Oct 03 2023 08:49 AM
Hello all.
We are considering Defender for Endpoint as a potential replacement for our current AV solution. We currently have it enabled for a deeper look into the vulnerabilities and missing updates on the computers in our environment.
We are not utilizing all the pieces now due to having the third-party AV installed. We want to test out the Web Filtering on a handful of computers. Will turning on Web Filtering from the portal cause issues with devices with Defender in passive mode?
Oct 03 2023 10:03 AM
@crhode13 No, web filtering feature is to block categorized websites through MDE and performed by Windows Defender SmartScreen (Microsoft Edge) and Network Protection (Chrome, Firefox, Brave, and Opera)
Oct 03 2023 05:59 PM - edited Oct 03 2023 06:00 PM
One thing I will caution in regards to web content filtering (WCF) via MDE:
If your organization's internet traffic funnels through a forwarding proxy - you'll probably want to keep an eye on just how much this feature slams your proxy.
We found out the hard way just today that even having it set to audit, we're seeing about a 330% increase in traffic out to the WCF URL hitting our proxy.
So, what may be ~5 million calls per day to the smart screen URL without WCF suddenly becomes ~17 million calls per day with WCF turned on.
Oct 04 2023 07:07 AM - edited Oct 04 2023 08:31 AM
@crhode13 No. Web content filtering will support in Passive mode but only in Microsoft Edge browser.