Allow Office365 Outlook.com email but block Free outlook.com email

[DirtyBlueshirt]

We have a scenario where we block webmail in our environment, except for corporate webmail sites. With a hosted Exchange option and OWA this is easy. However we are getting contractors who are shifting their email to Office365, which authenticates users via outlook.com. Is there a way to allow Office365 authentication to outlook.com without allowing the user to log into the free version of outlook webmail as well? Our environment is using FortiOS v5.0.11.

[damiri]

Contractors are usually in separate VLAN. So you can create policy for that VLAN?

[DirtyBlueshirt]

damiri wrote:

Contractors are usually in separate VLAN. So you can create policy for that VLAN?

In our environment they are not, though the users will have reserved DHCP addresses. We also have an offshore office where this would be applied to the entire site.

The issue isn't segregation of policy. The issue is that for Office365 to authenticate, you need to allow access on HTTPS to the root outlook.com domain as well. On its own this would also grant access to the free webmail component of outlook.com. We want to prevent access to the free webmail component while still letting the user authenticate and log in to the Office365 business version of Outlook webmail.

[damiri]

Then I would copy existing policy and use it on that IP range you have reserved for contractors if this type of operations isn't actually doable thru web or application filter. With this, you will have one policy for them and you can apply whatever you want for them while you are keeping your internal users policies in order. That's how I would do it.

[gschmitt]

Basically you want https://www.youtube.com/watch?v=-G19h1poSoA this with Office365...

I don't think that will be doable without allowing all of Outlook.com but we'll try...

Are you blocking Web Mail with a Web Filter?

Make sure the Multiple Security Profiles feature is enabled for that one.

Go to Security Profiles > Application Control and select Create New in the top right corner

Name it "O365"

Select the action for all categories to Block

In Application Overrides select Add Signatures and search for these three:

[ul]

Microsoft.Office.365

Microsoft.Office.365.Login

Microsoft.Office.365.Outlook.Web.App[/ul]

Select them and hit User Selected Signatures

Set action to Allow

Create a new policy without your Web Filter profile and use this Application Filter

Move it on top of your other policy

[Big_Abe]

You beat me by 2 hours!

I was looking forward to providing a smart answer in the fourms. 

[DirtyBlueshirt]

gschmitt wrote:

Basically you want https://www.youtube.com/watch?v=-G19h1poSoA this with Office365...

I don't think that will be doable without allowing all of Outlook.com but we'll try...

Are you blocking Web Mail with a Web Filter?

Make sure the Multiple Security Profiles feature is enabled for that one.

Go to Security Profiles > Application Control and select Create New in the top right corner

Name it "O365"

Select the action for all categories to Block

In Application Overrides select Add Signatures and search for these three:

[ul]

Microsoft.Office.365

Microsoft.Office.365.Login

Microsoft.Office.365.Outlook.Web.App[/ul]

Select them and hit User Selected Signatures

Set action to Allow

Create a new policy without your Web Filter profile and use this Application Filter

Move it on top of your other policy

Thanks, I'll try that and let you know!

[ciap123]

Hi, I need the same on my company, did the application control option work for you?

Thank you.