SSO not working (user can access internet on new TAB of browser without login)

I have integrated the Active directory users with my Sangfor NGAF, I have created the authentication test policy only on 3 IPs. and int new user authentication I have select "No authentication for new users"
Now users are receiving the sign on page on brower, but when the open new tab without login thay can easily be access youtube, Facebook and everything.

I want to know why its been accessing the internet and how can I block in on these 3 test users.

I want no user can access the internet with out sign on (means no internet for new users)

please remove the SSO and make the policy for the blocking of internet then it works

please review your SSO policy .it looks the problem at your policy .

Specify the users that needs authentication and once authenticated can connect to the internet.

Just input the IP address or hostname of your NGAF device.

1) Review policy configuration to ensure SSO traffic is not inadvertently blocked.
2) Whitelist SSO traffic by creating exceptions or allowing necessary ports/protocols/URLs.
3) Check network connectivity between user devices and SSO server.
4) Verify proper Active Directory integration and SSO authentication settings.
5) Monitor NGAF logs for blocked SSO traffic or authentication failures.
6) Review SSO configuration and consult documentation or vendor for guidance.
7) Contact Sangfor technical support for further assistance if the issue persists.

To prevent the internet access of the 3 test users who bypassed authentication, you can create access control rules on Sangfor NGAF to block their IP addresses from accessing specific websites or the internet entirely.

Your IdP SSO profile settings may be usable only if you use them to configure the SSO profile for your organization.

In the NGAF management interface, look for the Firewall Policy section or something similar. This is where you may configure internet access rules.

Access the Sangfor NGAF management interface: Open a web browser and enter the IP address or hostname of your NGAF device to access the management interface.

Specify the AD authentication requirement: Configure the authentication method to utilize Active Directory inside the policy settings. This guarantees that before being allowed internet access, users must verify against AD.