In order to explain how the Internet Explorer works, we will use example below:
You have a policy to block access to internet based on user-agent= IE 8,9 or 10.
IE 11 is allowed to access the Internet, however, some of the websites are not open on IE 11 but on Firefox or another browser has no issue opening.
Internet Explorer is designed to view the content on a page with the best "compatibility" mode first before rendering with the newest IE version engine, with the release of IE 8, which has a stricter adherence to W3C described web standards than the IE version before it, some web pages which coded with the behavior of older version would break in IE version 8 onwards. To address this issue, IE 8 introduced "compatibility" modes which gives way to introduce new features and stricter compliance to standards while enabling it to be backward compliant.
IE 8 onwards determines the rendering mode based on two main factors, the value of compatibility mode and value of the !DOCTYPE switch.
The web page can specify compatibility mode either by using a Meta tag or by sending HTTP header. Meta tag takes precedence over HTTP header when both are present.
1) META Tag – You can place the following HTML tag in the HEAD element of your web page: <meta http-equiv=“X-UA-Compatible” content=“IE=#” />
2) HTTP Header – You can configure your server so that the following HTTP Header is sent with each page X-UA-Compatible: IE=#
note: # = the version of the IE
Take above example, where you have rules to denied internet access for IE 8, 9 and 10 and when accessing certain website using IE11 which needs IE 10 or below for compatibility view, the IE11 will render the access with the compatibility modes feature for backward compliance and this will cause the ProxySG to see the traffic are coming from IE 8, 9 or 10 (depending on the website requirement) and thus the traffic are blocked under the rules which denied access to IE 8, 9 and 10.
Create a separate rule to allow those blocked websites under "compatibility" modes under IE 8, 9 or 10 if you trust the websites, may refer to KB article "
000010111" on how to allow a single URL/website for references.