Business app inventory
Public SaaS destinations become named apps with owners, policy and usage context.
Approved public apps
Controlled egress for approved public-origin apps
Some business apps are public SaaS, but still need a predictable corporate egress country. BusinessProxy lets administrators model those apps as approved public-origin resources instead of sending the whole browser through a broad proxy.
Public-origin apps must point to public upstreams. Private IPs, localhost and internal DNS names are blocked by guardrails.
Approved SaaS as an appRegion-aware egressNo private upstream abuseUsage counted as app traffic
Use case
Route the work app, not the entire device
A workspace can define a public-origin application for a public business URL and select an approved egress location. The result is easier to review than a broad proxy-all exception.
Selected egress location
The app can use a selected available location when the workspace entitlement allows it.
Policy guardrails
The upstream must be public; the feature is not a back door to private network addresses.
Accounting
Make public app traffic visible
Public-origin access events can be counted in workspace usage breakdowns as app traffic, which separates approved work app traffic from ordinary browsing.
- Keep entitlement and available locations explicit.
- Use public-origin mode only for approved business destinations.
- Detailed egress decision history is planned separately.
Current boundary
Not a general-purpose unblock proxy
Public-origin egress is for approved business apps under workspace policy. It is not anonymity, scraping infrastructure or a way to bypass third-party access rules.
- No private IP, localhost or internal DNS upstreams.
- Universal service compatibility is validated per service.
- This is not anonymity or anti-detection tooling.
Next step
Review the rollout details before turning it on
The documentation page shows what to configure, how to verify the setup and which operational boundaries to review before rollout.