What URLs or requests is MS Office making? They are probaby standard requests that we can handle. Add some logging to see what it does or capture the sessions with ethereal.