"logincdn.msauth.net" being identified as "Phishing"

Question

Bad pattern update? 
 Several SG customers have this issue since today. XG detects it as "Information Technology"

kerobra_retired · Accepted Answer

Hi JeffK, 
 the behavior is normal. Even when the webfilter is working with no active SSL decryption the default setting is to check https pages against the category filter. 
 The block page of the UTM is shown (or at least tried to be shown) in https, so that is the cause why the https certificate of the UTM is shown to the client which here complains about an untrusted certificate. Even with installed CA certificate the connection would have been blocked. 
 Real failure here is the wrong categorization of the Microsoft URL. 
 Yes you can create an exception for the thousands of O365 URLs and then Office would have worked normal. But I would really appreciate if Sophos would stop false-positiving the Microsoft URLs instead.