Filter

When looking at the web report, I can see that a site was blocked by category or custom list but it would extremely helpful to know where the policy, access list, or category lives that was applied to the action of that site. For example, icloud.com is listed as being in the computers category and should be unblocked for all OUs. However, the report shows the site is blocked but doesn't say what policy contains the blocked category or access list that is applied to the action of that URL to know why it is being blocked by the Lightspeed filter in the first place. I see similar feedback requests, but maybe not as detailed. Having a clickable link to that policy location would save a ton of time for end users also.

When a domain or URL is added to the allow or deny list, no additional information is provided. Providing a time stamp as an optional column would be nice data to be able to review.

Environment: Lightspeed Filter Smart Agent, lsproxy.exe 3.0.4.19 Windows 11, build 10.0.26200.8457 Microsoft Teams 26163.405.4842.717, WebView2 Runtime 150.0.4078.48 Agent configured with machine-wide PAC ( http://relay.lsaccess.me:6544/local.pac ) Symptom: Clicking Sign in in Microsoft Teams opens the sign-in popup, which remains permanently white/blank. Affects all managed devices running the Filter Agent. No block pages are shown and no connections appear blocked (all TCP traffic to the local proxy succeeds), which made this very difficult to diagnose. Root cause identified: Before displaying the sign-in page, Teams' auth library (OneAuth) performs federation provider discovery against https://odc.officeapps.live.com/odc/emailhrd/getfederationprovider?domain=<tenant-domain> . When lsproxy SSL-decrypts this connection, it performs a TLS renegotiation mid-request (after the GET is sent, before the response is delivered). Browser clients and curl tolerate the renegotiation and receive the correct body; OneAuth's client does not, and receives a zero-byte response body. OneAuth then fails with: ServerTemporarilyUnavailable {"ErrorCode":"102","Message":"Federation provider discovery returned an invalid result.","Tag":"76lb9"} (from the MSTeams client log). With discovery failed, Teams never navigates the sign-in WebView2 to any URL, producing the blank window. Reproduction (curl through lsproxy): curl -v --proxy http://127.0.0.1:62312 " https://odc.officeapps.live.com/odc/emailhrd/getfederationprovider?domain=dcboces.org " Output: < Via: mitm/20230626, lsproxy.exe 3.0.4.19 [2025-07-30-1542UTC go1.24.4] windows * schannel: remote party requests renegotiation * schannel: renegotiating SSL/TLS connection confirming the domain is being MITMed and renegotiated. Process Monitor captures of ms-teams.exe show the corresponding WinINET cache entries for federationprovider and hrd written with EndOfFile: 0 (empty bodies) on every attempt. Workaround: Adding officeapps.live.com to both the allow list and the SSL decryption bypass list resolves the issue immediately. Request: Fix lsproxy's TLS handling so decrypted connections do not use mid-stream renegotiation (or otherwise deliver intact response bodies to non-browser TLS clients such as Microsoft OneAuth/WinINET). This affects any OneAuth-based Microsoft sign-in flow (Teams, Office activation, OneDrive) on any decrypted endpoint, so per-domain bypasses are only a partial mitigation. Confirm whether a newer Smart Agent release addresses this. Consider adding Microsoft identity/discovery endpoints (including odc.officeapps.live.com ) to the default decryption bypass set.

When deauthorizing an account when doing a OU sync between Lightspeed and Google Workspace (this may be relevant to other sync options), you lose all the selected OUs. A tooltip or small "hey just so you know" message to warn that the selected OU's for the sync will be forgotten would be helpful. This has just bit us when trying to authorize the sync as a new account. A warning to others may save some frustration.

District would like to have the option to enable an email notification that would be sent if a sync (from any source) into Platform fails.

I get so many release notes emails for aspects not relative to us, such as we don't use ChromeOS so these emails are not relevant to us. Our DSLs would like to know about Alert updates and features to ensure IT are staying on top of this but don't want to know about Filter update, Extension Helper version updates or Release Candidates etc. Could you please put a way of signing up to the specific release updates relevant to the role and just what we want to be notified on, instead of bombarding with all releases for everything?

We would benefit greatly within our community if Screen Time data were available in the Parent Portal for parents to review.

Please add the ability to add SSL exclusions by entire category, not just individual sites. I want to exclude all healthcare/banking/financial. I don't want to have to add them in one by one as there are so many and I know I will miss some. Thank you! Please make it happen!

We would like to be able to disable SSL decryption for specific groups like our Police Department or Accounting to avoid problems with chain of custody.

We would like to submit a feature request to be able to run a report or view version information in the console for filter agents currently deployed and reporting for our environment.