Apply URL RegEx Exceptions to Individual Web Filtering Policies

You are correct.

See here for what you can do with URL Groups and Custom Categories:

https://community.sophos.com/kb/en-us/127270

What are you ultimately trying to achieve?

I'm needing to create web filtering exceptions to allow certain services but apply them only to specific policies instead of applying them globally from Web > Exceptions.

tscott_16 said:

I'm needing to create web filtering exceptions to allow certain services but apply them only to specific policies instead of applying them globally from Web > Exceptions.

That is a solution that is not possible.  I'm trying to understand the problem that you are trying to solve in order to help you with an alternate solution.  Without knowing what problem you are experiencing or trying to resolve I cannot help.

For example "When most people go to https xyz.com I want to do HTTPS scanning, but some users/devices cannot install the certificate and do HTTPS scanning, so I want to exclude them".  That is a problem that could be solved without exceptions.

So an example that I just encountered yesterday is I want to block the "Download Freeware & Shareware" category but that includes the Google Play Store. I want to allow Google Play Store URLs only for specific web filtering policies and not globally for all.

So an example that I just encountered yesterday is I want to block the "Download Freeware & Shareware" category but that includes the Google Play Store. I want to allow Google Play Store URLs only for specific web filtering policies and not globally for all.

So this is a whitelist of domains you want to override a category block.

Create a URL group object and put in all the Google Play store domains.

In the web policy, have a higher level rule that allows the URL group, and then a lower level rule that blocks the category.

Alternately you can use a Custom Category rather than a URL group, the results are similar.

Some more info:

https://community.sophos.com/kb/en-us/124370

https://community.sophos.com/kb/en-us/127270

Great. I think this is the answer. It looks like even though URL groups do not support RegEx, there is enough flexibility to do what I need to. Thanks!