Tenant control

With Gateway tenant control, you can allow your users access to corporate SaaS applications while blocking access to personal applications. This helps prevent the loss of sensitive or confidential data from a corporate network.

When creating an HTTP policy with an Allow action, you will have the option to configure custom headers. Gateway can use custom headers to control SaaS application access. If a user’s HTTP request is headed to your organization’s account for the SaaS application, Gateway will approve the request. If the request does not match the information in the header, Gateway will block the request.

​​ Add custom headers for a SaaS application

To create an HTTP policy with custom headers:

1. In Zero Trust Open external link , go to Gateway > Firewall Policies. Select HTTP.
2. Select Add a policy.
3. Build an expression to match the SaaS traffic you want to control.
4. In Action, select Allow. In Untrusted certificate action, select Block.
5. Under Add headers to matched requests, select Add a header.
6. Add any custom header names and values corresponding to your SaaS application.
7. Select Create policy.

Your policy is now displayed in your list of HTTP policies. When your users attempt to authenticate your configured SaaS application with a personal account, authentication will fail.

​​ Common policy configurations

Depending on which SaaS application your organization needs access to, different tenant control policies are required.

​​ Microsoft 365

Microsoft 365 tenant control requires two policies. When you order your policies, make sure they follow order of precedence.

For more information, refer to the Microsoft Entra ID documentation Open external link .

​​ Google Workspace

For more information, refer to the Google Workspace documentation Open external link .

​​ Slack

For more information, refer to the Slack documentation Open external link .

​​ Dropbox

For more information, refer to the Dropbox documentation Open external link .

​​ Use tenant control with Browser Isolation

You can configure Browser Isolation to send custom headers. This is useful for implementing tenant control for isolated SaaS applications or sending arbitrary custom request headers to isolated websites.

To use custom headers with Browser Isolation, create two HTTP policies targeting the same domain or application group. For example, you can create policies for httpbin Open external link , an open-source site for testing HTTP requests:

1. Create an Isolate policy for httpbin.org.

   Selector	Operator	Value	Action
   Domain	in	httpbin.org	Isolate

2. Create an Allow policy for httpbin.org with a custom header.

   Selector	Operator	Value	Action
   Domain	in	httpbin.org	Allow

   Custom header name	Custom header value
   Example-Header	example-value

3. Go to httpbin.org/anything Open external link . Cloudflare will render the site in an isolated browser. Your custom header will appear in the list of headers.