Thanks for the information! We are going to hold this in reserve. At least we know that it is feasably possible.   We are speaking to one of the regional municipalities about their in house solution. It seems they have made something like this that we may possibly "copy and paste".   Wouldn't that be great if it worked 😉   Have a good weekend.   ... View more

@Brandon_Wertz: We added those previously and nothing - traffic was still blocked for some or other reason   In the end we resolved this by adding every IPv4 address MS has listed to Addresses with an appropriate Tag.   In Address Groups we created a Dynamic Group based on the aforementioned Tag.   In Policies we allowed for the Address Group. And now our clients are able to authenticate the Office 365 license. The authentication process is ridiculousloy slow though. With all traffic enabled, license authentication takes a second or two. With the internet restricted and this rule in place...it takes 2 - 3 minutes to authenticate. Very strange this, not to sure where the optimisation must be done.   As we only need to get a license, we only added all IPs relating to Portal and ID.   (Ps: But...to cover our bases - I have also added the IPv6 to Addresses, URLs to URL Category and created an Application Group based on the needed O365 applications in the PAN-2020. Nothing wrong with a little overkill 😉   Cheers and thanks for the help Anthony ... View more

Ok will give that a try, thanks for the tip. ... View more

Still not getting the desired results. 😞   I've tried the following (and a combination of the following):   1) Taken all the URLs and placed them in a new URL category in Objects. Placed this into the main Policy that allows for traffic irrespective of when we have to close access to the internet. Result = access still blocked   2) Taken all the individual IPs (599 of them) and placed them into a URL category in Objects. And updated this to the main rule. Result = no access   3) In a pique of curiosity - I created the rule to allow for all traffic to "www.*.com" and "*.com". And that didnt work either.   4) I have opened up all traffic, took a copy of the destinations that were used, created a rule for them and tried that once the blocks were in place...nope.   5) I have gone through the Application filters and updated the main policy to allow for ms-office365 and all other derivaties I could find...but that didnt work either.   So - any other tips? I am not a network specialist (clients & scripting are my main) but I cannot understand why it is not working or what is actually been blocked. Unfortunatley too much information is been hidden within the "not-application" description in the Monitor. I can see that the IPs are within the correct subnet range and ports are correct (80 and 443) for Office365 traffic. But why are the applications getting hidden by "not-applicable"?         ... View more