Had to remove the X-Content-Type-Options header. Initially, had no problems. Now, it is impacting ECP pages to have that. Unfortunatley, there is only one value, so it’s on or off. It might be possible to add this back to the OWA page to remove th...

Permissions-Policy fullscreen=() Referrer-Policy strict-origin-when-cross-origin Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Powered-By ASP[.]NET

Content-Security-Policy default-src ‘self’ hxxps://api-12345678.duosecurity[.]com hxxps://.microsoft.com hxxps://.sharepointonline.com data: ‘unsafe-inline’; script-src ‘self’ hxxps://.microsoft.com hxxxps://.sharepointonline.com ‘unsafe-inline’ ‘uns...