IP address is Exempt from SSL decryption But traffic log shows decrypted

[MP18]

There is this Microsoft Application autopilot with tons of urls and destination IP addresses.

I have created the SSL decryption Rule on Top for no decryption for all those IP addresses.

When i see traffic logs it shows decrypted when i see url logs it shows no decryption for those IP's.

Is this by design?

I never saw like this before?

[vsys_remo]

Did you configure the decryption rule with any as source IP/zone? Is it really the same session in URL and traffic log? Does the session where decrypted still shows 'yes' hit your decryption exemption rule?

[MP18]

Source zone is defined but source address is any.

yes it is same session in traffic and url logs, i did search by same source and destination in both traffic and url logs.

under traffic logs i see decrypted as checked do you mean that?