Why decrypt?

[blroberts2]

If we're strictly doing web filtering and the appliance can still detect and filter HTTPS sites with SSL inspection off, why would we want to decrypt?  Solely for the extra granularity like blocking facebook games and such?

[Karsten Iwen]

One example could be that AMP on the WSA finds malicious downloads that your desktop AV would miss. Or Data loss prevention that you can inspect what your users are uploading to cloud-services.

[Tao Yang]

Another case is for user authentication, Here are the options in WSA HTTPs Proxy configuration.

Decrypt for Authentication:	Enabled
Decrypt for End-User Notification:	Enabled
Decrypt for End-User Acknowledgement:	Enabled
Decrypt for Application Detection:	Disabled