Not able to send email from Outlook app on macOS

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Users accessing internet server via Cloud SWG using WSS Agents.

Users running Microsoft Office 365 applications including the new (not classic) Outlook version.

When users compose an email and select SEND, the email appears in the Outbox immediately but sits there indefinitely without actually being sent.

This is seen with all macOS users and a handful of WIndows users.

CASB integrated with Cloud SWG and Office 365 gatelets enabled.

Cloud Proxy access logs report 400 errors for a number of Outlook endpoints at the time the issue was seen.

Environment

CLoud SWG.

CASB.

Office 365 Applications.

WSS Agents.

macOS.

Cause

The outlookservice streams (https://outlook.office365.com/outlookservice and https://outlook.office.com/outlookservice) do not want to be touched, and the CASB ICAP connection broke the stream.

"outlookservice.hxs" is a URL path associated with the new Outlook application on Windows and macOS. It's related to the communication between the Outlook client and the Outlook.com or Office 365 backend. Specifically, it's used in the servicechannel.hxs endpoint for email sending, receiving, and mailbox synchronization. 

Resolution

Enabled the following policy to handle these endpoints. Note that a ticket with the Broadcom support team is required for the time being, to apply the change via a policy fragment.

define condition BC_Outlook_Auto_Update_URLs
  url.regex = "^https://outlook\.office365\.com/outlookservice"
  url.regex = "^https://outlook\.office\.com/outlookservice"
end

define list domain BC_Cloud_Not_AV_Scannable_domains
  outlook.office365.com/outlookservice
  outlook.office.com/outlookservice
end

define condition BC_Elastica_Exempt_URLs
  url.domain = outlook.office365.com/outlookservice
  url.domain = outlook.office.com/outlookservice
end 

Additional Information

Access logs for the above outlookservice.hxs endpoints constantly show the 400 HTTP status response with invalid_request verdict when intercepted.

Issues does not appear when CASB gatelet for Office 365 disabled.