Tenant control

In this example, tenant control is configured for Microsoft in the inline CASB profile for the fortinet-us.com domain.

To configure an inline CASB profile with tenant control in the GUI:

1. Configure the inline CASB profile:

   1. Go to Security Profiles > Inline-CASB and click Create new.

   2. Enter a Name, such as microsoft_test.

   3. In the SaaS Applications table, click Create new. The Create SaaS Application Rules pane opens.

   4. Search Microsoft and select the Microsoft application, then click Next.

      

   5. Enable Tenant control. Click the + and enter fortinet-us.com.

      

   6. Click OK to save the rule.

   7. Click OK to save the CASB Profile.

2. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy. Edit an existing policy, or create a new one.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable Inline-CASB and select the microsoft_test profile.

   4. Set the SSL Inspection profile to one that uses deep inspection.

   5. Configure the other settings as needed.

   6. Click OK.

To configure an inline CASB profile with tenant control in the CLI:

1. Configure the inline CASB profile:

   config casb profile
       edit "microsoft_test"
           config saas-application
               edit "microsoft"
                   set tenant-control enable
                   set tenant-control-tenants "fortinet-us.com"
               next
           end
       next
   end

2. Configure the firewall policy:

   config firewall policy
       edit 8
           set name "casb_test_microsoft"
           set srcintf "port1"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "ssl"
           set casb-profile "microsoft_test"
           set nat enable
       next
   end

To test the configuration:

1. Open a browser and attempt to log in to Microsoft Office 365 with a fortinet-us.com account.

2. Since the domain is valid, the user can log in successfully.

   

3. Attempt to log in to Microsoft Office 365 with another account with a different domain.

4. The domain is invalid. The user is unable to log in, and an error message appears: Your network administrator has blocked access.

   

Sample log:

1: date=2026-04-08 time=09:33:27 eventtime=1775666006955935136 tz="-0700" logid="2500010002" type="utm" subtype="casb" eventtype="casb" level="information" vd="root" policyid=8 poluuid="23fa6e58-fd3a-51f0-fcba-755a1c0b5610" sessionid=484445 srcip=13.13.13.13 dstip=20.190.190.130 srcport=59380 dstport=443 srcintf="port1" srcintfrole="undefined" srcuuid="1c9e034e-72bc-51f0-4866-42e7eacff7bb" dstintf="port3" dstintfrole="undefined" dstuuid="70b43f6e-1e2b-51f1-c748-c3c24466ed2e" proto=6 url="https://login.microsoftonline.com/common/login" action="monitor" profile="microsoft_test" saasapp="microsoft" useractivity="microsoft-tenant-control" operation="tenant" subaction="monitor" tenantmatch="missed" activitycategory="tenant-control" msg="CASB access was monitored because it contained activity."