About Category Checker

Category Checker is a free MSNugget tool that looks up how a website or URL is categorized by Microsoft Global Secure Access web content filtering, part of Microsoft Entra Internet Access. It's built for Global Secure Access administrators, security administrators, network administrators, cloud architects, and IT professionals who need to confirm a category-based access decision quickly, without opening the full Entra admin center.

Why it exists

Category-based access policies only work correctly if the category you expect for a domain is the category the enforcement point actually uses. Global Secure Access web content filtering policies are written against categories like "Social Media," "Streaming Media," or "Business" — get the category wrong (or assume a domain is categorized when it isn't) and you either block something you meant to allow, or leave something reachable that a policy was supposed to catch. Category Checker exists to make that one lookup fast, so it's a two-second check instead of a policy-testing round trip.

How it works

Category Checker calls the Microsoft Graph getWebCategoryByUrl API — the same categorization data Global Secure Access itself enforces against — using an app-only Entra ID registration with the NetworkAccess.Read.All permission. Every provider (Microsoft Global Secure Access today, more planned) implements the same CategoryProvider interface, so adding another vendor's real API later doesn't change how results are displayed. See msnugget.com for the rest of the MSNugget tool family, and this project's ARCHITECTURE.md for the technical design.

Why aren't FortiGuard, Cisco Umbrella, Zscaler, and Netskope wired up yet?

Each of those vendors either requires a paid subscription and API credentials we don't have, or only offers a free public lookup page that's actively protected against exactly the kind of automated request this tool would need to make. Rather than scrape around that protection — which would be fragile and against the vendor's intent — Category Checker only shows real results for providers it has legitimate API access to. They'll be added as real integrations if and when that access is available.

Independence

Category Checker is an independent, community-built tool. It is not affiliated with, endorsed by, or sponsored by Microsoft, Fortinet, Cisco, Zscaler, or Netskope.