M365 slowness via Prisma

[Sanjay_Ramaiah]

Hi Team,

We are facing issues with the M365 via prisma. If we bypass prisma it feels better to access. If it is via Prisma it is pretty slow. Any suggestions on how to troubleshoot this issue.

Regards,

Sanjay S

[nikoolayy1]

Why ask this question in the NGFW section not the Prisma Access one?

Outside of that you may need to exclude some urls from decryption to speed things up 🙂

See:

https://live.paloaltonetworks.com/t5/automation-api-discussions/do-not-decrypt-ssl-traffic-for-offic...

https://live.paloaltonetworks.com/t5/blogs/edl-hosting-service-helps-to-safely-enable-microsoft-365/...

[Sanjay_Ramaiah]

Thank you Nikoolayy for the inputs. And sure will address these queries in Prisma Section in furture.

Just to understand one thing, Decrypt rule base should only consists of IPs and FQDNs right? how an i include the URLs?

[nikoolayy1]

The only thing you can do without decryption outside of fqdn/ip address is SNI:

How to identify url information on SSL traffic without decryption

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PObsCAG&lang=en_US%E2%80%A...

[NuvinG]

I have noticed significant issue when users are for example connected via a gateway in Italy, UK or Spain and then goes through a service connection located in France.