Outlook and mapi-over-http

[mariusz.rendaszka]

Hello team,

Today, I had problems connecting Outlook 2019 to Exchange Online. After analyzing: it turned out that my PA suddenly started dropping the Mapi-over-http application, which it didn't need previously. What could be causing this behavior?

[JayGolf]

Hi @mariusz.rendaszka ,

When something that's been working suddenly starts getting dropped/blocked, Id recommend looking at the traffic logs. What does the actual session-end reason show? Also, which security policy was it previously hitting? & what is it doing now? (is it not hitting a policy and hitting your deny rule?) Reviewing these will help us determine the root cause and help narrow down whether this is a policy matching/ security profile enforcement/App-ID behavior change issue. 

[mariusz.rendaszka]

Hi @JayGolf 

Previously, Outlook traffic was under SSL and WebBrowsing rules, and now under mapi-over-http, which was previously not in the logs. Nothing was changed in the PA rules.

[JayGolf]

@mar 

Gotcha, that makes sense. App-ID can dynamically reclassify traffic as it gains more context, and in this case it’s being identified as mapi-over-http. App-ID behavior can also change as part of regular content updates, even when no policy changes are made.

At this point, you've reviewed the traffic logs to confirm how the session is now being identified. You can either add the mapi-over-http app to the appropriate outbound security policy or create a small, explicit rule for this traffic (or related Windows traffic) so it’s handled intentionally.