Microsoft has published guidance for years: do not force-tunnel all Office 365 traffic through the corporate VPN hairpin if you care about performance and scale. In spring 2020 the guidance stopped being theoretical. Forced tunnel melted under Teams media and SharePoint sync from home. This post is what we implemented, what we measured, and how we answered security teams without hand-waving.
The failure mode
User → VPN concentrator → corporate egress → Microsoft edge, with inspection and bandwidth contention, while every teammate does the same for video. Symptoms:
- VPN session capacity exhaustion
- Egress firewall CPU pegged
- One-way audio, frozen video, slow OneDrive
- “SaaS is down” tickets that were really path design
Exchange Online mailbox access might limp along. Real-time media does not.
What we implement
Optimize connectivity for Office 365 — send marked Microsoft 365 prefixes and URLs directly from the client network per current Microsoft endpoint categories (Optimize / Allow / Default as documented at implementation time). Keep true private apps on tunnel.
Practically:
- Maintain endpoint lists via Microsoft’s published URLs/IPs (automation beats quarterly wiki copy)
- Configure VPN split tunnel exclusions for Optimize endpoints
- Validate DNS so clients resolve Microsoft endpoints to public paths, not sinkholes
- PAC/proxy exceptions where proxies still exist
- Measure before/after: VPN concurrent, firewall throughput, Teams call quality surveys
Field results (composite)
On estates that implemented split tunnel for Optimize traffic during surge:
- VPN concurrent growth flattened relative to headcount growth
- Teams quality tickets dropped materially within two weeks
- Security retained full tunnel for RFC1918 and sensitive line-of-business
On estates that refused:
- Emergency purchase of VPN capacity
- Executive escalation about “broken Teams”
- Eventually the same split tunnel change under worse politics
Security objections and answers
“We lose visibility.”
You gain capacity. Compensate with: Defender / Cloud App signals, CA policies, device compliance, DNS logging at resolver, and accepting that TLS inspection of all Microsoft media was never free or complete.
“Data exfiltration risk.”
Exfiltration was already possible via personal hotspots. Prefer managed devices + CA + DLP over hairpin theater.
“Compliance requires inspection.”
Scope inspection to categories that survive it; do not inspect real-time media until someone owns the outage. Document residual risk.
Implementation pitfalls
- Stale IP lists after Microsoft expands ranges
- Split tunnel on paper, PAC still forcing proxy
- IPv6 surprises
- Guest networks at home — out of scope but show up in tickets
- Split tunnel for Optimize only — users still full-tunnel random SaaS; that may be fine
Pair with Conditional Access
Direct-to-Microsoft paths make device compliance and MFA more important, not less. We implement CA in the same change window when possible so security gains a control while network gives up a hairpin.
Extended practice notes (2020)
The remaining gap between a short checklist and a usable field note is usually scenario detail. In practice, the same engagement type described above still requires explicit answers to: what is in scope this quarter, what is deferred with a date, who can halt a wave, and how success is measured in production — not in a lab.
We document those answers before the first production change. When stakeholders disagree, the disagreement is resolved in writing, not on the bridge at cutover. That habit is independent of whether the workload is mail, identity, virtualization, desktop delivery, or security hardening.
Repeatable detail also includes communication: who tells users what changes, when the freeze starts, where status is posted, and how exceptions are requested. Technical excellence without communication still produces an outage from the user's point of view.
If you're facing this
If Teams and OneDrive are “fine in the office and terrible on VPN,” fix the path before you buy more VDI. We design Office 365-optimized remote access with security stakeholders at the table — bring firewall owners and a week of quality tickets.