Blog Post

Microsoft Defender for Endpoint Blog
2 MIN READ

Web content filtering with Microsoft Defender ATP now in public preview

Christine_Xu's avatar
Christine_Xu
Former Employee
Jan 28, 2020

Web content filtering is a new feature in Microsoft Defender ATP that enables security administrators to track and regulate access to websites based on specified content categories. You can configure policies within Microsoft Defender Security Center to block or gather access data on certain categories across your machine groups. This feature provides the following capabilities:

  • Users are prevented from accessing websites in blocked categories, whether they are browsing on-premises or away
  • Conveniently deploy varied policies to various sets of users using the machine groups defined in the Microsoft Defender ATP role-based access control settings
  • Access web reports in the same central location, with visibility over actual blocks and web usage
  • Support for most major web browsers, with blocks performed by SmartScreen and Network Protection.

For instance, you could set a policy to block ‘adult content sites’ across all of your machine groups, and create a separate policy to block ‘high bandwidth sites’ on just a few machine groups. Any category that is not being blocked will still have access information collected from them that you can view in the reports.

 

 

In order to give customers access to various sources of web content categorization data, we are very excited to partner with data providers for this functionality. We’ve chosen Cyren as our first partner, who we’ve worked with closely to build that integration. Cyren sends categorization data directly to our cloud, so no customer data will be leaving Microsoft boundaries. We then use this data to determine which blocks to perform on the end user's machine. In order to use this feature, you must acquire a separate license with Cyren, who offers a 60-day free trial license for Microsoft Defender ATP customers. Learn more about partner licensing.

 

Starting today, web content filtering is available for public preview in the Microsoft Defender Security Center. To begin, go to Settings > Advanced features, and click the Web content filtering toggle to turn the feature on. Then, go to Reports > Web reports and click “Connect to partner” on the lower card to start a Cyren trial. Also, check out our technical documentation.

Updated May 12, 2022
Version 4.0

70 Comments

  • KrupaT's avatar
    KrupaT
    Former Employee

    Christopher Brumm Yes, custom indicators have the highest precedence and will override any policy configured through web content filtering. 

  • KrupaT's avatar
    KrupaT
    Former Employee

    Scott650 We are actively evaluating if we can include content filtering as part of E5 license and not require any additional pricing and will update once we have a finalized plan. Hoping to provide an update by 3rd week of April. 

    Could you please share feedback on what additional categories you would like to see?

     

    Chris Johnston - Hoping to finalize the details on licensing (or no-licensing) soon. Thank you for your patience. 

     

    Christopher Brumm - Good feedback, will publish the guidance on this soon. In the interim, you can find out categorization of a url visiting this page:https://www.cyren.com/security-center/url-category-check.

    Also, please leverage custom indicators to selectively allow/block a given URL. https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/manage-indicators

     

     

     

     

  • Scott650's avatar
    Scott650
    Copper Contributor

    Testing out the features, so far looks quite good, would like to see more classifications and control (white listings). Also requested a quote for the ATP web url classification and have not heard back yet.  Understand we are in a unprecedented situation - would like to understand order of magnitude on pricing to see if this is viable - or move to another solution.  Any chance we can get a better understanding of feature sets and pricing when moving to GA ?

     

     

  • We are currently implementing a cloud-only Microsoft 365 deployment with the only 3rd party requirement being SaaS web filtering so would be very interested to switch to this Defender based solution so we can offer a complete solution using M365 but like the above comments how do we find out about licensing / subscription / pricing once the trial ends?      

  • Onboarding worked fine for us. I'm missing a place where I can check the categorization of a given URL and an option to exclude/whitelist special URLs. And yes - some information about pricing would be cool!

  • AaronRothstein's avatar
    AaronRothstein
    Copper Contributor

    Very cool. The post mentions the ability to create block rules for categories, but knowing that categories can be added over time, I'd love to have the ability to create an allow policy for a list of categories, knowing I can always add new ones, IF they are needed.

     

    Will be watching this one closely!

  • AlphaSeb's avatar
    AlphaSeb
    Brass Contributor

    Cool feature. Would like to test it. I have applied for the trial version and entered not enough devices for my tenant and ran directly into the error message:

     

    You are above the device limit for your Cyren license that is used for web content filtering. It supports - devices, but -are currently in use. Go to Cyren partner page and update license
     
    Well, I went to the partner page, and submitted the form, but no reply. Also I can't find pricing anywhere. More info on the pricing and billing (CSP possible?) would be appreciated.
  • This is indeed a much asked question from my customer base. I'm very pleased to see this solution is coming very soon. The first question that pops-up in my mind is however on licensing (yes, sorry, but I believe the technology works :happyface:). As this solution is brought together with the power of Cyren's Content Categorization data, I'm wondering if the licensing for this will be done separately at Cyren's, or if Microsoft is going to be the broker in this (even through the CSP program).

     

    Thanks in advance,

    Ronald van Ackooij

  • Jan Geisbauer's avatar
    Jan Geisbauer
    Brass Contributor

    if you want to see this in action, check out my blog post here: https://emptydc.com/2020/01/27/block-it/

     

    thanks for reading,

    Jan