Isolating Exchange Server with AMP / OWA still accessible

[JuliaMora15110]

Hi there, 

We recently isolated an Exchange Server using the AMP Dashboard. However, it appears that the Outlook Web Access (OWA) application that is running from it, was still active and accessible from the internet. 

Please clarify if AMP Isolation means all applications and connections to the server should be prevented? 

[ppreenja]

Hi Julia,

The endpoint isolation should only allow communication between Windows Connector and Cisco Cloud unless any other communication is explicitly allowed in the "IP isolation allow list".

If the "IP isolation allow list" doesn't have any communication defined to & fro from Outlook then I would request you to please open a TAC case and get the issue further investigated.

Please refer the below Cisco Secure Endpoint user guide for more details:

https://docs.amp.cisco.com/en/SecureEndpoint/Secure%20Endpoint%20User%20Guide.pdf (Pg-122)

Cheers,

Pratham