Thanks for your reply, Philip. Much appreciated.   I have a quick look on the below page: https://docs.microsoft.com/en-us/office365/enterprise/urls-and-ip-address-ranges   It looks like IP ranges and URLs are dynamic. Might API would be helpful here for IP addresses. But how to handle the URLs?    Take this one for example:   There is no IP address. If the two URLs are whitelisted in URL filtering, how to configure the layer 3 firewall rules to allow the traffic? permit tcp any any 443/80?   We are using proxy for all the traffic except office 365 and proxy traffic will be tunneled back to the hub site. In this case, how to define URL filtering to whitelist office 365 traffic? it looks like Meraki would inspect proxy traffic with URL filtering policy as well. If blacklisting everything except office 365, it will impact all the website browsing?    Cheers Charles   ... View more

OK. If the default route option is not ticked, is it possible to block all the Internet traffic except Office 365? ... View more

Yes.   VPN tunnels via MPLS and VPN tunnels via Internet. The Hub works in one-arm concentrate mode. ... View more

Thanks Philip,   The default route in VPN page gets ticked because we want to route the rest of the traffic back to hub sites.     In this case, I think internet traffic option in Flow preferences setting would not work?   Cheers Charles     ... View more