Office 365 cannot activate with MCP

[dadialla]

Hello,

We're working in an enviroment with MWG 7.8.2, and it works propperly when the proxy is configured in the browser and now we're planning to deploy MCP over all the company machines.

In order to test, when we configure MCP in a workstation (and no configured in browser), the behaviour it's exactly the same that when we configure the proxy in the browser, but only one function it's not working properly, the office 365 activation. When we open Word for example, the message that the product it's not activated appears inmediatly, but it's the only thing that it's not working, if you try access to any webpage load without problem, also if the webpage it's blocked by the proxy, appear the block webpage.

We also have the cloud configuration added, but in this momment we're performing the test with the on premise proxy before continue configuring the cloud one.

In order to check where is the incident we have tried with differents configuration like:

- Add the bypass 365 rulse form the library (anyway, without this ruleset it's working properly when we configure the proxy in the browser)

- Create a rule at the beggining that send all the traffic to the next-hop(to avoid that maybe any rule it's blocking that)

- Creating ruleset for MCP authentication from some examples found here (https://community.mcafee.com/t5/Documents/Web-Gateway-Choosing-the-right-Authentication-Method-for-y... ; https://community.mcafee.com/t5/Web-Gateway/Web-Gateway-Authentication-Chain/td-p/475617

It looks like Office produts don't know where to send the request when no proxy is configured in browser, if in that momment we enable again the proxy configuration in the browser, it's enabled automatically ... Has somebody experienced something like this? Thank you so much

[AaronT]

Are your users able to resolve external DNS while on your company network?  If not, that could be why it is failing.

On Windows, most applications know to send all requests to the proxy, if it's defined and let the proxy do the DNS lookup.  However, without a proxy, the application may attempt to lookup the DNS name, fail (because it can't), then "stand down" without ever sending a packet on the wire.  Because of this, MCP will not forward the traffic, because no traffic generated.

MCP will not forward packets until the application puts them on the wire and on the "right" port for MCP.  So if the application does not send a packet, MCP won't do anything, and the application will assume it is not on the internet.

[dadialla]

Thanks for the info @AaronT , I think that  scenario commented match with ours, so this week we want to perform the test and ensure about the DNS resolutions and study a solution, I would let you know as soon as we know someting

[pakorn]

Hi @AaronT @dadialla  

Do you think this app can support witn MCP

[AaronT]

@pakorn - short answer?  yes. 

More details:  You might not be able to TLS/HTTPS inspection on the traffic to the below IPs/ports to make it work.  Reuters apps sometimes require this to work correctly

Hope this helps 

[dadialla · Accepted solution]

Hello, just fyi the resolution was to add the URL activation.sls.microsoft.com in exceptions, after verify that, we've added into the proxy whitelist instead MCP exceptions and it's working without problems

[Former Member]

Hi,

I did not understand where the informed URL should be configured, and could you confirm that the URL is correct?
Is it a "L" or an "i"?

Thanks in advance

[dadialla]

Hello @Former Member  , in our case we've added the url in our proxy whitelist, avoiding other rules (like SSL inspection, authentication, ...) 

It's a L