Tenant Restrictions
Tenant Restrictions allow administrators to control which tenants of supported SaaS applications users can access. This feature prevents users from accessing personal or unauthorized accounts on platforms such as Microsoft Office 365, Google Workspace, GitHub, Claude, ChatGPT, Dropbox, and Slack, ensuring that only organization-approved tenants are reachable from the corporate network.
|
|
Note: Tenant Restrictions for GitHub, Claude (Anthropic), ChatGPT (OpenAI), Dropbox, and Slack are available in Early Availability (EA) only. To enable, contact Check Point Support. |
To view the Tenant Restrictions page, access the SASE Administrator Portal and click Internet Access > Tenant Restrictions.
Supported Applications
Tenant Restrictions supports these applications:
-
Microsoft Office 365
-
Google Workspace
-
GitHub
-
Claude (Anthropic)
-
ChatGPT (OpenAI)
-
Dropbox
-
Slack
Policy Table Columns
|
Column |
Description |
|---|---|
| Cloud Service |
Displays the cloud service for which the restriction is applied:
This column is auto-populated and cannot be edited. |
| Source |
Defines the groups or members the restriction applies to:
|
| Allowed Identifiers |
Specifies the tenant identifiers that users in the selected source are allowed to access. The accepted identifier format depends on the selected vendor. Examples for Microsoft Office 365:
See Allowed Identifiers below. |
Specify one or more domains explicitly in the allowed identifiers to ensure the restriction is applied as intended.
Allowed Identifiers
This table is the authoritative reference for identifier formats, modal titles, validation behavior, and limits.
|
Vendor |
Modal title |
Identifier format |
Max entries |
|---|---|---|---|
| Microsoft Office 365 |
Manage Tenant IDs & Domains |
Domain or Tenant ID (UUID). Formats supported:
|
Multiple |
| Google Workspace |
Manage Domains |
Domain only (Tenant ID GUIDs not supported). Example: contoso.com |
Multiple |
| GitHub |
Manage Enterprise IDs |
Numeric Enterprise ID only. This is NOT a domain or URL slug.
|
20 max |
| Claude (Anthropic) |
Organization ID |
Anthropic organization UUID from the Anthropic admin console. |
Single |
| ChatGPT (OpenAI) |
Workspace ID |
OpenAI workspace or organization ID. |
Single |
|
Dropbox |
Team ID |
Numeric Dropbox Business team ID |
Single |
| Slack |
Requester Workspace ID and Allowed Workspaces |
Requester workspace ID plus allowed workspace IDs. |
Multiple |
Configuration Requirements
To enable tenant restrictions enforcement, HTTPS Inspection must be enabled and traffic must not be bypassed. Restrictions do not apply to bypassed traffic.
Domains That Must Not Be Bypassed
|
Vendor |
Domains That Must Not Be Bypassed |
Vendor documentation |
|---|---|---|
| Microsoft Office 365 |
|
|
| Google Workspace |
*.google.com |
|
| GitHub |
|
|
| Claude (Anthropic) |
|
|
| ChatGPT (OpenAI) |
|
Contact OpenAI Enterprise support. |
| Dropbox |
*.dropbox.com |
|
| Slack |
*.slack.com |
|
|
Note: Each vendor has its own pre-requisites. Make sure to visit each vendor documentation to ensure proper restriction by the vendor. |
Rule Evaluation Model
Each vendor supports multiple Tenant Restriction rules. Rules are evaluated top-down. The first rule whose Source matches the requesting user is applied, and rule evaluation stops. Later rules are not checked.
If no rule matches the user, no Tenant Restriction headers are injected. Access to the vendor is unrestricted for that user.
Note - Rule order is important. Place more specific rules (scoped to a Group or Member) above broader rules (scoped to Any). Specific rules placed below a catch-all rule are never reached.
Rule Fields
|
Field |
Description |
|---|---|
| Name | Administrator-defined label for the rule (for example, Executive Team, Corporate Catch-all). The name appears in activity logs when the rule is matched. |
| Source | The user scope of the rule. Select Any for all users, or scope to specific Groups or Members. |
| Allowed Identifiers | The tenant identifiers permitted for users matched by this rule. The format is vendor-specific. See Allowed Identifiers. |
|
Status |
Per-rule toggle to enable or disable the rule. Disabled rules are skipped during evaluation, but remain configured. |
Evaluation Example
The following example shows how a Microsoft Office 365 policy with three rules is evaluated for different users:
|
Rule Name |
Source |
Allowed Tenants |
Who it Applies To |
|---|---|---|---|
| M&A Team | M&A Group |
contoso.com, acme-target.com |
M&A group members can access both tenants. |
| Executives | Exec Group |
contoso.com, plus personal accounts allowed |
Executives can access the corporate tenant and personal Microsoft accounts. |
| Catch-all | Any |
contoso.com |
All other users can access only the corporate tenant. |
In this example, an M&A team member matches Rule 1 and is granted access to both tenants. Rules 2 and 3 are not evaluated for that user. A user who is not in the M&A group or the Executive group falls through to Rule 3.
Creating a Tenant Restriction
-
Access the SASE Administrator Portal and click Internet Access > Tenant Restrictions.
-
Click the vendor to configure.
-
Click Add Rule.
-
In the Name field, enter a name for the rule.
-
In the Source field, select Any, or add specific Groups or Members.
The Manage Groups and Members window appears.
-
Select the required groups or members and click Apply.
-
In the Allowed Identifiers field, enter the permitted tenant identifiers for this vendor. See Vendor-Specific Field Requirements.
-
To activate the rule, turn on the Status toggle.
-
Click Apply.
Vendor-Specific Field Requirements
Each vendor uses a specific field label and input format in the Allowed Identifiers column:
|
Vendor |
Field Label in UI |
What to Enter |
|---|---|---|
| Microsoft Office 365 |
Manage Tenant IDs & Domains |
Comma-separated list of allowed tenant domains or IDs. Optionally enable Block Microsoft Personal Accounts to prevent sign-in with personal Microsoft accounts while the listed tenant IDs/domains remain permitted.
|
| Google Workspace |
Manage Domains |
Comma-separated list of allowed domains (for example, company.com). Optionally enable Block Google Personal Accounts to prevent sign-in with personal Google accounts while the listed domains remain permitted.
|
| GitHub |
Manage Enterprise IDs |
Numeric GitHub Enterprise ID only. Example: 576354. Found in GitHub Enterprise settings. Enter one value at a time. Maximum 20 entries. |
| Claude (Anthropic) |
Organization ID |
Your Anthropic organization UUID, found in the Anthropic admin console. |
| ChatGPT (OpenAI) |
Workspace ID |
Your OpenAI workspace or organization ID. |
|
Dropbox |
Team ID |
Your Dropbox for Business team ID (numeric). |
| Slack |
Requester Workspace ID + Allowed Workspaces |
Enter your organization's Slack workspace ID in the Requester field. Then add the workspace IDs users are permitted to access. |
Reordering Rules
Rules are evaluated top-down. More specific group rules must be placed above broader catch-all rules.
To change the order of rules:
-
Open the vendor detail page.
-
Drag a rule row to the required position using the drag handle on the left.
Changes take effect after saving.
Enabling or Disabling a Vendor
Each vendor can be independently enabled or disabled. To enable or disable a vendor from the list, use the toggle in the vendor row.
|
|
Notes:
|
End User Behavior
When Tenant Restrictions are enabled, users experience these behaviors based on their actions:
|
Scenario |
User Experience |
|---|---|
| User accesses an allowed tenant | Access proceeds normally. |
| User accesses a disallowed tenant | A block page is displayed by the SaaS application (for example, Microsoft Office 365 and Google Workspace), indicating that access is not permitted. |
| User accesses another SaaS application | No restriction is enforced, and access is allowed (for example, Salesforce and Atlassian). |
|
User accesses a GitHub enterprise not in the allowed Enterprise IDs list |
GitHub displays: “Your network administrator has blocked access to GitHub except for the [enterprise name].” Access is denied across all supported channels: git operations, GitHub CLI, and GraphQL API. |
Tenant Restriction Logs
When a user attempts to sign in to a SaaS application using an account that does not belong to an allowed tenant, a blocking action is triggered by the relevant vendor and a log entry is generated on SASE. These logs help you identify unauthorized access attempts and policy gaps.
Logs are generated automatically. No additional configuration is required.
Logs examples:
-
Microsoft Office 365
-
Google Services
A single log entry is created for each blocked login attempt. Each entry includes:
-
User - The identity that attempted to sign in
-
Application - The SaaS application where the login was attempted
-
Restricted Identifier - The tenant identifier that the user attempted to access
-
Category - The URL category of the login endpoint
-
Policy Rule - The tenant restriction rule that blocked the attempt
-
Action - Blocked
-
Limitations
-
Logs are generated only for failed login attempts.
-
Successful logins to allowed tenants are not logged.