I have gone the cheaper or route the license for GP is $$$ so i use split tunnel routes
https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service offical ip ranges used by MS for services - pick the skype ones it covers MS teams from my under standing
i run this script to produce something I can cut and paste into panorama
#!/bin/bash
#
# guid
# https://www.guidgenerator.com/online-guid-generator.aspx
#
guid=<generate one>
tp="/tmp/$guid"
#
# https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service
#
wget -O "$tp" -q 'https://endpoints.office.com/endpoints/WorldWide?ClientRequestId=<getyourown>&AllVersions=false&Form...'
#
theips="prefix other ips"
for x in $( cat "$tp" | sed -e 's/^[^,]*,[^,]*,"[^"]*",//;s/"[^"]*",//;s/^,.*$//;/^id,.*$/d;/^$/d;s/^"\([^"]*\)".*$/\1/;s/,/ /g')
do
#echo $x
theips="$theips $x"
done
echo "# this is for the <agent name1> people on the gateway"
echo "set template Active_Passive config vsys vsys1 global-protect global-protect-gateway alcpa-vpn-gateway remote-user-tunnel-configs <agent name1> split-tunneling exclude-access-route [ $theips ]"
echo "# this is for the non singapore people on the gateway"
echo "set template Active_Passive config vsys vsys1 global-protect global-protect-gateway alcpa-vpn-gateway remote-user-tunnel-configs <agent name2> split-tunneling exclude-access-route [ $theips ]"
echo "# this is for all on the gateway"
echo "set template ybopa config vsys vsys1 global-protect global-protect-gateway ybopa-vpn-gateway-external remote-user-tunnel-configs <agent name3> split-tunneling exclude-access-route [ $theips ]"
echo
