Cisco ESA office365 relay issue

So I have my cisco ESA c600v virtual machine setup using these instructions:

[https://www.cisco.com/c/en/us/support/docs/security/cloud-email-security/214812-configuring-office-365-microsoft-with.html](https://www.cisco.com/c/en/us/support/docs/security/cloud-email-security/214812-configuring-office-365-microsoft-with.html)

I've got the 365 tenant setup with the key for allowing relaying, and the incoming email is all flowing, and everything is great, except for one thing.

I realized that i was seeing some emails being marked as dropped, and it's when they're being sent out from other office365 tenants so their sender shows up as [something.protection.outlook.com](http://something.protection.outlook.com), and I discovered that it was because apparently the Recipient Access Table is being ignored.

Per the instructions, .protection.outlook.com is included in the RELAY sendergroup in the HAT.

So what seems to be happening is that the ESA is seeing emails coming in from [outlook.com](http://outlook.com), it's seeing that is part of the RELAY group, and because it doesn't have the relay key header, the message filter is dropping the email, even though the address is included in the RAT so it should be allowed.

This seems like it would be a problem that the documentation would have called out, so I'm assuming I missed something.

Any suggestions? Do I need to add a RAT check to the message filter somehow?