Office 365 URL based filtering is just better and easier to sustain

One big problem, most proxies cannot do URL based filtering for https sites because they ONLY see the IP, not the hostname/URL.   Therefore, "unblocking" access to office365 over the SSL channel REQUIRES that IP based filtering be used, UNLESS you are using a DLP type product that is playing "man in the middle" decrypting your SSL traffic, and therefore is able to see the URL in addition to the ip address.  Very few products out there do this-- we manage it with Websense Content Gateway along with WCCP, but this is an advanced configuration and in my experience represents a small amount of highly regulated corporate networks.

We went through this exact BS with Office365--hopelessly trying to unblock various IP ranges.  Once we implemented the aforementioned SSL decryption product we were able to use URL's, however the recommendations in your article will be unusable my most networks that do not use such a product.