text content that Global Secure Access routes for inspection.

Prerequisites for Purview integration

  • Microsoft Purview pay-as-you-go billing configured for your tenant. You must configure pay-as-you-go billing before you set up Microsoft Purview collection or DLP policies for network data security. For more information, see Learn about Microsoft Purview billing models.
1. On the **Adaptive app scopes** tab, choose the app categories you want to protect against (for example, **All unmanaged AI apps**).
1. Select **Add**.
  1. Select Next.
  2. On the Choose where to enforce the policy page, ensure Network and non-Microsoft secure browsers is enabled, then select Next. You can only select network enforcement when pay-as-you-go billing is set up. For more information, see Learn about Microsoft Purview billing models.
  3. Select Create or customize advanced DLP rules and select Next.
  4. Select + Create rule and configure the rule:
    1. Enter a Name and optional description.

For a detailed walkthrough with example configurations, see Use Network Data Security to help prevent sharing sensitive information with unmanaged AI.

Test the network content policyfiltering with Purview

Test the configuration by attempting to upload or download files, or send text content, that matches the content policy conditions. Verify that the policy settings audit or block the actions.

Example: Block sensitive text sent through Gmail

When you create or edit your content policy rule, configure the following settings:

  • Action: Select Scan with Purview (preview).
  • Activities: Select Upload.
  • Text content types: Select the text content types that you want Microsoft Purview to inspect.
  • Destination: Add mail.google.com as an FQDN. For more information about Purview DLP policies for network traffic, see Learn about Microsoft Purview Network Data Security.

Step 3: Validate the policy

Known limitations

  • Network content filtering is supported with the Internet access profile only
  • Network content filtering doesn't support User Datagram Protocol (UDP) traffic, including QUIC.
  • When using web categories as destinations within Content rules, you must have a web filtering policy in place applied to one or more web categories (allow or block).
  • When using wildcards (*) in Content rule destinations, they cannot be used for top-level domains (TLD) or second-level domains (SLD). For example, *.contoso.com is supported, however .com and contoso. are not supported.
  • File detection is limited to files transferred as request/response bodies unencoded and with multipart encoding. Certain file transfer methods may prevent inspection, such as if an application encodes a file within a JSON, or the file is broken up into multiple encrypted requests.
  • WebSocket traffic bypasses content-type filtering in Content policy rules. When destination and activity conditions are met, the rule is evaluated regardless of the configured content type.
  • Requests are subject to rate limiting based on usage. When limits are exceeded, traffic is automatically blocked (fail-closed).

Known limitations for Scan with Purview include:

  • The maximum supported content size for Scan with Purview is 3 MB for both file and text content types.
  • OCR is not yet supported for traffic sent to Purview.
  • Scan with Purview only applies to traffic associated with an Entra user identity. Traffic that cannot be mapped to an Entra user identity is not sent to Purview for inspection.
  • In scenarios where Purview inspection is unable to complete, such as a payload that is too large to inspect, an unsupported codec, or an internal error, the traffic is allowed (fail-open). Transactions that have skipped inspection can be identified in Traffic logs using PurviewStatus field.

Monitoring and logging

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…