Advanced Application Controls

Some web-based applications offer the option to allow users to access the site but not to perform activities such as uploading, downloading, posting, or sharing content on those sites.

Depending on the destinations you select in an internet access rule, you will see an Advanced Application Controls section.

This section appears only if destinations added to the rule include one or more applications that allow granular controls on activities. These applications must be included in application lists or application categories selected as destinations, or be individual applications selected from application categories.

Use these advanced controls if you want to allow access to the site but block certain actions. If you don't want to allow access to the site at all, select the application, Application List, or Application Category in the destination list for the rule.

Table of Contents

• Applications with Advanced Controls
• Prerequisites for Advanced Application Controls
• Configure Advanced Application Controls
• Troubleshooting

Applications with Advanced Controls

If apps have advanced app controls, you can block all content for the app, block the app from uploading content including posts and shares, block the app from downloading content, or block the app from deleting content.

• Cloud Storage
• Collaboration
• Content Management
• Media
• Office Productivity
• P2P
• Social Networking

Cloud Storage

Collaboration

Content Management

Media

Office Productivity

P2P

Social Networking

Prerequisites

• Full Admin user rule. For more information, see Manage Accounts.

Procedure

1. In an internet access rule, add as destinations any application categories or applications from the table above, or a configured application list that includes any of the above applications or categories.
2. The Advanced Application Controls option will appear:
   
3. Click Edit.
4. In the pane on the left, select the types of activities to block:
   
5. (Optional) Filter the list in the main pane by clicking All categories and choosing a category.
6. In the main pane, select the activities to block for each application in the list
7. (Optional) If you filtered the list, choose a different category, then select the activities to block for that category.
   Repeat as needed for each category in the All categories list.
8. Click Save.

Troubleshooting

If advanced application control is not working as expected, check the following:

• Decryption must be enabled in the security profile selected in the rule.
• The site must not be on the Do Not Decrypt list selected in the security profile.
• The domain—for example, dropbox.com—is not configured for Bypass Web Proxy on the Connect > End User Connectivity> Internet Security page. Any domains or IPs on this list will bypass Secure Access and be routed by your local DNS server. This list applies to PAC file and AnyConnect deployments.
• When an application is blocked, a web notification page will not be displayed. Instead, an error message will be displayed in the application.

---

Block Internet Access to Geographic Locations < Advanced Application Controls > Global Settings for Internet Access Rules