Microsoft doesn’t publish an accurate list of IP ranges, and pushes many things to Akamai, so you need to whitelist a few dozen domains.

When I ran a very large O365 environment, it was even harder as we had a dedicated 10Gb circuit to Microsofts network, and and depending on various bugs, conditions, etc, you could easily send traffic to the wrong place and impact performance. (For example, if you inspect TLS traffic, that latency will kill Outlook application performance)