topic Re: Prisma Access Web Security blocking access to M365/teams/outlook in Prisma Access Discussions

Prisma Access Web Security blocking access to M365/teams/outlook

CyberEng — Tue, 30 May 2023 21:57:20 GMT

Hi, anytime we enable "web security" as recommended on the main dashboard of prisma access, MS Teams and outlook stop working. Outlook throws up certificate errors and teams refuses to connect. Upon investigation it looks as though the traffic is being decrypted and this is causing issues. We have put in bypass decryptions for the "worldwide 365 URL" and "worldwide 365 IP" lists in our network security decryption policy. However the logs clearly show this traffic is still being decrypted and breaking the application. It appears that the "web security" feature / policy later is overriding anything set at the network security layer with regards to encryption.

As soon as we disable "web security" the applications start working again. How should we configure the web security feature to bypass decryption for all M365 URLS and IP's?

Many thanks.

Re: Prisma Access Web Security blocking access to M365/teams/outlook

nikoolayy1 — Sat, 01 Jul 2023 10:48:04 GMT

https://live.paloaltonetworks.com/t5/prisma-access-discussions/split-tunnelling-for-m365/td-p/540192

Re: Prisma Access Web Security blocking access to M365/teams/outlook

JoeCheng — Mon, 31 Jul 2023 08:19:19 GMT

I am currently experiencing the same issue. I noticed that installing the Root CA allows decryption to work correctly,

but if I install Forward-Trust-CA, the same problem occurs.

Re: Prisma Access Web Security blocking access to M365/teams/outlook

CyberEng — Mon, 31 Jul 2023 10:28:49 GMT

Thanks for the reply folks - much appreciated.

In the end I did not enable split tunnel. What I did was create an EDL to the "M365 worldwide URLS" at https://saasedl.paloaltonetworks.com/feeds/m365/worldwide/any/all/url

Then under "web security" > "Global Decryption exclusions" > "bypass URL categories" I added in the External dynamic List.