topic Re: Outlook and mapi-over-http in General Topics

Outlook and mapi-over-http

mariusz.rendaszka — Mon, 29 Dec 2025 12:03:36 GMT

Hello team,

Today, I had problems connecting Outlook 2019 to Exchange Online. After analyzing: it turned out that my PA suddenly started dropping the Mapi-over-http application, which it didn't need previously. What could be causing this behavior?

Re: Outlook and mapi-over-http

JayGolf — Wed, 31 Dec 2025 01:19:34 GMT

Hi @mariusz.rendaszka ,

When something that's been working suddenly starts getting dropped/blocked, Id recommend looking at the traffic logs. What does the actual session-end reason show? Also, which security policy was it previously hitting? & what is it doing now? (is it not hitting a policy and hitting your deny rule?) Reviewing these will help us determine the root cause and help narrow down whether this is a policy matching/ security profile enforcement/App-ID behavior change issue.

Re: Outlook and mapi-over-http

mariusz.rendaszka — Wed, 31 Dec 2025 10:16:54 GMT

Hi @JayGolf

Previously, Outlook traffic was under SSL and WebBrowsing rules, and now under mapi-over-http, which was previously not in the logs. Nothing was changed in the PA rules.

Re: Outlook and mapi-over-http

JayGolf — Wed, 31 Dec 2025 19:36:30 GMT

@mar

Gotcha, that makes sense. App-ID can dynamically reclassify traffic as it gains more context, and in this case it’s being identified as mapi-over-http. App-ID behavior can also change as part of regular content updates, even when no policy changes are made.

At this point, you've reviewed the traffic logs to confirm how the session is now being identified. You can either add the mapi-over-http app to the appropriate outbound security policy or create a small, explicit rule for this traffic (or related Windows traffic) so it’s handled intentionally.

Re: Outlook and mapi-over-http

mariusz.rendaszka — Fri, 02 Jan 2026 18:35:30 GMT

That's what I did. Thank you for your help, Jay.