Cloud Policy Details

This setting enables and configures the device-based tenant restrictions feature for Azure Active Directory.

When you enable this setting, compliant applications will be prevented from accessing disallowed tenants, according to a policy set in your Azure AD tenant.

Note: Creation of a policy in your home tenant is required, and additional security measures for managed devices are recommended for best protection. Refer to Azure AD Tenant Restrictions for more details.

https://go.microsoft.com/fwlink/?linkid=2148762

Before enabling firewall protection, ensure that a Windows Defender Application Control (WDAC) policy that correctly tags applications has been applied to the target devices. Enabling firewall protection without a corresponding WDAC policy will prevent all applications from reaching Microsoft endpoints. This firewall setting is not supported on all versions of Windows - see the following link for more information.
For details about setting up WDAC with tenant restrictions, see https://go.microsoft.com/fwlink/?linkid=2155230

Cloud ID (optional):

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	cloudid
Value Type	REG_SZ
Default Value

Azure AD Directory ID:

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	tenantid
Value Type	REG_SZ
Default Value

Policy GUID:

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	policyid
Value Type	REG_SZ
Default Value

Enable firewall protection of Microsoft endpoints

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	enforceFirewall
Value Type	REG_DWORD
Default Value
True Value	1
False Value

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	hostnames
Value Type	REG_MULTI_SZ
Default Value

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	subdomainSupportedHostnames
Value Type	REG_MULTI_SZ
Default Value

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
Value Name	ipRanges
Value Type	REG_MULTI_SZ
Default Value