Forum Discussion
AnuragSrivastava
Dec 06, 2020Iron Contributor
ASR | Legit URL getting blocked
Hi, A legit exchange url is getting blocked by defender and showing the action type as ExploitGuardNetworkProtectionBlocked. The event info says that the URL is blocked as Custom Policy by ASR. ...
sewtom
Jan 20, 2021Copper Contributor
Nope, the case has been ongoing for several weeks. Several things have been tried but we don't yet know the true cause. Will try to remember to update here when I know 🙂
edinili84
Feb 09, 2021Brass Contributor
You might see this if you are using the web content filtering in Defender for Endpoint. Check the web protection reports and you might see that URL being blocked by one of the web content filtering categories.
- sewtomFeb 09, 2021Copper ContributorThanks yes we are using that but that was only part of the issue. Disabling 'unknown' categories has helped (it's in beta apparently) but we still have other issues with explicitly allowed sites getting blocked.
It seems a combination of conflict with SmartScreen and browser cache, however.- DCoombe460Jan 06, 2022Copper Contributor
Over a year later and we're seeing the same issue. Site was tagged as pornography, it wasn't. Created an exception and it is still blocked.
- Jake_MowrerJan 13, 2022
Microsoft
Allow network indicator will allow you to override however there is a delay for it to hit the endpoint (up to 2 hours) doc'd here: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-ip-domain?view=o365-worldwide#before-you-begin
Please be sure to dispute the category in the UI as doc'd here:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-content-filtering?view=o365-worldwide#dispute-categories
Thanks,
Jake Mowrer