Blocked IP In IOC In MDE, however the traffic is not blocked from the source

Hi,

We ran into exactly the same issue in our environment.

The main reason: MDE IP indicators only block OUTBOUND connections. They're enforced through Network Protection, which inspects connections that the device itself initiates. Connections coming IN from that IP to your devices are not blocked by the indicator, which is why you still see "InboundConnectionAccepted" in DeviceNetworkEvents.

I am not sure if you found your solution but If you are still seeing outbound connections getting through, these are worth checking:

1. Network Protection must be in Block mode, not Audit or Off. On a device, run: Get-MpPreference | Select EnableNetworkProtection (1 = Block, 2 = Audit, 0 = Off).

2. Custom network indicators must be turned on under Settings....Endpoints.....Advanced features.

3. Microsoft Defender Antivirus must be in active mode, not passive mode.

4. The indicator's scope should include correct device group.

5. Only single public IP addresses are supported. CIDR ranges and internal/private IPs aren't supported in IP indicators.

How we fixed it:

Since our traffic was inbound, the indicator was never going to stop it. We blocked it at the firewall level instead by [creating an inbound block rule for the IP in Windows Defender Firewall, deployed through Intune (Endpoint security > Firewall) / adding the IP to our perimeter firewall block list]. We kept the MDE indicator in place so any outbound connections to that IP are blocked as well.

We then confirmed it was working with this Advanced Hunting query:

DeviceNetworkEvents

| where Timestamp > ago(1d)

| where RemoteIP == "x.x.x.x"

| summarize Connections = count() by ActionType, DeviceName

After the firewall rule, the inbound accepted connections stopped showing up.

Hope this helps.