Forum Discussion
Solved
Indicator allow/block list not working over Web Content Filtering
Hi all, We have Web Content Filtering to block selected categories. WCF is working well as intended that browsing the selected categories is blocked on both Edge and Chrome browsers. We also...
- It ended up being such an obvious one. Sharing it here in case anyone struggle to get it working for the same reason.
Go to Microsoft 365 Defender Admin Portal > Settings > Endpoints > Advanced Features.
Enable "Custom Network Indicators".
IsaacPark that's weird, with that in place you should be able to override the blocked category. I suggest you open a ticket with the Microsoft security team so they can check your tenant in the backend.
We have multiple tenants showing the same problem. We even created a brand new tenant and clean setup the WCF and Indicator for testing (to eliminate the possible interference by other existing policies), same thing is happening. So, we thought it could be a global issue or at least across APAC region, hence the post to tech community to see if anyone else is also experiencing it.
Full disclaimer, this is first time we are using the indicator. Never needed to until now. So, it may just be a silly mistake of missing a tick box somewhere we didn't know we had to enable/disable to get the indicator working. I have gone over Microsoft documentations over and over on WCF and Indicators but could not find anything I missed. (another reason for posting to tech community, to get feedback from the experienced users to advise on tips Microsoft Docs may have overlooked).
Much appreciate your continued interests and suggestions. If it's not too much trouble can you check if the URLs/Domain based indicators are working in your tenant?
Yes, I logged a support call with Microsoft. Over the screen share session, the MS support confirmed all configurations are correct and it 'should' work. Asked me to blow away all indicators and recreate them (and wait a few hours for it to kick in). This did not make any changes. As a next step, they asked for Process Steps Recorder showing WCF & Indicator settings, then record browsing the allowed sites to show they are still being blocked. So it's pretty much repeating what I already showed them over screen share, but in recorded format. Hopefully they will come back with some good suggestions to try next.
Cheers,
Full disclaimer, this is first time we are using the indicator. Never needed to until now. So, it may just be a silly mistake of missing a tick box somewhere we didn't know we had to enable/disable to get the indicator working. I have gone over Microsoft documentations over and over on WCF and Indicators but could not find anything I missed. (another reason for posting to tech community, to get feedback from the experienced users to advise on tips Microsoft Docs may have overlooked).
Much appreciate your continued interests and suggestions. If it's not too much trouble can you check if the URLs/Domain based indicators are working in your tenant?
Yes, I logged a support call with Microsoft. Over the screen share session, the MS support confirmed all configurations are correct and it 'should' work. Asked me to blow away all indicators and recreate them (and wait a few hours for it to kick in). This did not make any changes. As a next step, they asked for Process Steps Recorder showing WCF & Indicator settings, then record browsing the allowed sites to show they are still being blocked. So it's pretty much repeating what I already showed them over screen share, but in recorded format. Hopefully they will come back with some good suggestions to try next.
Cheers,