Forum Discussion
Indicator Policy Change with Defender takes more than 2 hours
Hi, We have recently ran into an issue that indicator was created through automation to block a benign URL (Shxt happens) and removal of the IoC did not sync with devices for 6 hours, maybe even ...
Thanks for your response! ItsBhatti
Those are the checks we do no matter what, for sure.
It is inconsistent I believe the block-setting would be implemented in 2 hours as expected but a whitelist would not. I have a support case with Microsoft. I will keep this post updated.
Those are the checks we do no matter what, for sure.
It is inconsistent I believe the block-setting would be implemented in 2 hours as expected but a whitelist would not. I have a support case with Microsoft. I will keep this post updated.
Did you hear back from Microsoft? Do you have a way to speed up whitelisting, or an expected timeline?