Adobe Firefly access restricted to specific AD group using Edge SWG

Products

• ISG Proxy
• Advanced Secure Gateway Software - ASG

Issue/Introduction

This article addresses a scenario where access to Adobe Firefly or other Generative AI sites remains available to all users even after implementing an Active Directory (AD) group exception rule. This occurs when broad "Allow" rules for general web categories match the traffic before the specific AI restriction is evaluated.

Environment

• Edge SWG (ProxySG)
• Visual Policy Manager (VPM) or Content Policy Language (CPL)
• Advanced Secure Gateway (ASG)

Cause

Policy evaluation in Edge SWG follows a specific order. If a transaction matches a broad "Allow" rule (e.g., for categories like "Technology/Internet" or "Business/Economy") in an earlier layer or rule, the proxy permits the connection. Specific "Deny" rules placed later in the policy will not be evaluated unless a FORCE_DENY is utilized or the "Allow" rules are reordered.

Resolution

To ensure only a specific AD group can access Adobe Firefly while blocking all others, implement the following policy logic:

1. Identify Broad Allows: Perform a policy trace to identify which existing rules are allowing firefly.adobe.com. Reference: Debug access denied errors or website accessibility issues with Policy tracing.
2. Create the Exception Rule:
   • Source: Specific AD Group object.
   • Destination: Request URL object for firefly.adobe.com (or "Adobe Firefly" application object).
   • Action: ALLOW.
   • Placement: This rule must be placed above the block rule.
3. Create the Block Rule:
   • Source: Any.
   • Destination: Request Category "Generative AI" (or specific URL for Firefly).
   • Action: FORCE_DENY.
   • Note: Using FORCE_DENY ensures this rule overrides any standard "Allow" matches in other layers.
4. Install Policy: Click Install Policy to apply changes.

Additional Information

 

• For general guidance on blocking AI categories, see Block access to Microsoft Copilot AI Chat on ProxySG/EdgeSWG.
• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.