<!--
	For rules causing false/broken MCB, see Microsoft.com-falsemixed.xml.

	For problematic rules, see Microsoft-mismatches.xml.


	Other Microsoft rulesets:

		- Acik_Akademi.com.xml
		- ASP.NET.xml
		- ASPNETcdn.com.xml
		- Bing.xml
		- DreamSpark.com.xml
		- Halo.xml
		- Live.xml
		- Microsoft-Atlas.xml
		- Microsoft_Online_Services.xml
		- Microsoft_Store.xml
		- Moreinterop.com.xml
		- MSDN.xml
		- MSN.xml
		- Newsvine.com.xml
		- Outlook_Live.xml
		- Photosynth.xml
		- Skype.xml
		- S-msn.com.xml
		- System_Center_Advisor.com.xml
		- Technet.com.xml
		- Virtualearth.net.xml
		- Windows_Azure.xml
		- Windows.net.xml
		- Windows_Phone.xml
		- Xbox.xml


	CDN buckets:

		- i.g.mobile.ms.akadns.net

			- i1.mobile.microsoft.com

		- res.windows.microsoft.com.edgesuite.net

			- a1737.g2.akamai.net
			- res2.windows.microsoft.com

		- wscont.apps.microsoft.com.edgesuite.net

			- wscont[12].apps.microsoft.com

		- az12410.vo.msecnd.net
		- az373151.vo.msecnd.net	(used on imaginecup.com)
		- msstore.vo.msecnd.net
		- officeimg.vo.msecnd.net

	msnportalmobileisv.112.2o7.net


	Nonfunctional domains:

		- www.buildmypinnedsite.com
		- (www.)imaginecup.com ***
		- compete.imaginecup.com ***

		- microsoft.com subdomains:

			- silverlight.dlservice *
			- download *
			- web.esd *		(esd, origin, origin-web, and web don't exist)
			- samples.msdn		(refused)
			- visualstudiogallery.msdn	(redirects to http, valid cert)
			- mymfe			(reset)
			- officeimages
			- privacy		(times out)
			- academic.research ***
			- sharepoint		(redirects to login.live.com, cert valid)
			- edir.windowsm		(404)
			- visio **
			- (www.)windows **

		- msimg.com
		- blogs.office.com ***
		- blog.surface.com		(handshake fails)
		- blogs.windows.com		(reset)
		- (www.)windowsteamblog.com

	* 503, akamai
	** 404, cert valid
	*** Times out


	Problematic domains:

		- microsoft.com subdomains:

			- ^ ***
			- apps			(works; mismatched, CN: *.apps.microsoft.com)
			- wscont[12].apps	(works, akamai)
			- i[1-4].connect **
			- i **
			- i\d **
			- js **
			- i1.mobile **
			- scache **
			- search **
			- spcache		(504, akamai)
			- img3.store		(mismatched)
			- update *
			- res[12].windows **

		- office.com

		- widgets.membership.s-msft.com		(akamai)
		- compass.surface.com **

	* Cert only matches www
	** akamai
	*** Times out


	Partially covered domains:

		- answers.microsoft.com		(some pages redirect to http)
		- code.msdn.microsoft.com	(pages redirect to http)


	Fully covered domains:

		- microsoft.com subdomains:

			- accountservices
			- feedback.adcenter
			- ajax
			- fb.answers
			- wscont.apps
			- wscont[12].apps	(→ wscont.apps)
			- advertise.bingads
			- secure.bingads
			- c
			- c1
			- choice
			- commerce

			- connect subdomains:

				- connect
				- i[1-4]		(→ services)
				- innovation
				- services

			- sas.css
			- social.expression
			- g
			- m
			- widgets.membership
			- mobile
			- i1.mobile		(→ m)
			- social.msdn
			- office15client
			- officepreview
			- officeredir
			- o15.officeredir
			- rad
			- scache		(→ www)
			- profileapi.services
			- social
			- services.social
			- spcache		( → www)
			- corp.sts
			- social.technet
			- res[12].windows	(→ akamai)

		- (www.)office.com			(^ → www)
		- i.s-microsoft.com
		- widgets.membership.s-msft.com		(→ widgets.membership.microsoft.com)

		- *.sec.s-msft.com:

			- download-codeplex
			- i-technet
			- i2-technet


	Wildcard cookies:

		- *.office.microsoft.com
		- *.support.microsoft.com


	Mixed content:

		- css on onlinehelp from i3.onlinehelp *

		- Images on onlinehelp from i.onlinehelp *

	* Secured by us

-->
<ruleset name="Microsoft (partial)">

	<target host="microsoft.com" />
	<target host="*.microsoft.com" />

        <exclusion pattern="^http://msdn\.microsoft\.com" />

		<!--
			https://mail1.eff.org/pipermail/https-everywhere-rules/2012-June/001189.html
											-->
		<exclusion pattern="^http://www\.microsoft\.com/.*[fF]amily[iI][dD]" />
		<!--
			Health pages 404:

				https://trac.torproject.org/projects/tor/ticket/9148
											-->
		<exclusion pattern="^http://(?:www\.)?microsoft\.com/health/(?:$|\?|.+\.aspx)" />
		<!--
			Redirects via JS to http.  Very secure indeed.
									-->
		<exclusion pattern="^http://www\.microsoft\.com/security/.+\.aspx(?:$|\?)" />
		<!--
			Microsoft won't serve OEM pages on https
								-->
    		<exclusion pattern="^http://(?:www\.)?microsoft\.com/[oO][eE][mM]/" />
		<!--
			Redirects to http:
						-->
		<exclusion pattern="^http://www\.microsoft\.com/Surface/\w\w-\w\w(?:$|\?|/)" />
		<exclusion pattern="^http://answers\.microsoft\.com/(?!\w\w-\w\w/\w+/forum/[\w-]+/[\w-]+/)" />
		<!--
			https://trac.torproject.org/projects/tor/ticket/5754
										-->
		<exclusion pattern="^http://msdn\.microsoft\.com/(?:$|en-us/$|.+(?:/$|\.aspx|/\w\w\d{6,10}$))" />
		<exclusion pattern="^http://code\.msdn\.microsoft\.com/(?![cC]content/|RequestReduceContent/)" />
		<!--
			Some data exist on www, exclude the rest here.
									-->
		<exclusion pattern="^https?://search\.microsoft\.com/(?!global/oneMscomSettings/|shared/)" />
		<exclusion pattern="^http://technet\.microsoft\.com/(?!en-us/(?:library/[^\.]\.rss(?:$|\?)|security/(?:advisory|bulletin)(?:$|\?|/)))" />
	<target host="office.com" />
	<target host="www.office.com" />
	<target host="i.s-microsoft.com" />
	<target host="*.s-msft.com" />


	<!--
		A, MC1, MS0: Cookies set by c.microsoft.com
		s_.+: Other tracking cookies
						-->
	<securecookie host="^\.microsoft\.com$" name="^(?:A|GsfxStatsLog|MC1|MS0|OnlineTrackingV2\.0|R|RioTracking\..+|s_.+)$" />
	<securecookie host="^(?:feedback\.adcenter|advertising|advertise\.bingads|choice|commerce|ieonline|m|\.?office|office(?:15client|2010|preview|redir)|corp\.sts|\.?support|\.?www)\.microsoft\.com$" name=".+" />
	<securecookie host="^www\.office\.com$" name=".+" />


	<rule from="^http://(?:i\d?\.|js\.|search\.|spcache\.)?microsoft\.com/"
		to="https://www.microsoft.com/" />

	<rule from="^http://(accountservices|(?:feedback\.)?adcenter|advertising|ajax|(?:fb\.)?answers|c1?|choice|commerce|(?:innovation\.|services\.)?connect|sas\.css|events|social\.expression|go?|ie|ieonline|m|mobile|code\.msdn|msdn|social\.msdn|office(?:15client|365|2010|preview|redir)?|o15\.officeredir|profile|rad|research|profileapi\.services|signature|snackbox|(?:services\.)?social|store|corp\.sts|support|(?:social\.)?technet|www\.update|(?:v[45]\.)?windowsupdate)\.microsoft\.com/"
		to="https://$1.microsoft.com/" />

	<rule from="^http://wscont\d?\.apps\.microsoft\.com/"
		to="https://wscont.apps.microsoft.com/" />

	<rule from="^http://i\.s-microsoft\.com/"
		to="https://i.s-microsoft.com/" />

	<rule from="^http://i\d\.social\.s-msft\.com/wiki/"
		to="https://social.technet.microsoft.com/wiki/" />

	<!--	Akamai with no valid cert.
						-->
	<rule from="^http://i\d?\.((?:code\.)?msdn|onlinehelp|(?:services\.)?social|(?:gallery\.)?technet)\.(?:microso|s-ms)ft\.com/"
		to="https://$1.microsoft.com/" />

	<rule from="^http://i\d\.connect\.microsoft\.com/"
		to="https://services.connect.microsoft.com/" />

	<rule from="^http://i1\.mobile\.microsoft\.com/"
		to="https://m.microsoft.com/" />

	<rule from="^http://scache\.microsoft\.com/"
		to="https://www.microsoft.com/" />

	<rule from="^http://img3\.store\.microsoft\.com/"
		to="https://msstore.vo.msecnd.net/" />

	<rule from="^http://update\.microsoft\.com/"
		to="https://www.update.microsoft.com/" />

	<rule from="^http://origin-res\.windows\.microsoft\.com/"
		to="https://origin-res.windows.microsoft.com/" />

	<rule from="^http://res(1|2)\.windows\.microsoft\.com/"
		to="https://a248.e.akamai.net/f/1737/7533/6/res$1.windows.microsoft.com/" />

	<rule from="^http://(?:www\.)?office\.com/"
		to="https://www.office.com/" />

	<rule from="^http://([\w-]+)\.sec\.s-msft\.com/"
		to="https://$1.sec.s-msft.com/" />

	<rule from="^http://widgets\.membership\.(?:s-ms|microso)ft\.com/"
		to="https://widgets.membership.microsoft.com/" />

	<rule from="^http://i\d\.social\.s-msft\.com/"
		to="https://social.expression.microsoft.com/" />

</ruleset>
