Disconnected environments, proxies and Microsoft Defender for Endpoint

Hey autopoiesis,

Thanks for the clarification. I believe that this links back to suggested practices when consuming Microsoft cloud services. Given that Microsoft's own "intranet" is the internet we've built our products around this conception. Ideally, as you stated, is having the endpoint communicate directly to the cloud endpoints (published via CDN) is the "easiest" method. This however, doesn't support all scenarios, especially disconnected environments due to regulation or other such requirements. 

I'd strongly suggest reading through the following: Networking up (to the cloud)—One architect's viewpoint | Microsoft Learn

Essentially you always want the endpoint to communicate to the nearest front door to Microsoft global network. Step 2. Optimal networking for your Microsoft 365 for enterprise tenants | Microsoft Learn

Using that approach should resolve any issues but it does seem intimidating. I really like the article by Ed Fisher to help explain this. You can also reach out to your FastTrack team. (https://fasttrack.microsoft.com) If you have at least 150 licenses (Requirements here: Eligibility - FastTrack – Microsoft 365 | Microsoft Learn) then they can help walk through the networking scenario and show you the different tools and methodologies available for optimization. Hope this helps 👍