Thank you for reaching out, @jamesban! A Netskope expert from our community team will get back to you as soon as possible. In the meantime, if anyone has any ideas that you feel may help, please share them here.

The Outlook 365 native app that runs independently from the browser is part of our default steering exceptions due to embedded certificates in the executable, please review this link: https://docs.netskope.com/en/certificate-pinned-applications.html#UUID-2eee2f97-5834-c608-3f51-d8d6bc64104e_section-idm4560157736670432923469889158 

Of course if the Outlook 365 app is being run directly in the browser then Netskope is able to inspect the traffic with decryption as part of the forward proxy support for browsers that leverage the OS certificate store. The Netskope certificates are installed by the agent or by SCCM or other device management solution.