Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=protected-browser-settings

Settings

Configure browser settings, such as Browser enforcement, DNS Protection, and Phishing Protection.

Browser enforcement via IdP

You can configure access to your critical SaaS applications only through Protected Browser, blocking access from other browsers. To enforce this, use an identity provider (IdP), such as Entra ID or Okta. The IdP authenticates all requests to a specified domain and then routes the traffic through a ZTNA data plane region. To enable this, create a conditional access policy in your IdP that allows the IP address of the ZTNA data plane region you want to use for authentication.

Note

The authentication token is managed by your IdP. If you configure session controls through conditional access policies in your IdP, those settings take precedence. For example, if you set a sign-in frequency of 2 days using a conditional access policy, sessions expire after 2 days. If you don't configure any session controls in your IdP, Protected Browser uses a default session expiry of 7 days.

To configure browser enforcement for your applications, do as follows:

  1. Click the Global Settings icon Global Settings icon..
  2. Go to Products and Services, and click Protected Browser.

  3. Select an identity provider from the following options:

    • Entra ID: Entra ID authenticates all application access requests that login.microsoftonline.com receives.
    • Okta: Enter the domain that receives application access requests. Okta authenticates requests that the domain you specify receives.

  4. Under Data plane region, select the ZTNA data plane region you want to use for authentication.

  5. Click Copy IPs list to copy the IP addresses of the ZTNA dataplane region.

    You must allow these IP addresses in your IdP for every application whose access you want to enforce through Protected Browser.

DNS Protection

By default, Sophos Protected Browser uses the DNS service configured on the device. You can configure Protected Browser to resolve DNS requests independently through Sophos DNS Protection using DNS over HTTPS (DoH).

Using DNS Protection with Protected Browser lets you apply different DNS policies to Protected Browser and other browsers on the device. For example, you can block an application in other browsers but allow it in Protected Browser. You can then use Protected Browser data controls to restrict actions such as copying, pasting, printing, and sharing.

You can use the default DNS Protection policy to block high-risk websites. Alternatively, you can apply a specific DNS Protection policy to Protected Browser. You can use an existing policy or create a separate policy for browser traffic.

Restriction

DNS Protection is only available in the full Protected Browser, not the extension.

To configure DNS Protection for Protected Browser, do as follows:

  1. Go to My Products > Protected Browser > Settings.
  2. Select the DNS Protection tab.
  3. Turn on Use DNS Protection for Protected Browser.

  4. Select one of the following options:

    • Block only high risk DNS requests: Uses the default DNS Protection policy to block high-risk websites. You must configure Protected Browser web policies to control access to other unwanted content.
    • Apply a specific DNS Protection policy: Applies the DNS Protection policy that you select. Select an existing DNS Protection filtering policy or create a new one. To create a new policy, see Add a filtering policy.

  5. In Domain Exclusions, specify the domains you want to exclude from DNS Protection. DNS requests for these domains are resolved by your local or network DNS server. All subdomains are automatically excluded.

    Note

    If you're using DNS Protection for Endpoints, add the same exclusions to the relevant Endpoint policy.

  6. (Optional) Turn on Trust the DNS Protection signing certificate to add the DNS Protection signing certificate to the Protected Browser certificate chain.

    This option installs the DNS Protection root certificate as a trusted certificate authority (CA), allowing Protected Browser to show DNS Protection block pages for websites that aren't blocked by a Protected Browser web policy.

    Note

    If the certificate is already trusted on endpoints through other mechanisms, it remains trusted even when this option is turned off.

  7. Click Save.

Phishing Protection

Phishing Protection helps prevent users from entering corporate email addresses and credentials on suspicious or impersonated websites. It monitors website forms for email addresses and domains that you specify. To use Phishing Protection, turn it on globally and then turn it on in web policies for specific sites, applications, or web categories. If a user attempts to submit a monitored email address on a site, Protected Browser can either warn the user or block the submission, depending on the setting you specify in the policy.

Phishing Protection monitors websites that users visit in Protected Browser. It doesn't scan email messages. Instead, it helps protect users when they interact with websites that attempt to collect corporate credentials.

To turn on Phishing Protection globally, do as follows:

  1. Go to My Products > Protected Browser > Settings.
  2. Select the Phishing Protection tab.
  3. Turn on Phishing Protection.

  4. In Email domains to protect, enter one or more corporate email domains or specific email addresses.

    • To protect all users in a domain, enter a domain such as example.com.
    • To protect specific users, for example during testing, enter individual email addresses.

  5. Click Save.

  6. Go to My Products > Protected Browser > Web policies, and turn on Phishing Protection in the base policy or any custom policy.