Unfortunately much like every nice thing on the internet, once it is being abused, it gets axed... Domain fronting (having Host header differ to SNI in TLS) is a powerful way a malware author could send payload into organisations.. imagine seeing seemingly legitimate traffic to azure.com but end up with malwaredomain.com/lulz.exe... Unless organisations are peeking into TLS, check Host header, response with MZ file header...There is nothing they can do to stop this.