Office 365 Traffic Classification

Sounds like a job for Deep Packet Inspection and the Ouality of Experience dashboard in NPM

There is a preconfigured application already for Office 365

check out [VIDEO] Overview of Quality of Experience Dashboard In SolarWinds NPM

this is kind of an old thread so you might have resolved this issue, but for anyone else that finds this page Microsoft does publish there external IP blocks. You could build an IP group with this information. QOE is good way to go as well. But this will take advantage of your NTA.

Office 365 URLs and IP address ranges - Office 365

This should be solved in planned release NTA 4.2 with NBAR2 - Better application traffic visibility - NTA 4.2 Beta using NBAR2

As petr.klang said NBAR2 will really help with this, but I have found a passable work around. Basically you just create IP groups for each of the O365 applications. The IPs can be found here. This will require entering a LOT of IPs into the group you will have to keep in mind that basing things off of just an IP is going to be the most error prone (due to IPs changing). I am currently using this to get a rough idea of the bandwidth utilization. I created a new tab on my netflow interface and node pages to for displaying the IP groups. I am seeing some issues with it (the dropdown to select the groups in the flow navigator is just white with no text now, but I just click then use my arrows to find the right options), but it work well enough for management until NTA supports NBAR2 at least.

If you want to automate the creation of the IP groups I recommend Pulover's Macro Creator. It is free and based on AutoHotKey. Watch the videos on the applications site and use the image search function as much as possible. If you have issues with that let me know and I will try to help with it since that is how I added the O365 IPs to my groups.