Exchange 2010 & F5

As Michael said, you could use a 403 for this to indicate the request will never be allowed. A 401 indicates the app wants the user to present credentials for the request.

You could check for a URI which starts with /owa instead of matching /owa exactly. And you shouldn't need to call HTTP::enable unless you're disabling the HTTP filter elsewhere with HTTP::disable:

when HTTP_REQUEST {
   if {[string tolower [HTTP::uri]] starts_with "/owa"}{
     HTTP::respond 403 content {Blocked!}
   }
}

Aaron