Issue with Web Content Filtering – Indicators Not Working

Question

Hello,

I'm trying to set up site blocking using Web Content Filtering. After enabling all the necessary components in Advanced Features in security center:

Web Content Filtering

And configuring the following components in the system (via Intune):

SmartScreen for apps and files

Allow Behavior Monitoring = Allowed (Enables real-time behavior monitoring)

Allow Cloud Protection = Allowed (Enables Cloud Protection)

The "Web-based Email" blocking policy works as expected. However, it also blocks outlook.com, so I added an exception in Indicators. Additionally, I added youtube.com and tiktok.com to the blocked sites for testing.

The issue is that Web Content Filtering works, but the Indicators do not seem to take effect.

Checked the requirements

https://learn.microsoft.com/en-us/defender-endpoint/indicator-ip-domain

Microsoft Defender Antivirus version requirements

1. Your organization uses Microsoft Defender Antivirus. Microsoft Defender Antivirus must be in active mode for non-Microsoft browsers. With Microsoft browsers, like Microsoft Edge, Microsoft Defender Antivirus can be in active or passive mode.
2. Behavior Monitoring is enabled.
3. Cloud-based protection is turned on.
4. Cloud Protection network connectivity is turned on.
5. The anti-malware client version must be 4.18.1906.x or later. See Monthly platform and engine versions.
6. Behavior Monitoring is enabled

3. Cloud-based protection is turned on.

Changed 1 to 3 (SendAllSamples)

4. Cloud Protection network connectivity is turned on.

5. The anti-malware client version must be 4.18.1906.x or later

Could you please advise what might be causing this issue and how I can debug it?

Thank you.

Answer 1

Hi, @Catherine Kyalo

The problem was solved very easily :)

As far as I remember, I included in the Setting - Endpoint - Advanced Feature - Custom network indicators. But as it turned out, it was disabled. I just turned it on and everything worked, which is quite logical.

And very stupid of me. However, I don’t understand why Microsoft doesn’t warn and doesn’t enable all available features by default.

Answer 2

Hi @Mountain Pond

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Solution :

As far as I remember, I included in the Setting - Endpoint - Advanced Feature - Custom network indicators. But as it turned out, it was disabled. I just turned it on and everything worked, which is quite logical.

And very stupid of me. However, I don’t understand why Microsoft doesn’t warn and doesn’t enable all available features by default.

If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.