Forum Discussion

Spark Zhang's avatar
Spark Zhang
Brass Contributor
Jun 05, 2023

Web content filtering and indicator aren't working on third party browser

Hi, we have just noticed that web content filtering and customized indicators are not working on third party browsers after upgraded defender for endpoint to 4.18.23050.3, the issue has happened to b...
CharlieAD's avatar
CharlieAD
Copper Contributor
Mar 06, 2024
Still does not work for me either. I currently have a case open with Microsoft Premiere Support and its going around in circles. We have checked and rechecked the same configurations and despite everything the behavior remains the same - Edge consistently works, Chrome does not. This is very clearly a broken service and Microsoft on the hook to either fix it or formally declare that they don't support 3rd party browsers. I have sent Premiere Support a half dozen reddit and techcommunity posts highlighting this but we'll see if it reaches the right people.

In the meantime, I have applied a workaround in Intune using a device configuration for Chrome using the "Block access to a list of URLs (Device)" setting and adding the same list of URLs. It stinks that I have to maintain two lists and I don't always receive Defender alerts but at least its a consistent workaround since Chrome is the most popular browser in our small company.
Sathya_Sekar520's avatar
Sathya_Sekar520
Copper Contributor
Mar 06, 2024

I have identified some solution. Could you please share the specific URL you tested? I will verify it on my end to confirm whether it works CharlieAD 

  • CharlieAD's avatar
    CharlieAD
    Copper Contributor
    Mar 06, 2024

    Hi Sathya_Sekar520, we have tested a number of custom indicators.  Here are two harmless sites we used, both of which exhibited the same behaviors on multiple PCs:

     

    lucenttechgroup.com

    fark.com

    http://www.lucenttechgroup.com

    http://www.fark.com

    https://lucenttechgroup.com

    https://fark.com

    https://www.lucenttechgroup.com

    https://www.fark.com

     

    All of these variations produce the same inconsistent results in Chrome.  Edge works every single time.

     

    It should be noted that Premiere Support did find that Microsoft's test URL: https://smartscreentestratings2.net/ is blocked in Chrome every time.  Premiere Support has yet to come back with why that is.

    • Sathya_Sekar520's avatar
      Sathya_Sekar520
      Copper Contributor
      Mar 06, 2024
      Hi, I have two options to check this issue. Please configure and check:

      Use MCAS (Microsoft Cloud App Security) - Validate the URL through MCAS.
      Configure Microsoft Defender browser protection for Chrome and check.
      • CharlieAD's avatar
        CharlieAD
        Copper Contributor
        Mar 13, 2024

        Hi Sathya_Sekar520 - not sure if you saw my question but can you please expand on your suggestion?  I have a Business Premium license so I'm not sure if what you mentioned is feasible.  Thanks.

  • Nweber531's avatar
    Nweber531
    Copper Contributor
    Mar 06, 2024

    Sathya_Sekar520 the URL I have been using with support is https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.chat.openai.com%2F&data=05%7C02%7Cnweber%40AEM.org%7Cb6e2a7fbd4fd4805ae2508dc3c9efdc7%7C57778a97d4144290a93826ca7120b0ed%7C0%7C0%7C638451900808536849%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=E%2Fi6LbgdpHWal37wvn96%2FZJlfpQAyVaJnLbwPP%2B70bY%3D&reserved=0

     

    The block works correct in edge, just not chrome. But chrome does give a windows notification that it is blocked despite still loading.  They are still trying to find answers on their end.

    • CharlieAD's avatar
      CharlieAD
      Copper Contributor
      Mar 06, 2024
      Yes, I should note that's the same behavior I see. The Windows toast message says the site is blocked and there's a corresponding entry in the PC's Windows Event Log, however Chrome still renders the website.
    • Sathya_Sekar520's avatar
      Sathya_Sekar520
      Copper Contributor
      Mar 06, 2024
      Have you individually blocked the URL, or have you categorization-based approach to block URLs?
      • Nweber531's avatar
        Nweber531
        Copper Contributor
        Mar 06, 2024
        We have tried custom indicators in addition to un-sanctioning the app itself in cloud app security. I provided Microsoft some MDEClientAnalyzer logs yesterday which they are still looking into

Resources