Zscaler enforces Tenant Restriction by intercepting user authentication requests to cloud applications like Microsoft 365 or Google Workspace. During this process, the Zscaler service inserts specific HTTP headers into the request. These headers contain the identifiers for the organization's approved tenants (e.g., Tenant IDs, domains). The cloud application receives these headers and permits access only to the specified tenants, effectively blocking access to personal or unauthorized accounts while using the corporate network. This method provides granular control without blocking the application entirely.

A. This is the opposite of tenant restriction, which is designed to limit, not unrestrict, access.

B. Blocking all external traffic is an overly broad and disruptive action, not the targeted control provided by tenant restriction.

D. This is a simple block policy. Tenant restriction allows access to approved instances of an application, rather than disabling it completely.

1. Zscaler Help Portal, "About Tenant Restrictions," Section: "How Tenant Restrictions Work." This document states, "When a user authenticates to a cloud application, Zscaler can insert a header into the user's login request that identifies the approved tenants for your organization."

2. Zscaler Help Portal, "Adding Tenant Profiles," Step 2. This section details the specific tenant IDs and domains that are inserted into headers like Restrict-Access-To-Tenants for Microsoft services and X-Goog-Allowed-Domains for Google services.