Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail

Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail

Written By Anoop C Nair
Last Updated July 1, 2026
Posted In Entra
SHARE

Key Takeaways

  • Blocks sensitive file uploads to ChatGPT, Gmail, and other unapproved platforms.
  • Helps reduce Shadow AI and data leakage risks.
  • Works for both personal and corporate accounts.
  • Requires TLS inspection setup, which needs planning and configuration.
  • Sensitivity Labels and encryption still provide the strongest file protection.

Microsoft has introduced new file type control capabilities in Entra Global Secure Access, helping organizations reduce Shadow AI and data leakage risks. The feature allows administrators to block users from uploading sensitive file types to unapproved AI platforms such as ChatGPT and unapproved email communication services like Gmail at the network layer. The protection applies to both personal and corporate accounts and can be configured through the Entra admin center using Content Policies, Security Profiles, and Conditional Access integration.

Table of Content

Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail

TLS inspection is needed for this feature, and setting it up can take time and planning. It is not something you can enable quickly. You may need certificates, configuration work, and proper testing before rolling it out. Even with this network protection, Sensitivity Labels with encryption are still very important. If a file is encrypted using labels, it stays protected even if someone shares it outside the company.

  • To use this feature, organizations must have a Microsoft Entra Internet Access or Microsoft Entra Suite licence.
Steps
Go to Microsoft Entra admin center
Navigate to Global Secure Access
Open Secure > Content policies
Select Create policy
Add file type rules
Link the policy to a Security Profile
Apply it through Conditional Access policy
Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail – Table 1
Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail - Fig.1
Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail – Fig.1

Microsoft Entra Global Secure Access – File Type Policy Configuration Steps

You can configure file type blocking for Shadow AI and data protection using the Microsoft Entra admin center. This setup helps control sensitive file uploads to unapproved AI and communication platforms.

Note: You need a Microsoft Entra Internet Access or Microsoft Entra Suite licence to use this feature.

Patch My PC
Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail - Fig.2
Microsoft Entra Global Secure Access Blocks Sensitive File Uploads to ChatGPT and Gmail – Fig.2

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community  and the Whatsapp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well

Resources

Tutorial: Configure Content Policies – Global Secure Access | Microsoft Learn

Author

Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM,  Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.

Written by

Anoop C Nair is Workplace Technology solution architect with 25+ years of experience in global enterprise organizations such as JP Morgan, Capgemini, etc. Microsoft Certified Trainer. Microsoft MVP from 2015 onwards for consecutive 11+ years! He also conducts Intune and modern workplace tech training for enterprise organizations. He is Blogger, Speaker, and Founder of HTMD Community and HTMD Conference. His main focus is on Device Management technologies like Intune, Windows, Cloud PC. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security.

Discussion

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Entra

Entra ID SSPR Improves Security with Registered Authentication Methods | Impact on Unregistered Users Starting September 2026

Key Takeaway Entra ID SSPR Improves Security with Registered Authentication Methods! Starting September 7, 2026, Microsoft Entra ID Self-Service Password Reset (SSPR) will require users to verify their identity using explicitly registered authentication methods. Directory-sourced contact information, such as mobile phone numbers, business phone numbers, and alternate email addresses, will no longer be accepted for […]

AC Anoop C Nair 4 min read
Entra

Explicit Forward Proxy in Microsoft Entra Internet Access Helps Secure VDI BYOD and Clientless Browsing

Key Takeaways Explicit Forward Proxy in Microsoft Entra Internet Access! This feature allows organizations to use secure web and AI gateway capabilities without deploying the Global Secure Access client, making it useful for browser-based and lightly managed environments. It works with browsers that support Proxy Auto-Configuration (PAC) files. Since this is a prerelease feature, Microsoft […]

AC Anoop C Nair 3 min read
Cloud

Microsoft Enables Entra Writeback for Cloud-Managed Remote Mailboxes to Help Remove Last Exchange Server

Key Takeaways: Let’s discuss about Microsoft Unlocks Entra Writeback for Cloud-Managed Remote Mailboxes to Help Remove Last Exchange Server. For customers with no remaining dependency on their last Exchange Server, a guide for decommissioning your last Exchange Server. Microsoft announced the Public Preview of Cloud-Managed Remote Mailboxes. Microsoft is excited to share these two new milestones […]

AC Anoop C Nair 3 min read