Forum Discussion
problems with MS Defender for Endpoint on iOS device
MarkTheITGuy The problem is not with Defender on iOS per se but instead with the ATP module (web content filtering). Microsoft provides a script for that. It can be downloaded here. The problem is, once a policy that contains that script is created in InTune and is applied to iOS devices, traffic becomes very slow and some sites don't even load (bank sites, news sites, etc.). If you let ATP enabled but remove the policy to filter the traffic it will work fine. However, the outbound traffic will not be inspected anymore.
We've had a few incidents recently, where unaware users, clicked links in email, and also a couple from website popups, that were blocked by ATP so the user was protected.
Just thinking if we turn it off, would these users (and there will be more) fall pray to these links?
Thanks again, mate.
- From what I understand, ATP will still do its job (meaning it will block malicious websites that it already knows) but you are correct, it will not analyze outbound traffic on the fly. Unless Microsoft provides a better way to do this, I am afraid you'll just have to live with it or search for another product/solution. I am not a big fan of the way the traffic inspection works on iOS (i.e. VPN-THAT-POINTS-TO-LOCAL-LOOPBACK) but it seems that's the way they decided to go.
sunayanasinghMicrosoft
rickside MarkTheITGuy , Currently there is a known issue with the content profile (script that you deploy from Intune) which is causing internet connectivity problems. We are looking into this issue. Meanwhile, you can un-deploy this profile to help resolve the internet connectivity problems. Please find more details here.
Also, even without the profile, Defender for Endpoint will still protect you from phishing in real-time leveraging the VPN capabilities. Hope this helps. Please revert back for further questions.
- sunayanasingh Thanks for the update. Out of curiosity, any ETA currently for the updated profile to be released?
