Forum Discussion

Iron Contributor

Sep 11, 2023

Solved

Live Response URL's

Hoping to clarify URL requirements for Live Response in Defender for Endpoint. The URLs listed in the Defender URLs spreadsheet online that reference being required for Live Response are: *.wns.w...

PJR_CDF
Sep 13, 2023
I've found an older version of the Defender URLs spreadsheet that has an entry for

*.notify.windows.com

The latest version of the spreadsheet doesnt contain this URL anymore and only lists the following requirements for Live Response:

*.wns.windows.com
login.live.com
login.microsoftonline.com

Interestingly in the ChangeLog tab on the latest version of the spreadsheet, it notes that *.notify.windows.com was removed on the 25/01/22. I have a version I downloaded in May this year with that URL present.

Regardless of the above it looks like perhaps they havent updated the connectivity analyzer to remove the test to global.notify.windows.com.

jbmartin6

Iron Contributor

Sep 11, 2023

Well, (client.wns.windows.com) is covered by *.wns.windows.com, maybe there is a wildcard elsewhere in the reference that covers (global.notify.windows.com)

jbmartin6

Iron Contributor

Sep 11, 2023

Ah sorry, I see you already considered that, my mistake I should have re-read before replying.

PJR_CDF
Iron Contributor
Sep 13, 2023
I've found an older version of the Defender URLs spreadsheet that has an entry for

*.notify.windows.com

The latest version of the spreadsheet doesnt contain this URL anymore and only lists the following requirements for Live Response:

*.wns.windows.com
login.live.com
login.microsoftonline.com

Interestingly in the ChangeLog tab on the latest version of the spreadsheet, it notes that *.notify.windows.com was removed on the 25/01/22. I have a version I downloaded in May this year with that URL present.

Regardless of the above it looks like perhaps they havent updated the connectivity analyzer to remove the test to global.notify.windows.com.