Description:
An Identification Policy exception might be necessary on Secure Web Gateway (SWG) appliances in order to enable Office to download supplemental content from Microsoft.

Symptoms:
Although some clipart and templates are included with Office, much more is available as part of Microsoft’s online web collections.  Users might find that they are unable to access this online content from within Office applications.  When the administrator reviews the Web Log details that are related to these transactions, the following Identification Status is sometimes observed on the Policy Enforcement tab:

Error during authentication handshake

Cause:
Some Office installations have restrictions on proxy authentication.  For example, most Office 2003 installations will not authenticate when a proxy is deployed transparently (including WCCP installations).  This can prevent users from being able to retrieve supplemental Microsoft Office content.

Solution:
If users are unable to download supplemental Office content from Microsoft, please follow the steps below to add an exception to the SWG appliance’s Identification Policy.  This procedure will work for built-in and custom Identification Policies in which the Exclude by Headers list serves as an exception condition.  If using a custom Identification Policy that does not utilize this Header Fields list, please add it as a condition to the rule that performs authentication and select “Everything except for the items selected below” in the Applies to field.

1. Navigate to Policies -> Condition Settings -> Header Fields.
   
2. Select the Exclude by Headers list.
   
3. Click the Edit button.
   
4. Click the green + button to add a new list entry.
   
5. In the Header Name field, type:
   
   Host
   
6. In the Condition field, select Regular Expression.
   
7. In the Header Value field, type:
   
   .*office(images)?.microsoft.com
   
   The entry should appear as it does in the screenshot below:
   
   
   
8. Click the Save button.
   
9. Commit the changes.

Please give the system ample time to finish committing before testing the change.

Software Versions:
9.x