Forum Discussion
problems with MS Defender for Endpoint on iOS device
As soon as the app is removed, the connection returns to normal and device is usable again.
Hopefully a fix can be found soon.
MarkTheITGuy The problem is not with Defender on iOS per se but instead with the ATP module (web content filtering). Microsoft provides a script for that. It can be downloaded https://aka.ms/mdatpiossupervisedprofile. The problem is, once a policy that contains that script is created in InTune and is applied to iOS devices, traffic becomes very slow and some sites don't even load (bank sites, news sites, etc.). If you let ATP enabled but remove the policy to filter the traffic it will work fine. However, the outbound traffic will not be inspected anymore.
- Thanks for the reply rickside - It makes sense what you're saying. The downside is that if we remove the policy, and leave the outbound traffic un-inspected, would that then mean that malicious links clicked from emails, that redirect to a malicious site, would then be allowed to load as normal?
We've had a few incidents recently, where unaware users, clicked links in email, and also a couple from website popups, that were blocked by ATP so the user was protected.
Just thinking if we turn it off, would these users (and there will be more) fall pray to these links?
Thanks again, mate.- From what I understand, ATP will still do its job (meaning it will block malicious websites that it already knows) but you are correct, it will not analyze outbound traffic on the fly. Unless Microsoft provides a better way to do this, I am afraid you'll just have to live with it or search for another product/solution. I am not a big fan of the way the traffic inspection works on iOS (i.e. VPN-THAT-POINTS-TO-LOCAL-LOOPBACK) but it seems that's the way they decided to go.
akash_singh_Microsoft
Hi, MarkTheITGuy ,
Apologies for the inconvenience. This is not an expected behaviour, and we will like to investigate this issue further. It will be helpful if you can send us an in-app feedback using the steps outlined here along with Diagnostics Data enabled to allow us to identify the issue better: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/ios-troubleshoot?view=o365-worldwide#send-in-app-feedback
Please do mention the issues you are facing in the feedback such as network latencies, or if any particular set of apps is being affected by Defender.
Thanks,
Akash
Microsoft Defender for Endpoint team
- Thanks, Akash.
I've sent a couple of feedback requests. I needed to reinstall the app and sent another feedback request.
As mentioned in the tickets. When the app is installed and enabled, we get many connection timeouts on a host of different sites using different browsers.
I would say on average, 8/10 URLs visited, throw a connection error and time out.
Thanks again for your reply.- akash_singh_
Thanks MarkTheITGuy . We will investigate the issue and reach out to you with our findings and remediations on our feedback channel.
