anybody seeing issues with XG17 causing Outlook desktop client losing "sync" with Office365.

We are having the exact same issue since implementing a XG firewall.  I have added all of the domains listed on Microsoft's website that should be white-listed for office 365 connectivity and we are still having issues.  I also created a firewall rule for traffic to Office 365 service to not to any http or https scanning.  

Does anyone have any idea what is going on?  

We are having the exact same issue since implementing a XG firewall.  I have added all of the domains listed on Microsoft's website that should be white-listed for office 365 connectivity and we are still having issues.  I also created a firewall rule for traffic to Office 365 service to not to any http or https scanning.  

Does anyone have any idea what is going on?  

It started working after putting ATP off.

and you turned HTTP scanning back on?

I am glad you got it going, but we don't have ATP turned on in the first place.  

Yes, but long exclusion list

Even with HTTP scanning off, I still have issues with users needing to restart outlook for emails to come in.  Did shutting HTTP off fix the issue for you?

For the most part it did. We still have random issues where we need to restart outlook to get it it working again. Most of our users have laptops and are docking and undocking several times a day. I don't know if that is part of our legacy issues where outlook does not like switching network connections. The issue did get significantly better after we created the O365 rules and turned off the scanning.

Do you have load balancing enabled for that rule?

I do not have load balancing enabled.  Just a fail over rule.  

Attached is the log of the IP of an effected machine narrowed down by denied traffic on Port 443.  Any ideas what "Could not associate packets to any connection" means?  Googling it gives me some pretty unhelpful information.  There is also no destination interface on JUST the denied traffic.   

What does your rule look like that routes all the office domains through your non-http-scanning rule?

I've still been working on this issue and for me it seems to be the connection between the Sophos firewall and my upstream Velocloud device.  if I try to ping the Velocloud through the Sophos, I get random ping delays.  I'll see 5-10 <1ms replies, then a 1ms reply and then a 8ms reply, and then it goes back down to <1 for 5-10 replies.  I've messed with the link settings, changing it from AUTO to 100Full  on the Sophons and that helped the ping responses and I seemed to lose sync less often.

I noticed that the Velocloud was reporting that it was running at 100 Half-duplex.  I tried settng everything to forced 1000Full and the worse ping times are back and the sync issue is worse.

I've added in additional switches between the Sophos and Velocloud and it does change how the pings look, which makes no sense to me.  but I can see that the worse the ping response is, the worse the sync issue gets.