Umbrella | URL being blocked despite being whitelisted

[anfare]

I don't understand what is going on here. I have a domain on the enforced whitelist. When I test the policies, the domain is always allowed. But when I try to visit the site, I get "This site is blocked due to content filtering" block page. The diagnostic info isn't very helpful, just lists a Bundle ID and the host is block.opendns.com which doesn't seem helpful. 

Any idea what is going wrong?

[Georg Pauwen]

Hello,

which domain is whitelisted ? Chances are that that particular domain fetches content from other sites (which you have not allowed). Try the Google prefetch tool (link below) to identify additional sites that your domain is accessing...

https://support.umbrella.com/hc/en-us/articles/230904008-Guide-to-best-practices-for-allowing-or-blocking-domains-in-Cisco-Umbrella

[anfare]

Thanks for the reply. I did see that article about watching the HAR for additional domains. The domain in question is intune.microsoft.com and it doesn't call any blocked subdomains, it is being fully blocked for some reason I don't understand despite both microsoft.com and intune.microsoft.com being whitelisted. 

[anfare]

I'm seeing this on multiple domains too-very confusing. Here azure is in the whitelist:

According to the documentation, you don't need to explicitly add subdomains. The policy tester shows the domain as allowed:

Yet when I try to go to a subdomain, I get blocked:

And none of these blocks are showing in the Activity Search for some reason despite all policies being set to "Log All Requests":

which is making it even harder to diagnose....

[Georg Pauwen]

Hello,

I don't want to give stupid advice and mention the obvious, but check if you have 'Allowed-Only Mode' enabled...

https://docs.umbrella.com/deployment-umbrella/docs/create-and-apply-policies#advanced-settings

[anfare]

Thanks, always welcome any help/advice, but unfortunately this time it isn't that easy (i.e. allowed-only mode is not enabled). 

[anfare · Accepted solution]

I think this was another instance of me not being aware that there is also a Web Policy enabled that is impacting users. I checked the policy tester for DNS but I don't think I checked the Web policy tester and I think that was what was causing this block. Still not clear on why the allow destination list didn't take precedence, but disabling the web policy along with dns policy seemed to fix the issue.