Microsoft Entra Global Secure Access
GeneralHow to configure custom headers
In brief
The article title and preview notice for configuring custom headers were removed.
What Entra admins need to know
Administrators will no longer see preview and prerelease warnings in this documentation; no action is required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
How to configure custom headers (preview)
Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select.
The most common use case is tenant restrictions for software as a service (SaaS) applications. Some popular SaaS services understand specific HTTP headers that identifies your organization's approved tenant or workspace in that service. When you add the HTTP header understood by the SaaS provider, the SaaS application allows access to your approved tenant and blocks access to consumer tenants or tenants from other organizations. You can also use header modification to add any custom header that a destination service expects, such as an identifier or policy tag.
How it works
When you create a web filtering policy version 2 (v2) rule, you select one or more destination FQDNs and define the custom headers to add. After you link the policy to a security profile, Global Secure Access adds the configured headers into matching outbound requests for users who are assigned that security profile. The destination service reads the header and applies its own tenant restriction or access logic.
How it works
When you create a web filtering policy version 2 (v2) rule, you select one or more destination FQDNs and define the custom headers to add. After you link the policy to a security profile, Global Secure Access adds the configured headers into matching outbound requests for users who are assigned that security profile. The destination service reads the header and applies its own tenant restriction or access logic.
@@ -9,7 +9,7 @@ ms.subservice: entra-internet-access ai-usage: ai-assisted --- -# How to configure custom headers (preview)+# How to configure custom headers Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select.@@ -19,9 +19,6 @@ Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to The most common use case is tenant restrictions for software as a service (SaaS) applications. Some popular SaaS services understand specific HTTP headers that identifies your organization's approved tenant or workspace in that service. When you add the HTTP header understood by the SaaS provider, the SaaS application allows access to your approved tenant and blocks access to consumer tenants or tenants from other organizations. You can also use header modification to add any custom header that a destination service expects, such as an identifier or policy tag. -> [!IMPORTANT]-> Header modification is currently in preview. This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.- ## How it works When you create a web filtering policy version 2 (v2) rule, you select one or more destination FQDNs and define the custom headers to add. After you link the policy to a security profile, Global Secure Access adds the configured headers into matching outbound requests for users who are assigned that security profile. The destination service reads the header and applies its own tenant restriction or access logic.