Make the Forward-Proxy Policy Compatible with OneDrive

For OneDrive behind a filtering forward proxy, check the network design against the sync client’s requirements before adding another hostname exception.

1. Check proxy authentication. Microsoft’s OneDrive system requirements state that authenticated proxies are not supported. A browser successfully answering the proxy’s login prompt does not establish a supported path for the sync application.
2. Use the current endpoint set. For work or school accounts, Microsoft directs administrators to the required Microsoft 365 URLs and IP ranges. Personal OneDrive has its own published requirements. A short domain list copied from an old incident is not the complete current dependency set.
3. Review TLS inspection. Microsoft’s Microsoft 365 connectivity guidance recommends bypassing TLS decryption and intrusive inspection for the required service domains. A rule that permits a domain while still replacing its TLS session can leave a different compatibility problem.

Keep the actual failure stage in the report. A 407 indicates a proxy challenge. A blocked connection, a certificate validation error and a service response are other outcomes. Do not infer certificate pinning from a generic “cannot sync” symptom alone.

The organization’s network administrator can implement the supported service route and keep its endpoint data current. Where direct access is approved, OneDrive’s IgnoreWebProxy policy is a separate way to bypass proxy detection. Microsoft recommends using its maintained endpoint data rather than selective guesses based on a few operations that happened to succeed.

After an approved policy change, check the required account’s sign-in and sync operations. Being able to open the public OneDrive website is only one operation in that workflow.