Who Me Too'd this topic

Hi,

To restrict access to specified Microsoft 365 tenant (allow company M365 tenant only), I have tired to follow below link for configuration.

Using HTTP Header Insertion For Sanctioned Access To Office365 ... - Knowledge Base - Palo Alto Netw...

But it's didn't work. Users still available to logon with personal M365 account.

Since URL including below only, is it the root cause ?

• login.microsoftonline.com

• login.windows.net

• login.microsoft.com

• login.live.com

I also tried to use External Dynamic Lists "https://saasedl.paloaltonetworks.com/feeds/m365/worldwide/any/all/url", but user then couldn't be access / browsing all Microsoft webpage.

External Dynamic List is provided by PaloAlto EDL Hosting Service (paloaltonetworks.com)

Secondly, refer to Decryption log, I found error Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20RSA%2

Furthermore, URL filtering license expired is showed in URL filtering, is it impact to configuration?

May I know what's the best practice to achieve it ?

Thanks