Why inspection and Teams cannot be friends
- Media is SRTP — already encrypted, keys negotiated end-to-service; an inspecting middlebox can't read it, only damage it (buffering UDP-turned-TCP flows, mangling long-lived sessions, adding jitter that concealment can't hide).
- Certificate pinning and token flows dislike forged certs: some Teams/Graph endpoints fail closed behind resigning proxies, producing sign-in loops and half-dead clients.
- Scale: a proxy sized for web browsing meets hundreds of persistent signalling connections + (if UDP is blocked) TCP-fallback media — connection tables and CPU melt at the worst moment (the all-hands).
The vendor-neutral rule from Microsoft's own guidance: Optimize endpoints bypass everything (no proxy, no inspection, direct route); Allow endpoints direct where possible; Default may ride the proxy. That's three PAC-file/SD-WAN rules, automatable from endpoints.office.com (worth a scheduled job — the list version-bumps and your bypass rot begins the day it drifts).
Inspection-shaped failure signatures
| Symptom | Mechanism |
|---|---|
| Sign-in loop on corp network, fine on hotspot | Resigned cert breaking token endpoints |
| Media connects only as TCP 443, high latency | UDP denied; TURN/TCP via proxy = rung 4 of the ladder |
| Calls die at proxy session-timeout boundaries | Long-lived flow hit the proxy's max-session timer |
| Random 'can't reach' for some services only | Partial bypass list — one hostname category missed |
| Everything slow 9:00-9:30 | Proxy CPU saturation at login storm + Teams reconnects |
What to watch (proofs)
- Where trust breaks: on an affected client, the cert chain presented for teams.microsoft.com (browser or openssl) — issuer = your proxy CA means inspection is active on a hostname you meant to bypass.
- The transport tell: CQD transport dimension for on-net users — TCP share is the bypass-health metric; it should be near zero and its trend is your early warning.
- PAC truth: fetch the live PAC file, test the Optimize hostnames/IPs through it (proxy libraries and browser dev tools both evaluate PACs) — belief vs behaviour in one check.
- Endpoint-list drift: your automation's endpoints.office.com version vs current — stale version number = new ranges going through the proxy already.