Keeping Work Inside the Right SaaS Tenant
Consumer and corporate versions of the same applications are increasingly hard to tell apart. An employee might use Google Workspace for email at the office and Gmail for personal correspondence, or share files through a corporate Dropbox while also managing a personal account on the same platform. When switching between these contexts—especially without a clean logout at the end of the day—mistakes happen and data can land in the wrong place.
Cloudflare has announced Tenant Control in Cloudflare Gateway, a feature designed to stop those cross-tenant mix-ups. With it, organizations can enforce rules that restrict users to the corporate instance of the SaaS tools they use, reducing the chance that files or credentials end up in personal accounts.
Beyond Classic HTTP Filtering
Cloudflare Gateway secures outbound traffic by routing it through Cloudflare's network, where it can be inspected. Most deployments begin with DNS filtering, which forwards only DNS queries to Cloudflare and enables blocking of malware or phishing destinations. Organizations that need deeper control can add HTTP filtering, giving them visibility into what happens within a request—such as blocking uploads to specific destinations.
That level of control works well when you want to distinguish between different applications. Cloudflare already classifies hostnames and URLs by application, so an administrator can, for instance, permit OneDrive uploads while blocking all file transfers to Google Drive. But this approach has a blind spot: it cannot tell the difference between a corporate and a personal account within the same application. Tenant Control addresses exactly that gap.
How Tenant Control Works
Tenant Control is implemented through Gateway HTTP policies. Administrators add a new rule type that injects a header into the outbound request before it reaches the target SaaS provider. For Microsoft 365, this involves providing the tenant ID for the organization's deployment. The injected header—X-GooGApps-Allowed-Domains for GSuite, or the equivalent tenant identifier for other providers—is then recognized by the application, which responds by rejecting any login attempts from outside the specified tenant.
This header injection is handled entirely by Cloudflare's network. In legacy setups, such headers were typically added by on-premises proxy servers, requiring traffic to be backhauled to a corporate location. Cloudflare Gateway applies the headers in data centers close to the user, then proceeds to accelerate the request toward its destination, avoiding the latency of traditional backhaul.
For debugging and audit purposes, Gateway already appended trace headers to proxied requests. Tenant Control extends this capability, letting administrators specify custom headers to be added upstream, which is the mechanism that enforces the tenant restriction.
Configuring a Tenant Policy
To configure tenant control, administrators create an HTTP policy from the Cloudflare for Teams dashboard. As an example, a policy can prevent users from authenticating to GSuite with a personal account or from uploading documents to a personal Google Drive. When the rule evaluates the request and determines it is headed to the correct destination, Gateway injects the necessary header before forwarding the traffic upstream.
Part of a Broader Data Protection Picture
Tenant Control joins a broader set of data-control capabilities already in Gateway. Administrators can dictate which applications are accessible, block file uploads or downloads in certain scenarios, and enforce restrictions on copy-paste or printing when using the isolated browser. The new tenant-level check adds an additional layer to this portfolio, ensuring that even when an application is allowed, only the sanctioned instance of it is reachable.
Cloudflare expects to expand on this foundation with additional scanning features as it continues to build out its data control offerings.
