Setting up the Proxy auto-config (PAC)

How to set up the Proxy auto-config (PAC).

Procedure

In case that you are using the Root certificate from the eperi sEcure Platform for the forward proxy, deploy the certificate to your clients as follows:
1. Access the eperi sEcure Admin Console.
2. Select Settings > Certificate Authority then click Download certificate authority.
3. Save the certificate file to a location of your choice.
4. Deploy the eperi sEcure Platform Root certificate to all of your clients.
Set up a Proxy auto-config (PAC) server.

Edit the PAC file m365.pac provided by eperi and adjust the values of the variables marked bold at the beginning of the file according to your needs and your system environment:

Important: Please always use the PAC file delivered with the respective software release!


Variable	Explanation
proxyServer	The host and port under which the clients can reach the eperi sEcure Platform forward proxy. (In case of a cluster setup configure the host and port of your load balancer.)
tenant	Configure your tenant name. You can find it out as follows: Log in to the Microsoft 365 admin center. Select Settings > Domains. Find the domain that ends with "onmicrosoft.com". The tenant name is the part before "onmicrosoft.com". For example, if your domain is mycompany.onmicrosoft.com, the tenant name is mycompany.
useMail	Set it to `true`, if you want to use email functionality.
useOneDrive	Set it to `true`, if you want to use OneDrive.
useSharePoint	Set it to `true`, if you want to use SharePoint.
useSubstrate	Set it to `true`, if you want to use Substrate with either SharePoint, Teams or OneDrive.
useTeams	Set it to `true`, if you want to use basic Teams functionality. File and email related Teams functionality is regulated by the other values.
useGraph	Should be set to `true` as the Graph API is utilised to support various functionalities.

function FindProxyForURL(url, host) {
    var proxyServer = "<proxyHost>:<proxyPort>";
    var tenant = "<tenant>";

    var useMail = false;
    var useOneDrive = false;
    var useSharePoint = false;
    var useSubstrate = false;
    var useTeams = false;
    var useGraph = false;
[...]
}

Deploy the PAC file on your PAC server, or locally on the machine.
Configure a proxy on each client (for example on a Windows 10 client):
1. Open Settings > Network & Internet > > Proxy.
2. In the Automatic Proxy Setup section, set the Use Setup Script switch to On.
3. Enter the Script address, for example:
```
http(s)://<pac-server-hostname>/m365.pac
```
4. Click Save.

Results

You have successfully set up the Proxy auto-config (PAC).

What to do next

Please follow these steps, if you would like to enforce the PAC file and prevent that clients connect to Microsoft 365 servers directly without the eperi sEcure Platform.

Add and customize the following entries to the hosts file on every client where this should take effect:

127.0.0.1 outlook.office365.com # for E-Mail
127.0.0.1 outlook.office.com # for E-Mail
127.0.0.1 attachments.office.net # for E-Mail
127.0.0.1 <tenantName>-my.sharepoint.com # for OneDrive
127.0.0.1 <tenantName>.sharepoint.com # for SharePoint
127.0.0.1 teams.microsoft.com # for MS Teams