Daily.Entra.News
Aboutmerill.net
Microsoft Entra Global Secure Access

Universal Tenant Restrictions

22 July 2026Updated+9 / −53 lines

In brief

- They work with all Microsoft Entra-integrated third-party apps at the authentication plane during sign-in.

What Entra admins need to know

Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

  • They work with all Microsoft Entra-integrated third-party apps at the authentication plane during sign-in.
  • They help protect Microsoft Graph.

Supported scenarios

Microsoft Entra ID

Enforcement points for universalof tenant restrictions

Authentication plane (Microsoft Entra ID)

Authentication plane enforcement happens at the time of Microsoft Entra ID or Microsoft account authentication.

When the user is connected with the Global Secure Access client or via remote network connectivity, the tenant restrictions v2 policy is checked to determine if authentication should be allowed. If the user is signing in to the organization's tenant, the tenant restrictions v2 policy isn't applied. If the user is signing in to a different tenant, the policy is enforced.

Any This works for any application that's integrated with Microsoft uses the Entra ID (Work/School account) or that uses a Microsoft account for authentication supports universal tenant restrictions at the authentication plane.Account as its identity provider.

Data plane (Microsoft Graph)Microsoft Graph

Data plane enforcement is currently supportedTenant restrictions for Microsoft Graph. Data plane protectionGraph ensures that imported authentication artifactstokens obtained on other devices can't be replayed from your organization's devices to exfiltrate data. An example of such an artifact is anIf the malicious user signs in to their own tenant from their personal computer while connected to the public internet, extracts the access token that's obtained on another devicefor Microsoft Graph, and bypasses authentication plane enforcements defined in yourcopies this token to their work device, tenant restrictions v2 policy.will block access with that token, since the token was not acquired from a trusted GSA network.

Prerequisites

For more information about configuring these policies, see Set up tenant restrictions v2.

Enable Global Secure Access signaling for tenant restrictionsUniversal Tenant Restrictions

After you create the tenant restriction v2 policies, you can use Global Secure Access to apply tagging for tenant restrictions v2. An administrator who has both the Global Secure Access Administrator and Security Administrator roles must take the following steps to enable enforcement with Global Secure Access:

|[email protected]|Member|northwindtraders.com|Yes|No (tenant not allowed by policy)| |bob_northwindtraders.com#EXT#@contoso.com|Guest|contoso.com|No (guest user)|Yes|

Validate the authentication plane protection

  1. Ensure that signaling for universal tenant restrictions is turned off in Global Secure Access settings.

  2. In a browser, go to the My Apps portal. Sign in with the identity from a tenant that's different from yours and that isn't on the allow list in a tenant restrictions v2 policy. You might need to use a private browser window and/or sign out of your primary account to perform this step.

    For example, if your tenant is Contoso, sign in as a Fabrikam user in the Fabrikam tenant. The Fabrikam user should be able to access the My Apps portal, because signaling for universal tenant restrictions is turned off in Global Secure Access.

    3. enforcement

    1. Turn on universal tenant restrictions in the Microsoft Entra admin center.Admin Center.

      1. Go to Global Secure Access > Settings > Session Management.
      2. On the Universal Tenant Restrictions tab, turn on the Enable Tenant Restrictions for Microsoft Entra ID and Microsoft Graph toggle.

    2. Sign out of the My Apps portal and restart your browser.

    3. With the Global Secure Access client running,enabled and connected, go to the My Apps portal by using the same identity (in the preceding example, the Fabrikam user in the Fabrikam tenant).

      You're blocked from authenticating to the My Apps portal. An error message like this one appears: "Access is blocked. The Contoso IT department has restricted which organizations can be accessed. Contact the Contoso IT department to gain access."

    Validate the data plane protection

    1. Ensure that signaling for universal tenant restrictions is turned off in Global Secure Access settings.

    2. In a browser, go to Graph Explorer. Sign in with the identity from a tenant that's different from yours and that isn't on the allow list in a tenant restrictions v2 policy. To perform this step, you might need to use a private browser window and/or sign out of your primary account.

      For example, if your tenant is Contoso, sign in as a Fabrikam user in the Fabrikam tenant. The Fabrikam user should be able to access Graph Explorer, because signaling in tenant restrictions v2 is turned off in Global Secure Access.

    3. Optionally, in the same browser with Graph Explorer open, open Developer Tools by selecting F12 on the keyboard. Start capturing the network logs.

      You should see HTTP requests returning status 200 as you interact with Graph Explorer when everything is working as expected. For example, send a GET request to retrieve users in your tenant.

    4. Ensure that the Preserve log option is selected.

    5. Keep the browser window open with the logs.

    6. Turn on universal tenant restrictions in the Microsoft Entra admin center.

      1. Go to Global Secure Access > Settings > Session Management.
      2. On the Universal Tenant Restrictions tab, turn on the Enable Tenant Restrictions for Microsoft Entra ID and Microsoft Graph toggle.

    7. While you're signed in as the other user (the Fabrikam user in the preceding example), new logs appear in the browser with Graph Explorer open. The process might take a few minutes. Also, the browser might refresh itself, based on the request and responses happening in the back end. If the browser doesn't refresh itself after a couple of minutes, refresh the page.

      Your access is now blocked with this message: "Access is blocked. The Contoso IT department has restricted which organizations can be accessed. Contact the Contoso IT department to gain access."

    8. In the logs, look for a Status value of 302. This row shows universal tenant restrictions being applied to the traffic.

      In the same response, check the headers for the following information to confirm that universal tenant restrictions were applied:

      • Restrict-Access-Confirm: 1
      • x-ms-diagnostics: 2000020;reason="xms_trpid claim was not present but sec-tenant-restriction-access-policy header was in requires";error_category="insufficient_claims"

    Known limitations

    If you enabled universal tenant restrictions and you access the Microsoft Entra admin center for a tenant on the tenant restrictions v2 allow list, you might get an "Access denied" error. To correct this error, add the following feature flag to the Microsoft Entra admin center: ?feature.msaljs=true&exp.msaljsexp=true.