M365 Optimize Inspection Exemption — Decision Instruments
A three-document set for exempting the Microsoft 365 Optimize endpoint set from TLS break-and-inspect at branch direct-internet egress, under SC-7(4)
M365 Optimize Inspection Exemption — Decision Instruments
All three carry bracketed fields requiring agency values, and Attachment A’s example rows use RFC 5737 documentation addresses. Nothing here is an agency-approved form — confirm the structure against your own risk-acceptance procedure and delegation of authority before use.
The problem these answer
A branch site running Microsoft 365 over local direct internet access has to decide what happens to the Optimize endpoint set. Microsoft’s connectivity guidance says bypass inspection for it. The agency’s boundary says inspect everything. Both positions are defensible, and the gap between them is a decision somebody has to sign.
These three instruments are the paperwork that decision needs. They exist because the shape of the ask matters: this is not a generic risk acceptance but a documented traffic-flow exception under SC-7(4), which carries a specific discipline — a named exception with its supporting mission need and duration, reviewed on a stated cadence, with enforcement evidence that its boundaries hold.
The set
| Document | What it decides | Who signs |
|---|---|---|
| SC-7(4) traffic-flow exception memo | Whether to grant the exception, on named controls and stated compensating controls | Authorizing Official |
| Attachment A — pilot site register | Which sites and circuits are in scope, why each needs it, and when it ends | System owner, cited by the memo |
| Attachment B — architecture review determination | Whether the design is TIC 3.0 conformant and where each PEP capability now sits | Architecture review board |
Keeping the memo and Attachment B separate is deliberate. The architecture review answers whether the design is conformant and where capabilities moved; it does not accept risk. The Authorizing Official accepts the one thing that cannot be transferred. Each signer answers a question that is actually theirs.
What the set is careful about
Naming the controls. The exemption punctures SI-3, SI-4(10), AC-4 and AU-3 (with AU-12 by reference). Saying “inspection forgone” invites an assessor to decide for themselves what was lost. SC-8 is explicitly not a gap — Optimize flows carry TLS and SRTP, and the overlay encrypts the rest.
Tenant restrictions. Tenant-to-tenant exfiltration over an Optimize-categorized path is the case an assessor will construct. The intuitive answer — that tenant restrictions v2 needs an in-path proxy, so it is lost — is wrong: that is the v1 model. Under v2 the Windows Group Policy path needs no proxy and is the only one reaching the data plane. For a FedRAMP Moderate agency it is also the only available path, since Global Secure Access is non-FIPS in GCC Moderate. So the control moves to the endpoint rather than disappearing — but only if it is configured and verified, which is why it is a precondition to cutover in all three documents.
The exception record. SC-7(4) requires each exception documented with its mission need and duration, and reviewed on a cadence. Attachment A’s Table A1 carries those fields, because a register that lists circuits without recording why each was granted an exception cannot evidence the control the memo claims.
Policy Enforcement Parity. The TIC 3.0 universal capability requiring protections to apply “independent of the communication mechanism, forwarding path, or endpoints used” is the one this design most strains against. Attachment B records it rather than omitting it; the SC-7(4) exception is the mechanism for documenting a bounded departure rather than denying there is one.