A method performed by data apparatus (102, 202, 218, 304) of a network (100, 200), the method comprising: maintaining i) first data that identifies forbidden resources hosted outside the network that client devices (104, 204, 302) on the network are not permitted to access, and ii) second data that associates, for each forbidden resource, a permitted resource that the client devices on the network are permitted to access, wherein each permitted resource offers comparable services as its associated forbidden resource, wherein the forbidden resources comprise cloud applications under different administrative control than the network is under; intercepting (310, 312) i) a first request (106, 208) from a first client device from among the client devices on the network for a resource hosted outside the network to provide support for group accounts and individual accounts and ii) a second request for the resource, the second request from a second client device from among the client devices of the network that is different from the first client device, wherein individual accounts are associated with a single user, and the group accounts are associated with a group or organization; determining (312, 314) that the requested resource is a forbidden resource for the first client device and a permitted resource for the second client device, based on the first data; routing, responsive to determining that the requested resource is a permitted resource for the second client device, the second request to an individual interface of the requested resource to cause the individual interface to permit access for the second client device to an individual account of the requested resource; and redirecting (314N, 318), responsive to determining that the requested resource is a forbidden resource for the first client device and based on the second data, the first request to a group interface of the requested resource to cause the group interface to permit access (320, 322) for the first client device to a group account of the requested resource. maintaining i) first data that identifies forbidden resources hosted outside the network that client devices (104, 204, 302) on the network are not permitted to access, and ii) second data that associates, for each forbidden resource, a permitted resource that the client devices on the network are permitted to access, wherein each permitted resource offers comparable services as its associated forbidden resource, wherein the forbidden resources comprise cloud applications under different administrative control than the network is under; intercepting (310, 312) i) a first request (106, 208) from a first client device from among the client devices on the network for a resource hosted outside the network to provide support for group accounts and individual accounts and ii) a second request for the resource, the second request from a second client device from among the client devices of the network that is different from the first client device, wherein individual accounts are associated with a single user, and the group accounts are associated with a group or organization; determining (312, 314) that the requested resource is a forbidden resource for the first client device and a permitted resource for the second client device, based on the first data; routing, responsive to determining that the requested resource is a permitted resource for the second client device, the second request to an individual interface of the requested resource to cause the individual interface to permit access for the second client device to an individual account of the requested resource; and redirecting (314N, 318), responsive to determining that the requested resource is a forbidden resource for the first client device and based on the second data, the first request to a group interface of the requested resource to cause the group interface to permit access (320, 322) for the first client device to a group account of the requested resource.