I'm currently trying to figure out my best option configuring web filtering for users that work both on the corp network and off site. I'm currently using On-premise: MWG (22.214.171.124.0) and SaaS Web Protection. Currently, there is a GPO enabling proxy settings where we use a pac file to ALL users. The situation is that when the mobile user receives the proxy setting, they are unable to browse when the are off site. And if the proxy settings are remove they are not able to browse on premise. I'm looking for a solution to have this working .