Creating a Secure Network Policy - Secure SaaS or Cloud App Access

Requirement

Secure Network requires Windows, Mac, and Linux Agent version 11.0 or greater and ThreatLocker Access App version 1.0 or later.

Important

Review Organization Beneficiaries to ensure all child organizations have access to the Secure Network servers required for SaaS policies.

Managing Organization Beneficiaries

Navigate to the Network section and select Network Policies.

Select the 'New Policy' button in the top left corner.

The Create Secure Network Policy window will open, where you can select which type of policy to create.

Select 'Create Secure SaaS or Cloud App Access' to create a policy to control access to your SaaS or cloud apps (such as Microsoft 365, GitHub, Slack) through Secure Network.

The Secure SaaS or Cloud App Access wizard will open.

1. Select SaaS Application: Select the Saas Application you wish to create a policy for.

Please Note: You will need to ensure that the SaaS app selected and any access policies for the app allow traffic from ThreatLocker.

Once you have selected the desired SaaS application, you can select to set an expiration date (A) for the policy or to apply the policy based on a schedule (B). Leave these unchecked to allow the policy to always be active and never expire.

2. Add Organization Devices: The 'Add Organization Devices' dropdown contains a list of all your Organizations, Computer Groups, Computers, and Mobile Devices. Select as many as desired and they will be added into the 'Add Organization Devices' box, and wil be permitted to access the selected SaaS application via the Secure Network.

3. Local Users and Groups: By default, 'Everyone' is selected. If you wish to scope access to specific users/groups, input the desired local Users and Groups. Once set, only the specified Users and Groups will be permitted to initiate the connection defined in this policy.

4. Authorize Local Apps: By default, 'All Applications' will be selected. If you wish to limit this policy to specific local applications, select the desired application or applications from the type-searchable dropdown list. For most SaaS deployments, leaving 'All Applications' selected is sufficient.

When all fields have been configured, select the blue 'Next' button. The Secure Network Policy Summary window will open.

Make any necessary edits, including adding a description if desired, and then click the blue 'Create' button to add this policy to your Secure Network policy list.

iCloud Private Relay Compatibility Notice

Apple’s iCloud Private Relay feature may proxy Safari traffic outside of the ThreatLocker Secure Network tunnel. As a result, access to internal or restricted resources that rely on ThreatLocker Secure Network conditional access may fail.

For best compatibility when accessing company resources:

Use a non-Safari browser such as Chrome or Edge
Or temporarily disable iCloud Private Relay / Limit IP Address Tracking while connected to the ThreatLocker Secure Network

Zero Trust Network Access (ZTNA) and Zero Trust Cloud Access (ZTCA) Frequently Asked Questions