Hi,
I don't know what version you're using. But you should configure your WSA not to offload O365 ip and domains.
I achieved this by using the external feed hosted on microsoft earlier.
The procedure to use this method is in the link below.
https://www.cisco.com/c/dam/en/us/products/collateral/security/web-security-appliance/guide-c07-738382.pdf
Unfortunately, as far as i know, microsoft has ended this feed. So this method is no longer valid.
But, i kept the domains from the feed and created a custom category with it. Which works without problem.
I am attaching the url's in the txt file. The regex you should use in your custom category are below:
autodiscover-*.outlook.com
-files.sharepoint.com
-my.sharepoint.com
-myfiles.sharepoint.com
equivioprod*.cloudapp.net
zoom-cs-prod*.cloudapp.net
Your problem should be when your client tries to access to a o365 link that is not allowed or decrypted.
So, create a custom category and exempt that category from decryption and even authentication. Let the unauthenticated users access to this domain.
In Asyncos 11 there should be a built in solution for that.
For more info please read :
https://www.cisco.com/c/en/us/support/docs/field-notices/703/fn70307.html
Regards
Sadik
