We were trying to allow access to activate Office 365 from a closed bubble , deployed the Application Whitelists per below

Upon Office activation we were still getting the below :

Looking at the block in the end I had to whitelist the FQDN 

fs-wildcard.microsoft.com.edgekey.net

And the following App

The servers were using Protected View for IE and that as a default browser so I also had to add https://login.microsoftonline.com/ to Trusted sites