Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' www.google-analytics.com www.googletagmanager.com d3js.org cdn.polyfill.io *.storage.googleapis.com *.aptrinsic.com js-agent.newrelic.com bam.nr-data.net;style-src 'self' 'unsafe-inline' fonts.googleapis.com *.aptrinsic.com *.storage.googleapis.com;font-src 'self' fonts.gstatic.com *.microsoft.com *.office.net data:;connect-src 'self' www.google-analytics.com d3js.org cdn.polyfill.io *.aptrinsic.com *.azurewebsites.net *.cloudapp.azure.com *.team.viewpoint.com *.blob.core.windows.net www.google-analytics.com d3js.org *.vpanalytics.com js-agent.newrelic.com bam.nr-data.net wss://*.service.signalr.net *.service.signalr.net *.viewpointplatform.com *.vpplatdev.trimble.com *.vistaqa.com:* *.viewpointforcloud.com *.viewpoint.com *.viewpointdev.com *.viewpointcs.com *.4projects.com *.platformapps.trimble.com *.apps.trimble.com;form-action 'self' login.microsoftonline.com *.viewpointplatform.com *.officeapps.live.com https://identity.team.viewpoint.com;frame-ancestors 'self';block-all-mixed-content