FortiSASE and Microsoft CDN/FrontDoor DNS

Hi

Has anyone managed to solve a problem with FortiSASE (and it's probably the same with Fortigate) where the Fortiguard DNS lookups for the likes of device.autopatch.microsoft.com will return an IP address that matches another service that's hosted in Azure? Which ends up conflicting with policies when you're trying to create explicit ones for MS services and updates, but then random websites get bundled in...?