topic Re: Office 365 URL Filter in General Topics

Office 365 URL Filter

thomas.rogers104 — Fri, 06 Aug 2021 16:12:43 GMT

Hi,

New to Palo Alto so might be an easy solution. Im trying to set up URL filtering to allow Office 365. Ive test the object and policy with other websites such as bbc.co.uk and sky.com so i know my policy works, however, when i add the office 365 URLs from https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide it doesnt seem to work. Any ideas are welcomed

Re: Office 365 URL Filter

Remo — Mon, 09 Aug 2021 11:25:21 GMT

Hi @thomas.rogers104

Did you add the urls to a custom url category which you then use in an url filteringnprofile or directly to a security policy rule?

What exactly does not work? Are the connections blocked to office365? Isn't the traffic using the rule you think it should (the one where you use the office365 urls)? Or does it show some ither errors / problems?

Re: Office 365 URL Filter

thomas.rogers104 — Wed, 11 Aug 2021 10:01:28 GMT

Hi @Remo ,

I added the URLs from the Microsoft website to a custom URL category and then used in a URL filtering profile which i assigned to a policy. The problem seems to be that whenever it goes to login to Office 365 the site is still blocked. My aim is to deny all internet traffic apart from specific sites such as O365.

I know the rule works for other addresses such as bbc.co.uk but doesnt work while authenticating with O365

Re: Office 365 URL Filter

Remo — Wed, 11 Aug 2021 10:31:10 GMT

Hi @thomas.rogers104

Did you add all the urls from that url in your first post in this topic? Including login.microsoftonline.com (which probably is the most important one for the login)?

Re: Office 365 URL Filter

thomas.rogers104 — Wed, 11 Aug 2021 10:48:07 GMT

Hi @Remo ,

yeah ive got that in there

when i go to enter that URL it gets blocked

Re: Office 365 URL Filter

Remo — Wed, 11 Aug 2021 10:51:12 GMT

When you check the logs for this connection, does it hit the security policy rule where you added the custom url category?

Re: Office 365 URL Filter

thomas.rogers104 — Wed, 11 Aug 2021 10:58:40 GMT

When i monitor it i see it attempting to get to 'ms-office365-base' application but its ended with policy-deny

Re: Office 365 URL Filter

Remo — Wed, 11 Aug 2021 13:06:18 GMT

And you did allow this application in the policy? If yes, then I would change your setup a little bit - at least for troubleshooting.

In your existing rule add the custom URL category directly to it instead of the url filtering profile. As URL filtering profile you add temporary one that has everything set to alert.
Create a second rule where you configure again the alert-all URL filtering profile and do not specify an URL category directly in that rule

This way I assume the access will work and you will see in the URL logs which URLs are missing in your custom category.

Re: Office 365 URL Filter

thomas.rogers104 — Wed, 11 Aug 2021 13:02:31 GMT

I think ive got it sorted now. added ms-office365 to the applications on the rule and its allowing it through now. Thanks for your help @Remo , much appreciated.