Forum Discussion
Kiril
Aug 09, 2023Steel Contributor
Difference between Tenant Allow/Block Lists and Endpoint > Indicators
I am trying to whitelist a URL that is being blocked by Windows Smart Screen on user devices. My initial approach was to submit the URL to Microsoft using an admin submission in the Actions & Submissions of Microsoft 365 Defender, and allow the URL in the process. That worked fine, and the URL was placed on Tenant Allow Lists. However, the user devices still could not reach the URL. After that I created an Indicator in Settings > Endoint > Indicators and allowed the URL. After a short time the user devices were able to access the URL.
What is exactly the difference between Tenant Allow/Block Lists and Endpoint > Indicators? I guess one comes from Microsoft Defender Office 365 and the other from Microsoft Defender for Endpoint, but I am confused about which to use.
Kiril Hello,
The Tenant Allow/Block list URL is to block URLs from being delivered through emails and to control the access to a webpage URL coming from an email.
The indicators are to Allow/Block the URL's from being accessed through the web browser at the endpoint level through the Windows Smart Screen.
to control which website you want to allow\block use the MDE indicators and also the webfiltering as well if you want to block by categories.
Kiril Hello,
The Tenant Allow/Block list URL is to block URLs from being delivered through emails and to control the access to a webpage URL coming from an email.
The indicators are to Allow/Block the URL's from being accessed through the web browser at the endpoint level through the Windows Smart Screen.
to control which website you want to allow\block use the MDE indicators and also the webfiltering as well if you want to block by categories.
- KirilSteel Contributor