Internet traffic blocked by policy violation

enable Implicit policy logging and check the reason , did you using ISDB based policy .

if you are using ISDB then some time office365 ip missing .

first you have to check your DNS server is resolving IP for the office365 and we have to check office365 ip address in ISDB for steps please check below kb

https://kb.fortinet.com/kb/documentLink.do?externalID=FD47288

Hey yeowkm99,

the page you linked is just an explanation that traffic logged as deny may show with the referenced threat ID.
This does NOT explain why traffic is blocked in the first place, which is what I think you're after?

Do you have any kind of authentication setup on your FortiGate?
Given that you mentioned running the browser as admin is a functioning workaround, that sounds to me a little like there might be something going on with authentication.
In particular, running the browser as admin could trigger a login event (that might be picked up through FSSO), or would cause NTLM/Kerberos to detect the admin user.

If the FortiGate for some reason lost the regular user authentication information (timeout maybe?) that could cause traffic to no  longer match (being denied for policy violation instead), and running the browser as admin, treated as a new login, could cause the traffic to match again.
I would suggest you have a look at traffic logs for the affected source IP before and after running the browser as admin, and check what differences there are - for the allowed traffic, does a username show in the logs, for example?
You might want to enable logging all sessions in the policy, to ensure that allowed traffic is captured properly.

Cheers!

Long shot, but you might check to see if your DCs were updated last night.  This week's updates caused some DC auth issues.

https://www.bleepingcomputer.com/news/microsoft/windows-kerberos-authentication-breaks-due-to-security-updates/

If you have FSSO in place, perhaps it isn't able to properly communicate with your DCs and that is why only Administrator is working?  That kind of makes sense if you are launching the browser with Domain Admin rights (actually this is a nightmare, never do this!), but if you are speaking about local administrator rights then perhaps a dead end.  You can copy your policy that uses authentication and remove that feature, place it above your current policy and disable the one that isn't working until you are able to better review your Fortigate and or FSSO logs.  I'd open a case with the TAC, they should be able to help.