Technical Tip: DLP profile is not blocking credit card info when outlook desktop app is using HTTPS

Configure Outlook to use MAPI over HTTP or RPC over HTTP protocols and ensure that the data transferred is not exclusively over HTTPS. The FortiGate needs to have MAPI-over-HTTP enabled in the SSL inspection profile:

config firewall ssl-ssh-profile
    edit deep inspection
        set mapi-over-http enable   ---> By default, it is disabled.
end

It has been confirmed that a functional version of the Outlook desktop app is Version 2405, Build 16.0.17628.20006. Newer versions do not support the MAPI protocol for traffic from the Outlook desktop app.

Use the following debug command to determine if the Outlook desktop app is using MAPI or HTTPS:

diagnose debug reset

diagnose sys scanunit debug all

diagnose debug enable

1. Run the DLP test, wait until it fails, and check the logs.
2. Stop the debugs: diagnose debug disable.
3. Save the output obtained in the CLI.

Execute the WAD debugs:

diagnose wad debug enable category all
diagnose wad debug enable level verbose

diagnose wad debug enable cate http
diagnose wad debug enable cate mapi
diagnose debug console timestamp enable
diagnose debug enable

Repeat the steps mentioned above from 1 to 3.

If needed, open a TAC ticket to get help interpreting the collected debug information.

Reach Microsoft support to get additional assistance on how to configure the recent Outlook desktop app if it is possible.