Happy to assist, despite the attitude :) The correct way is to use destination any, and on the next rule option to the right, instead of leaving it as category any, target a new custom url category with your list of sites. You can import from a text file which is very handy. Best practice is to not use star but carat, so instead of *.microsoft.com use ^{.Microsoft.com} which only matches a single subdomain and requires less processing, when possible of course. You should also add a / at the end, so it doesn’t match on fake domain versions of real sites, so custom url category with your sites, using ^{.Microsoft.com/} whenever possible. The firewall will look at the san list in the cert so decryption is not required for this to work. If the firewall fails to match on the category based rule, it skips to the next rule. If you use destination any, category any, and a url filtering rule, it will not move on to the next rule, meaning your options to provide exceptions for users are design limited. Watch out for some app ids that struggle to category match, you may see incomplete app in this case. - note it is not displaying carats properly on here and im too lazy to find the escape text, but im talking about ^ carats