This article explains how to control access to SaaS apps tenants with the Tenant Restriction policy. For an overview of how Tenant Restriction rules control access using header injections, see Restricting Access to SaaS Application Tenants.
The Tenant Restriction policy lets you create rules to limit which tenants users can access for the apps allowed in your network. This helps you secure your network by preventing access to tenants besides your organization's tenant. For example, you can stop users from accessing their personal email account or file sharing account to help prevent leakage of sensitive data.
The Tenant Restriction rulebase controls user traffic headed to SaaS apps by changing the header fields in HTTP client requests. When traffic matches a rule, Cato acts as a proxy and injects the HTTP headers you defined for that rule. The third-party app receives the headers you specified, and then enforces your organization's tenant access policy for that app.
You can configure granular Tenant Restriction rules that apply to specific user groups, sites, or other sources. Granular rules can help you gradually implement tenant restrictions and avoid potential usability issues. You can also create rules that bypass tenant restrictions for specified sources.
The Tenant Restriction policy lets different admins edit the policy in parallel. Each admin can edit rules and save the changes to the rulebase in their own private revision, and then publish them to the account policy (the published revision). For more information on how to manage policy revisions, see Working with Policy Revisions.
-
For Tenant Restriction rules, you must enable TLS Inspection and define the TLS Inspection policy to inspect the traffic that matches the rule.
-
The Tenant Restriction feature is included in the CASB license. For more about purchasing the CASB license, please contact your Cato representative.
Enable the Tenant Restriction policy to create rules that control access to SaaS apps tenants.
When you add a rule to the Tenant Restriction policy, configure each section in the rule that is required to define the tenant access for that app.
Create a new Tenant Restriction rule and configure the rule's settings to implement tenant control for your organization. The Injected Headers fields can contain only the following characters:
-
Header Name - a-z, A-Z, 0-9, and special characters: _ and -
-
Header Value - a-z, A-Z, 0-9, and special characters: _ :;.,\/"'?!(){}[]@<>=-+*#$&`|~^&
To create a new Tenant Restriction rule:
-
From the navigation menu, select Security > App & Data Inline.
-
Select the Tenant Restriction tab.
-
Click New. The New Rule panel opens.
-
Enter a Name for the rule.
-
Configure the Position for the rule in the rulebase.
-
Expand Source and select the source type.
-
Select the type (for example: Host, Network Interface, IP, Any). The default value is Any.
-
When needed, select a specific object from the drop-down list for that type.
-
-
Select a SaaS Application from the drop-down menu.
-
Define each Header Name and Header Value for the configured application (see below for more information).
-
Select the Action for this rule. The options are Inject Headers and Bypass.
-
(Optional) Configure the Time options that define when this rule is enabled.
-
Click Save.
The changes are saved to your unpublished revision, and are available for editing until they are published or discarded.
The Header Name and Header Value fields define the app and the action the Tenant Restriction Policy enforces. These fields are specific to each app. Below are examples of required fields for commonly used apps. To ensure you have the latest information, we recommend checking the apps's documentation.
Microsoft 365 requires two headers to enforce tenant restrictions. Add the following two rules in this order. For more information, see the Microsoft documentation.
Slack requires two headers to enforce tenant restrictions. For more information, see the Slack documentation.
Add the following header and value to enforce tenant restrictions. For more information, see the Google documentation.
Add the following header and value to enforce tenant restrictions. For more information, see the Dropbox documentation.
0 comments
Article is closed for comments.