SaaS Application Restrictions

You can configure Saas Restrictions in the backend, from Settings → SaaS Restrictions menu.

When you have enabled a SaaS Restriction, according to the type of the application installed, DefensX extensions append a specific HTTP header to every request sent to the related cloud application.

For example, if you enabled GSuite restrictions and only provided to example.com as allowed domains, DefensX extensions append X-GooGApps-Allowed-Domains: example.com in every request to *.google.com and gmail.com. When Google GSuite receives a request from a client that is using this header, it stops working for domains other than the included ones in the received header (https://groups.google.com/g/k12appstech/c/B1fsGYePm34).

Similarly, Microsoft also has a feature to restrict access by Tenant ID or the domain itself (https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictions).

In order to enable Google GSuite restrictions, first toggle the checkbox on the right-hand side and enter your allowed domains into the list. You can enter as many domains as you want.

In order to enable Microsoft O365 restrictions, first toggle the checkbox on the right-hand side and enter your allowed domains or Azure Tenant ID values into the list. You can enter as many domains/tenant id as you want.