Important SSL decryption must be enabled at the Forcepoint Content Gateway proxy for the requests to the Office 365 application that the end-users access. Similarly, The WCG will not be able to insert the custom headers if either the Office365 SSL Decryption Bypass or Content Gateway Bypass features are enabled.

Phase 1 of the configuration

1. Configured the proxy with the tenant restriction to secure and preserve your access to your Microsoft O365 tenant.

2. The tenant rule can be modified to allow more tenants in the Restrict-Access-To-Tenants

The above configuration manages the client connection to the Microsoft SaaS tenant. 

For more information see Microsoft's documentation Tenant Restrictions.

To restrict Forcepoint Web Security Cloud hosted users to specific Office 365 Tenants please see steps in article Restrict users to specific Office 365 Tenants 

How to allow access to your organization’s Office 365 applications, while preventing access to other organizations’ instances of these same applications and restrict end-users from logging into accounts of Office 365 tenancies that do not belong to my organisation. I would like to control the access via Forcepoint Content Gateway proxy. 

Watch Video: Web Security Proxy Configurations for Microsoft Office 365 documenting the following steps:
 

For each incoming request to login.microsoftonline.com, login.microsoft.com, and login.windows.net, insert two HTTP headers: Restrict-Access-To-Tenants and Restrict-Access-Context.

1. Browse to Configure > Security > Access Control > Filtering in the Forcepoint Content Gateway manager.
2. Click the Edit File button. A new tab will open.
3. Set Rule Type to add_hdr.
4. Set Primary Destination Value to login.microsoftonline.com then login.microsoft.com and then login.windows.net, you need to repeat this configuration for each domain (login.microsoft.com).
5. Under Additional Specifiers:
   • Set Custom Header to Restrict-Access-To-Tenants.
   • Set Header Value to tenant1.onmicrosoft.com,tenant2.onmicrosoft.com only if you would like to restrict connection to two tenants.
6. Set Rule Type to add_hdr.
7. Set Primary Destination Value to login.microsoftonline.com then login.microsoft.com and then login.windows.net, you need to repeat this configuration for each domain (login.microsoft.com).
8. Under Additional Specifiers:
   • Set Customer Header to Restrict-Access-Context= 
   • Set Header Value to 456ff232-35l2-5h23-b3b3-3236w0826f3d - this content string has to be your organization directory ID.
9. You can add any Secondary Specifiers which are optional, as an example you can restrict the configuration to a specific range of user by IPs, or even a single IP address.
   • Uses Range format, not CIDR.
   • Example: 1.1.1.1 or 0.0.0.0-255.255.255.255 
10. Click Add and then Apply.

 

• A general rule should look like below:

• Example of both domains

• Example of an additional secondary specifier

• Example for Restrict-Access-Context