Hi, From what I know is that usually the Cisco device use ACL to define the interested network traffic for VPN tunnel. So I think you could remove the destination that you want to offload from that ACL, then it will stop from taking IPSEC tunnel.Than...

If you enabled the SSO on your CUCM that will tell your Jabber to use OAuth token to authenticate everything.

Apparently, your issue is with the Oauth Token, either CUC can't get new token from CUCM or your Jabber client can't get token from the CUCM.you can run following command on CUCM and CUC to find out if both has the same token for jabber login. Make ...

Hi   Have you read this Document before?https://www.cisco.com/c/en/us/support/docs/unified-communications/jabber-windows/116517-problem-jabber-00.html