To enable TLS interception at the tenant level, change the default TLS Action to Inspect & Proxy. You can also define TLS policies to intercept selective traffic and keep the default TLS Action as TLS Bypass. When default TLS Action is TLS Bypass, you must define the TLS policy to intercept the requests to apply the web and application policy.

When the default TLS Action is Inspect & Proxy, all the proxy traffic will be scanned through the phishing protection, DLP scan, and malware scan unless you have defined the TLS policies to bypass the traffic. If the default TLS Action is TLS Bypass, you must define the TLS policies with the action as Inspect & Proxy for phishing protection, DLP scan, and malware scan. In both cases, phishing protection, DLP scan and malware scan cannot work for bypassed traffic.