{
  "name": "ChangeIntel Certificate revocation and issuers",
  "policyRules": [
    {
      "@odata.type": "#microsoft.graph.networkaccess.fqdnFilteringRule",
      "name": "ChangeIntel Certificate revocation and issuers FQDNs",
      "ruleType": "fqdn",
      "destinations": [
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "oneocsp.microsoft.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ocsp.digicert.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ocsp.digicert.cn"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl3.digicert.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl4.digicert.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl.digicert.cn"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "www.microsoft.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "caissuers.microsoft.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "cacerts.digicert.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "cacerts.geotrust.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "cacerts.digicert.cn"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl.microsoft.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "mscrl.microsoft.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ocsp.msocsp.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ctldl.windowsupdate.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.entrust.net"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.geotrust.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.omniroot.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.public-trust.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.symcb.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.symcd.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.verisign.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "*.verisign.net"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "cert.int-x3.letsencrypt.org"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl.globalsign.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl.globalsign.net"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "crl.identrust.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "isrg.trustid.ocsp.identrust.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ocsp.globalsign.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ocsp2.globalsign.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "ocspx.digicert.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "secure.globalsign.com"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.fqdn",
          "value": "www.digicert.com"
        }
      ]
    },
    {
      "@odata.type": "#microsoft.graph.networkaccess.urlDestinationFilteringRule",
      "name": "ChangeIntel Certificate revocation and issuers URLs",
      "ruleType": "url",
      "destinations": [
        {
          "@odata.type": "#microsoft.graph.networkaccess.url",
          "value": "www.microsoft.com/pkiops/*"
        },
        {
          "@odata.type": "#microsoft.graph.networkaccess.url",
          "value": "www.microsoft.com/pki/*"
        }
      ]
    }
  ],
  "action": "allow"
}