CASB - Blocking Microsoft Online Logins to Non-Company Domains
Updated 8 hours ago
by
admin
CASB uses the same Rules Engine as Web Security to control cloud application activity. A rule consists of Matches (the criteria to look for), Match Logic (how those criteria combine), and an Action (what happens when the rule triggers). This article shows how to combine a Keyword Category and a Specific Class, App, or Action match with AND logic so that only Microsoft Online logins carrying a @companydomain address are allowed, and every other Microsoft Online login attempt is blocked.
Rule Matches
Two matches are required for this rule, and both are added to the same rule so they can be ANDed together.
Keyword Category
A Keyword Category (built from a Keyword List) matches on the content of the request — in this case, the @companydomain domain string. Keyword Categories can themselves use AND or OR logic across their own patterns, independently of the logic used between matches on the rule.
Specific Class, App, or Action
This match type targets a specific entry from the App Catalog — a database of cloud Apps and the Actions available within them (for example, "Uploading a file" or "Posting a Tweet"). For this rule, the App is Microsoft Online/Office 365 and the Action is its login action, shown in the App Catalog as something like "Attempt to Login." Because the App Catalog is updated as new apps and actions are added, confirm the exact action label for Microsoft Online in your own dashboard before building the rule.
Rule Logic
Above the Selected Matches column on the rule, an AND/OR toggle controls how the added matches combine:
- AND — every match must be true at the same time for the rule to trigger
- OR — any single match being true is enough
Setting this to AND means the rule only fires when a Microsoft Online login attempt is seen and the request does not contain @companydomain — i.e. logins from that domain never satisfy the Keyword Category match, so the rule does not trigger for them and they pass through normally.
Rule Actions
With the Action set to Block, any Microsoft Online login attempt that matches both conditions is stopped and shown the configured block/response template. Only one action can be applied per rule.
Configuration Steps
Step 1: Create the Keyword Category
- Go to Security Modules → Global Settings → Keyword Lists.
- Click the green + button to create a new list.
- Set:
- Name:
M365 Allowed Domains - Match Logic:
Match Any Pattern - Match Content:
URL & App Action
- Name:
- Save the list, select it, and click the green + button again to add a pattern:
- Pattern:
@companydomain - Match Type:
Contains - Comment:
Matches company email domain for CASB login rule
- Pattern:
- Click Update to save.
Step 2: Create the CASB Rule
- Go to Security Modules → Web Security → Filter Rules.
- Click the green + button to create a new Block rule.
- Name it (e.g.
Block Microsoft Login – Non-Company Domain) and set a Priority that places it correctly relative to your other rules — in particular, ahead of any existing Office 365 allow rule, or this rule will never be evaluated.
- Select the required Condition(s)
- From the Matches panel, drag both of the following into the Selected Matches column and configure each (gear icon):
- Keyword Category → the
M365 Allowed Domainslist created above, then select the Switch logic icon
; the tile will turn red. - Specific Class:
Cloud Service - App:
Microsoft - Action:
Attempted to log in
- Keyword Category → the
- Set the match logic toggle above Selected Matches to AND.
- From the Actions panel, select the required Template.
- Enable the rule.
- Click Save and Close.
Verifying the Rule
- Attempt a Microsoft Online login with a non-
@companydomainaccount on a device/user in scope — this should be blocked. - Attempt a Microsoft Online login with a
@companydomainaccount — this should succeed. - Check Activity Reports to confirm the rule is logging matches as expected.