A 300-user SaaS-heavy firm sees variable Microsoft 365 performance across branches, has no regional gateways, and wants automated best-path SaaS selection without deploying new data-center hubs. Which Cloud OnRamp for SaaS model best fits this SaaS performance requirement?

The correct approach is appropriate because Cloud OnRamp for SaaS in DIA mode continuously probes Microsoft 365 endpoints from each branch over its local direct internet circuits and then automatically installs the best-performing local exit for that SaaS traffic, which directly resolves variable performance without adding infrastructure. The lowest-cost pinning alternative fails by concept because cost-based preference replaces performance-based selection, so branches stay on a cheap but degraded link even when telemetry shows a better path, violating the automated best-path requirement. The centralized breakout alternative fails by concept because hairpinning branch SaaS to a single best central internet point reintroduces tromboning and latency variance and depends on a hub architecture the firm explicitly wants to avoid. The gateway-probing alternative fails by concept because gateway-site probing measures SaaS reachability from regional gateways rather than from branch DIA circuits, so it requires deployed gateway infrastructure and answers a different design question than branch-local exit selection. As an exam caveat, distinguish the measurement source from the enforcement point, since DIA versus gateway models sound similar but imply opposite traffic paths and prerequisites. As a practical check, confirm in SD-WAN Manager that DIA interfaces are healthy, Cloud OnRamp probing is enabled for Microsoft 365, and per-site SaaS path decisions track measured loss, latency, and exit utilization before production cutover.