Issue
Microsoft has designated cloud.microsoft as the top-level domain (TLD) for Microsoft 365 services. A portion of M365 traffic, including Microsoft Copilot and other M365 SaaS surfaces, is served under this domain.
Netskope’s M365 default bypass list currently includes two subdomains under this TLD: outlook.cloud.microsoft and teams.cloud.microsoft. The wildcard *.cloud.microsoft is not included. Where SSL inspection is enabled, traffic to *.cloud.microsoft is inspected in the same manner as other web traffic.
Solution
Netskope provides a policy setting to add *.cloud.microsoft to the M365 default bypass list.
This setting is disabled by default for all customers, new and existing. Customers may enable this setting at their discretion.
Microsoft Reference
- Information about cloud.microsoft domain. https://aka.ms/cloud.microsoft
- Microsoft recommendation to exempt Microsoft 365 traffic from TLS decryption: https://aka.ms/m365_tls_decryption_guidance
Policy Impact
-
If the policy is enabled: traffic to *.cloud.microsoft is bypassed.
-
If the policy is disabled: there is no impact; traffic to *.cloud.microsoft continues to be inspected.
Questions or need help deciding?
Contact your Netskope account team or open a support case if you’d like help assessing whether enabling this setting is right for your environment.