A Palo Alto decryption bypass rule seems present and one SaaS login still...

The main login domain is exempted, yet authentication keeps failing because the browser is redirected through another host not covered by the bypass.