Microsoft Entra Global Secure Access
GeneralHow to configure custom HTTP headers in Global Secure Access
In brief
The documentation now states that custom headers are available only with Web Filtering (v2) policies and links to the related guidance.
What Entra admins need to know
Administrators configuring custom headers must account for the Web Filtering (v2) policy prerequisite.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select.
The most common use case is tenant restrictions for software as a service (SaaS) applications. Some popular SaaS services understand specific HTTP headers that identifies your organization's approved tenant or workspace in that service. When you add the HTTP header understood by the SaaS provider, the SaaS application allows access to your approved tenant and blocks access to consumer tenants or tenants from other organizations. You can also use header modification to add any custom header that a destination service expects, such as an identifier or policy tag.
@@ -2,7 +2,7 @@ title: How to configure custom HTTP headers in Global Secure Access description: "Add custom HTTP headers to outbound web requests with Global Secure Access web filtering policies to enforce tenant restrictions and configure other header-aware services." ms.topic: how-to-ms.date: 08/28/2026+ms.date: 09/16/2026 ms.reviewer: alexpav ms.author: alexpav ms.subservice: entra-internet-access@@ -14,6 +14,9 @@ ai-usage: ai-assisted Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select. +> [!NOTE]+> Custom headers are available only with Web Filtering (v2) policies. For more information, see [Web filtering in Global Secure Access (V2)](concept-web-filtering.md).+ The most common use case is tenant restrictions for software as a service (SaaS) applications. Some popular SaaS services understand specific HTTP headers that identifies your organization's approved tenant or workspace in that service. When you add the HTTP header understood by the SaaS provider, the SaaS application allows access to your approved tenant and blocks access to consumer tenants or tenants from other organizations. You can also use header modification to add any custom header that a destination service expects, such as an identifier or policy tag. > [!IMPORTANT]