Apple recommends that HTTPS Scanning, Content Inspection, and Authentication are bypassed entirely for Apple services, when routed through a proxy server.
Apple publishes a list of hosts recommended for bypass in the following article:
Apple Support - Use Apple products on enterprise networks
We recommend that you add these hosts to a Wildcard Expression list. Then, create a rule with the action
Stop Rule Set if the URL property is matched against the list.
Deploy the rules in the following top-level rule sets if used:
HTTPS Inspection
Explicit Proxy Authentication and Authorization
Authentication Server
