Help CenterCreate a Secure SaaS or Cloud App Access Policy
Use a Secure SaaS or Cloud App Access policy to control which devices in your organization can access SaaS and cloud applications, such as Microsoft 365, GitHub, and Slack. Traffic to these applications is routed through Secure Network.
Requirement
Secure Network requires Windows, Mac, and Linux Agent version 11.0 or greater and ThreatLocker Access App version 1.0 or later.Important: Do not apply SaaS policies that use the Microsoft Azure SaaS application to mobile devices. The Microsoft Azure application contains more IP addresses than mobile devices can support, so the device will fail to connect. Scope these policies to groups that don’t include mobile devices. An improvement that will resolve this issue is coming in version 2.0 of the ThreatLocker App.
In this article
Create the Policy
- Log in to the ThreatLocker Portal.
- Navigate to Network > Network Policies.
- Select New Policy.
- Select Create Secure SaaS or Cloud App Access.
Configure the Policy
SaaS Application
Select the SaaS application this policy will control. Custom SaaS Application Tags display (custom) at the end of their name. If the application isn’t listed, create a SaaS Application Tag from the Tags page.
Important
ZTCA Mobile currently supports only IP-based routing. Domain-based routing is coming soon.
Expiration and Schedule
- Expiration: Set a date and time when the policy stops.
- Schedule: Limit the policy to specific days or times.
Leave both off to keep the policy always active.
Source
Select the Organizations, Computer Groups, Computers, or Mobile Devices that can access the SaaS application.
You can select multiple items.
Users and Groups
By default, Everyone is selected. To limit the policy, select specific local users or groups.
Applications
By default, All Applications is selected, which is sufficient for most SaaS deployments. To limit the policy, select specific local applications.
Review and Create
- Select Next.
- Review your selections on the Secure Network Policy Summary page.
- Select Create.
Troubleshooting
Devices in child organizations can’t reach the SaaS app
Review Organization Beneficiaries to ensure all child organizations have access to the Secure Network servers required for SaaS policies.
Traffic to the SaaS app is blocked after the policy is created
Ensure the selected SaaS application, and any access policies configured within it, allow traffic from ThreatLocker.
A custom SaaS app doesn’t appear in the dropdown
Create a SaaS Application Tag from the Tags page.
Safari can’t reach restricted resources on Apple devices
iCloud Private Relay may route Safari traffic outside the Secure Network tunnel. Use Chrome or Edge, or temporarily disable iCloud Private Relay / Limit IP Address Tracking while connected.