Technical Articles
F5 SMEs share good practice.
Showing results for 
Search instead for 
Did you mean: 
Custom Alert Banner
F5 Employee
F5 Employee


This use case allows you to access Company Office 365 resources while blocking access to personal/non-company Office 365 resources.

In this scenario, SSL Orchestrator injects Microsoft "Tenant-Restriction" HTTP headers into outbound HTTP flows. The concept of Tenant Restrictions provides a mechanism to allow or deny access to Office 365 resources based on organizational requirements. For example, you may wish to allow access to Company Office 365 Outlook mail but deny access to the same resource when using a personal account.

Detailed information from Microsoft on Tenant Restrictions is available here[1]. In order to configure Tenant Restrictions, you need your company's ‘Restrict-Access-To-Tenants’ and ‘Restrict-Access-Context’ values. You can obtain these from the Microsoft Azure portal by signing in as the Administrator here[2]

After logging in select View under Azure Active Directory.

0151T000002dkVlQAI.pngYour Tenant Domain and Tenant ID will be shown like in the image below.


Restrict-Access-To-Tenants – a value of permitted tenant lists, which is a comma-separated list of tenant domains that users are allowed to access. Any domain that is registered with a tenant can be used to identify the tenant in this list. For example, to permit access to both Contoso and Fabrikam tenants, the name/value pair would look like this:


Restrict-Access-Context - a value of a single directory ID, declaring which tenant is setting the

Tenant Restrictions. For example, to declare Contoso as the tenant that sets the Tenant Restrictions policy, the name/value pair would look like this:

Restrict-Access-Context: 456ff232-35l2-5h23-b3b3-3236w0826f3d.

This article assumes you have a working SSL Orchestrator Deployment configured and wish to add Office 365 Outlook Tenant Restrictions.


1.    Create a Custom URL category – this will hold the Microsoft login URLs that require the Tenant Restrictions headers.

2.    Create the ICAP service - the ICAP service is a flexible, transactional service type. We’ll use this as the framework for injecting Tenant Restrictions headers.

3.    Create a security policy - the SSL Orchestrator security policy is the engine that maps traffic flows to actions (allow/block, decrypt/bypass, service chain). We’ll create a Security Policy that looks for the Microsoft login URLs (from the custom category) and assigns this traffic to the modified ICAP service.

4.    Create an iRule - this iRule actually does the work of injecting the HTTP headers and will be applied to the modified ICAP service.

5.    Test the Tenant Restrictions

Step #1 Create a custom URL category

From the SSL Orchestrator Configuration screen select Policies > URL Categories


Click Create


Give it a Name, Office365 in this example


Uncheck the box for Global Pattern Match. Add all of the following:

Click Finished when done


Step #2 Create an ICAP Service in existing Topology

From the SSL Orchestrator Configuration screen select Services then click Add


Note: if you do not have a Topology created you can still use this guide and create the ICAP Service at the time the Topology is created. The order of events will be slightly different.

Scroll to the bottom, select Generic ICAP Service and click Add


Give the ICAP Service a name, Office365_Tenant in this example. For ICAP Devices click Add.


Enter an IP Address, in this example and click Done.


Note: the IP address you use does not have to be the one above. It’s just a local, non-routable address used as a placeholder in the service definition. This IP address will not be used.

IP addresses to are owned by network benchmark tests and located in private networks. 

Scroll to the bottom and click Save & Next.


On the next screen click Add to create a new Service Chain


Give it a name, O365_Service_Chain in this example. Select your existing Services and click the right arrow to move them to Selected. Add the ICAP Service last.


Note: It’s important to know why you’re creating a new Service Chain. The custom category will be applied to a Security Policy rule to match on requests for specific Office 365 login URLs. If that condition matches, the traffic must be intercepted (decrypted), and sent to a Service Chain with the Office 365 Service. Multiple Services can be in this Service Chain. However, if you put the Office 365 Service in any other service chain, the tenant restrictions headers will be sent to other sites incorrectly.

It should look like the following. Click Save.


Note: the new Service Chain should look like your previous Service Chain with the addition of the Office365 ICAP Service at the end. It is important to do it this way to ensure Login activity to Office 365 is still inspected.

Click Save & Next


Click Deploy


You should receive a Success message.


Step #3 Create a security policy

From the SSL Orchestrator Configuration screen select Security Policies then click on the name of the Policy to edit, ssloP_Secure_Outbound this example.


Click the Add button to add a new rule


Name the Rule, O365_Tenant_Restrict in this example. Under Conditions click Select and choose Category Lookup (All).


Choose the Custom Category created previously, Office365 in this example. Type the name into the field and it will filter the results. 


Set the Action to Allow. For SSL Forward Proxy Action select Intercept. Set the Service Chain to the one created previously, O365_Service_Chain in this example.

Note: it is critical that the Action be set to Intercept so SSL Orchestrator can decrypt the connection and insert the Tenant Restriction headers.


Scroll down and click Deploy at the bottom


The changes should be successfully deployed

Step #4 Create an iRule

From Local Traffic select iRules > iRule list


Click Create on the Right


Give the new iRule a name, TenantRestrictions in this example

Enter the following for the Definition:

	HTTP::header replace Restrict-Access-To-Tenants ""
	HTTP::header replace Restrict-Access-Context "ee3dfd2f-6a3b-40d1-9be0-bf8327d81d90"

Note: The restrict-Access-To-Tenants header should contain your Tenant’s domain(s), comma-separated if more than one. Example: “,”

The Restriction-Access-Context header must contain the Tenant ID as shown in the Azure Portal.

Click Finished


From the SSL Orchestrator Configuration screen select Services. Click the padlock to Unprotect Configuration.


Note: Disabling Strictness on the ICAP Service is needed to modify it for Tenant Restrictions header insertion. Strictness must remain disabled on this service, and disabling strictness on the service has no effect on any other part of the SSL Orchestrator configuration.

Click OK to Unprotect the Configuration


From Local Traffic select Pools > Pool List


Select the Office365_Tenant Pool


Under Active Health Monitors select tcp and click >> to move it to Available

Click Update


Note: The Health Monitor needs to be removed because there is no actual ICAP service to monitor.

From Local Traffic select Virtual Servers > Virtual Server List


Locate the Office 365 ICAP service that ends in “-t-4” virtual server and select it


Set the Request Adapt Profile and Response Adapt Profile to None to disable the default ICAP Profiles


Click Update at the bottom

Click the Resources tab


Click the Resources tab > Manage


Select the iRule created previously, TenantRestrictions in this example and move it to the left under Enabled

Click Finished


Step #5 Test the Tenant Restrictions

Attempt to login to with your Tenant Restrictions domain.

Note: you must attempt to login with an email address and password in order to see the following error page:



[1] Detailed information from Microsoft on Tenant Restrictions

[2] Microsoft Azure portal


Nice! Is there a similar option for Dropbox being restricted if it is private or company dropbox?

Community Manager
Community Manager

 - can you answer  ?

F5 Employee
F5 Employee

I think it's possible but don't have the details just yet. I will ask around and report back.

F5 Employee
F5 Employee

Late to the party, but yes, doing the same for Dropbox would be pretty straight forward.

For all * HTTP requests, insert the following header:

X-Dropbox-allowed-Team-Ids = (dropbox team ID)

Note of course for tenant restrictions to work, you must decrypt this HTTPS request, as that'd be the only way to insert an HTTP header.

Version history
Last update:
‎01-Jun-2020 12:50
Updated by: