Technical Tip: FortiSASE bypass for a Microsoft Windows update

1. In the FortiSASE Portal, go to Endpoint Management -> Endpoint Profiles.
2. Create or select an existing Endpoint Profile of choice. Under the Connection section, scroll down to 'Steering bypass destinations'.
3. Under the 'Steering bypass destinations', the following Infrastructure and FQDN objects should be added.

Infrastructure objects:

• Add the infrastructure objects: Microsoft-Microsoft.Update and Microsoft-WNS.

FQDN:

• definitionupdates.microsoft.com
• prod.do.dsp.mp.microsoft.com
• dl.delivery.mp.microsoft.com
• windowsupdate.com
• delivery.mp.microsoft.com
• update.microsoft.com
• windowsupdate.microsoft.com
• adl.windows.com
• tsfe.trafficshaping.dsp.mp.microsoft.com
• api.cdp.microsoft.com

Refer to this resource for the comprehensive list of FQDN objects related to the Windows Update: Microsoft Windows Update.

Note: Some IPs may belong to other ISDB objects such as 'Akamai-CDN'. When this happens, traffic to those specific destinations may still pass through the VPN tunnel to FortiSASE.