Prisma Access Web Security blocking access to M365/teams/outlook

[CyberEng]

Hi, anytime we enable "web security" as recommended on the main dashboard of prisma access, MS Teams and outlook stop working.  Outlook throws up certificate errors and teams refuses to connect.  Upon investigation it looks as though the traffic is being decrypted and this is causing issues.  We have put in bypass decryptions for the "worldwide 365 URL" and "worldwide 365 IP" lists in our network security decryption policy.  However the logs clearly show this traffic is still being decrypted and breaking the application.  It appears that the "web security" feature / policy later is overriding anything set at the network security layer with regards to encryption.

As soon as we disable "web security" the applications start working again.  How should we configure the web security feature to bypass decryption for all M365 URLS and IP's?

Many thanks.

[nikoolayy1]

https://live.paloaltonetworks.com/t5/prisma-access-discussions/split-tunnelling-for-m365/td-p/540192

[JoeCheng]

I am currently experiencing the same issue. I noticed that installing the Root CA allows decryption to work correctly,

but if I install Forward-Trust-CA, the same problem occurs.

[CyberEng]

Thanks for the reply folks - much appreciated.

In the end I did not enable split tunnel.  What I did was create an EDL to the "M365 worldwide URLS" at https://saasedl.paloaltonetworks.com/feeds/m365/worldwide/any/all/url

Then under "web security" > "Global Decryption exclusions" > "bypass URL categories" I added in the External dynamic List.