Limit users’ access to Google and Microsoft personal accounts

You can use Custom Headers to stop students from signing in to their personal Google or Microsoft accounts during school time, while still allowing access to your school's Google Workspace or Microsoft 365 accounts.

Custom Headers work through devices running Linewize Connect. Connect uses Man In The Middle (MITM) inspection to add a header to sign-in requests:

• Google: the header contains your school's domain(s). Google only allows users to sign in with accounts on those domains.

• Microsoft: the header contains your Microsoft Entra tenant ID and cross-tenant access policy ID. Microsoft blocks sign-in to personal Microsoft accounts and accounts outside your organization.

To get started, add or update a filtering policy with a Custom Header for each provider you want to restrict. Then add the sign-in domains to your MITM configuration in the Mobile Agent menu.

If the user tries to sign in with a personal account, the sign-in is stopped and a message is displayed:

• Google: "This account is not allowed to sign in within this network."

• Microsoft: "You can't get there from here."

Before you begin

1. You must have access to Filtering and Configuration in Linewize Filter.

2. Ensure Linewize Connect is installed on your students’ devices (Linewize Connect is not available on Android devices).

3. Be familiar with any of your existing content filtering policies that Allow your users to access Google or Microsoft sign-in pages.

4. For Google: note your Google domain and subdomains as displayed in your school's Gmail or Google Workspace.

5. For Microsoft: you need a Microsoft Entra Administrator account to find your TenantID and policyGUID. See Get your TenantID and policyGUID.

Set up Custom Headers

Create a policy for each provider you want to restrict, then turn on MITM. You can set up Google, Microsoft or both.

1. Create a Google Custom Headers policy
2. Create a Microsoft Custom Headers policy
3. Turn on Man In The Middle (MITM)

1. Create a Google Custom Headers policy

In this example, you'll stop all users from accessing personal Google accounts on your school's network and only let them access your school's Google account. You'll do this by creating a new Allow policy with a Custom Header.

1. Go to Filtering > Content Filtering and select Create Policy.

2. Enter a descriptive Name.

3. Enter accounts.google.com in Type. Select Website accounts.google.com when it is displayed.

4. Select Allow.

5. (Optional) Select Locked if:

   • You do not want other policies to override this policy.

   • You want to stop teachers from giving students Bypass Codes to access personal emails and files.

   • You need to separate education and personal sign-ins before other Locked policies take effect.

6. Enter X-GoogApps-Allowed-Domains in Header Name, then type your school’s domain or subdomain as it appears in your school's Google Workspace accounts into Header Value.

     Warning

   Spell your domain names exactly as configured in your Google Administrator settings. Any misspelling will lock all users out of their Gmail and Google Workspace apps until you fix the policy. See Access your Google Workspace domain settings. 

   • Do not add a leading dot before the domain name. Start with the characters.

   • If you have multiple domains, add the domains separated by a comma and space. 

   • Do not add a trailing comma after the last domain.

7. Select the plus icon (+).

8. Verify your Custom Header is displayed under the Name and Value columns.

9. Select Save Policy.

10. Find your policy. An unlocked new policy will be displayed at the bottom of the list. A Locked new policy will be displayed as the last item in Locked policies. Drag your policy:

    • Below the Locked policies, unless your policy is also Locked and should be filtered before another Locked policy.

    • Below any Block policies applying to Google products, for example, below a policy blocking YouTube.

    • Above any Allow policies granting users access to any Google apps.

11. Select the toggle next to your policy to turn it on. The toggle appears green when the policy is on.

12. Continue to Create a Microsoft Custom Headers policy, or skip to Turn on MITM.

(Optional) Filtering Multiple Google Domains

Different groups in your school may need access to different school Google domains. You can add multiple Google Workspace applications to the Allow > Website in a filter policy as long as the Custom Header Value is the same. Your policy needs to allow the subdomain for the Google product. Replace the example domains, "school.edu" and "district.edu", with your actual domain name.

If your school uses more than one domain, use a Website filter. Separate the domains by a comma and space.

If your Gmail has a different domain from your Google Workspace, add another Custom Header for the Google Apps.

If your school uses subdomains to limit access by type of user to specific Google Apps, add a Custom Header for the subdomain. For example, you allow your staff and teachers to sign in to personal accounts in Google Groups but want your other Google filtering to apply.

For more specifics on how to work with Google to block access to consumer accounts, see https://support.google.com/a/answer/1668854. 

2. Create a Microsoft Custom Headers policy

In this example, you'll stop all users from signing in to personal Microsoft accounts on your school's network. You'll do this by creating a new Allow policy with a Custom Header that contains your Microsoft Entra TenantID and policyGUID.

Before you start, get your TenantID and policyGUID.

1. Go to Filtering > Content Filtering and select Create Policy.

2. Enter a descriptive Name.

3. Enter each of the following in Type, and select each Website when it is displayed:

   • login.microsoft.com

   • login.live.com

   • login.microsoftonline.com

   • login.windows.net

4. Select Allow.

5. (Optional) Select Locked if you do not want other policies to override this policy.

6. Enter sec-Restrict-Tenant-Access-Policy in Header Name, then type your school's TenantID and policyGUID, separated by a colon, into Header Value.

7. Select the plus icon (+).

8. Verify your Custom Header is displayed under the Name and Value columns.

9. Select Save Policy.

10. Find your policy and drag it into position, following the same order as in step 10 of the Google policy.

11. Select the toggle next to your policy to turn it on. The toggle appears green when the policy is on.

12. Continue to Turn on MITM.

If it's configured correctly, users who try to sign in with a personal Microsoft account will see the message "You can't get there from here."

Get your TenantID and policyGUID

You need a Microsoft Entra Administrator account to find these values.

• TenantID is your Microsoft Entra tenant ID.

  1. Sign in to the Microsoft Entra admin center.

  2. Go to Entra ID > Overview > Properties, or find it on the Home page.

  3. Copy the Tenant ID.

• policyGUID is the object ID of your cross-tenant access policy.

1. Sign in to Microsoft Graph Explorer with your Entra Administrator account.

2. Select GET and v1.0, then enter this request URL: https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default

3. Select Run query. If prompted, consent to the Policy.Read.All permission.

4. In the Response preview, copy the value of id.

3. Turn on MITM for Mobile Agents

After creating the filtering policy, you need to tell Linewize Connect to inspect your users' sign-in attempts for Google and Microsoft accounts.

1. Go to Configuration > Mobile Agent. 

2. Under On Linewize Filter Network, ensure the MITM checkbox is selected.

3. In the Inspected field, enter each sign-in domain for the providers you're restricting, and select each Website from the list:

   • Google: accounts.google.com

   • Microsoft: login.microsoft.com, login.live.com, login.microsoftonline.com and login.windows.net

4. (Optional) To block access to personal accounts outside of school hours, including when the student is at home, go to Off Linewize Filter Network. Select the MITM checkbox, and enter the same domains in Inspected.

5. Go to the bottom-right of the window and select Save.

Removing a Custom Header

You can remove the Customer Header without deleting the filtering policy.

1. Go to Filtering > Content Filtering and select the Edit icon (pencil).

2. Select the Delete icon (bin) at the bottom of the Edit Policy window.

3. Select Save Policy.  

Frequently Asked Questions

Which Google Apps does Custom Header work for?

When you filter and inspect the “google.com” domain, all of the Google Workspace Apps (including Gmail, Drive, Docs, Sheets, Slides, Forms, Sites) will be limited to users signing in with their school accounts. 

Do Custom Headers work with other Google sites that don’t have the Google domain?

Google does not apply your Custom Header to all their extended apps. For example, the Blogger sign in will return a user to the home page without displaying the message when the user tries to sign in with their personal account. Instead, we recommend you use your Google Workspace Administrator functions to turn off access to any additional Google apps or services. See Turn services on or off for Google Workspace users.

Why do I need four domains for Microsoft?

Microsoft uses several sign-in domains for work, school and personal accounts. Adding all four to your policy and to Inspected makes sure the Custom Header is sent with every Microsoft sign-in request.