Tenant restrictions are a specific security feature designed to control access to multi-tenant SaaS applications. To allow access only to a sanctioned Google Workspace environment, an administrator configures Prisma Access to insert a specific HTTP header (X-Goog-Allowed-Domains) into the user's web requests to Google services. This header lists the approved corporate domain(s). When Google's services receive this header, they enforce the policy, granting access only to the specified corporate tenant and blocking access to any personal or other unsanctioned Google accounts. This provides granular control beyond simple URL filtering.

A. Dynamic Address Groups: These groups are based on IP addresses associated with tags, not the application-layer tenant information required to differentiate between instances of a SaaS application.

C. Dynamic User Groups: These groups define who a policy applies to based on user attributes, but they are not the mechanism that performs the tenant restriction itself.

D. URL category: This feature operates at the domain level (e.g., google.com). It cannot distinguish between a sanctioned corporate tenant and an unsanctioned personal tenant hosted on the same domain.

1. Palo Alto Networks Prisma Access Administrator’s Guide: "Configure SaaS Tenant Restriction for Google." This document explicitly details the procedure: "To control access to Google applications, you can configure a SaaS tenant restriction policy that adds the X-Goog-Allowed-Domains HTTP header to web requests for Google applications. This header specifies the domains that your users can access."

Source: Palo Alto Networks TechDocs, Prisma Access Administrator’s Guide.

2. Palo Alto Networks PAN-OS® Administrator's Guide: "Dynamic Address Groups." This guide explains that DAGs "allow you to create policy that automatically adapts to changes... without the need to manually update and commit policy changes. The firewall dynamically imports the IP addresses... based on the tags you define." This confirms their function is IP-based.

Source: Palo Alto Networks TechDocs, PAN-OS Administrator's Guide 10.2, section on Objects > Address Groups.

3. Palo Alto Networks PAN-OS® Administrator's Guide: "Create a Dynamic User Group." The documentation states, "A dynamic user group is a type of group membership list that is based on tags that are registered on the firewall." This shows DUGs are for grouping users, not for application-layer tenant control.

Source: Palo Alto Networks TechDocs, PAN-OS Administrator's Guide 10.2, section on Objects > Dynamic User Groups.