Defender for Business Web Content Filtering

Many UK SMEs spend thousands of pounds annually on third-party web filtering tools like Cisco Umbrella, DNSFilter, or Webroot, unaware that their existing Microsoft 365 Business Premium licences already include enterprise-grade web security. Microsoft Defender for Business (MDB) provides native Web Threat Protection and Web Content Filtering (WCF) directly at the operating system level, protecting corporate laptops whether employees work in the office, from home, or on public Wi-Fi.

Rather than relying on clunky third-party DNS forwarders, local proxy agents, or browser-specific extensions that users can disable, Defender for Business leverages Windows Network Protection. Network Protection operates at the network stack (NDIS driver) level. It inspects all outbound HTTP, HTTPS, and DNS traffic before packets leave the machine. This blocks malicious domains, command-and-control infrastructure, and non-compliant web categories across Microsoft Edge, Google Chrome, Mozilla Firefox, and non-browser background processes alike.

Quick answer

To enable native web content filtering in Microsoft Defender for Business:

1. Verify that your endpoints are onboarded to Microsoft Defender for Business via Microsoft Intune.
2. In the Microsoft Defender XDR portal (security.microsoft.com), navigate to Settings > Endpoints > Advanced features and toggle Web content filtering to On.
3. In the Microsoft Intune admin center, create an Attack surface reduction policy under Endpoint security setting Enable network protection to Enabled (Block mode).
4. Return to the Defender portal under Settings > Endpoints > Web content filtering and add a policy selecting the web categories to block (such as Adult content, High bandwidth, Legal liability, or Uncategorised).
5. Scope the policy to your machine groups or apply it tenant-wide across all onboarded devices.
6. Configure custom allow or block domains under Settings > Endpoints > Indicators to handle specific corporate exemptions.
7. Decommission redundant third-party DNS filtering agents to eliminate software conflicts, improve battery life, and reduce software subscription costs.

Who this affects

This architectural consolidation is intended for UK IT managers, business owners, and technology consultants overseeing Microsoft 365 Business Premium or Microsoft Defender for Business tenants. You should act on this if:

• You are currently paying a monthly per-seat fee for third-party DNS security solutions that duplicate controls already bundled into Business Premium.
• Hybrid and remote staff take corporate laptops home, leaving them outside the protection of physical office firewalls without a cloud-native boundary filter.
• Your company is aligning with the UK National Cyber Security Centre (NCSC) Cyber Essentials criteria, which require boundary gateway and firewall controls to prevent access to untrusted, malicious domains.
• Your users experience network drops, VPN routing issues, or captive portal failures caused by competing third-party DNS filter agents intercepting localhost lookups.
• You need central, auditable visibility into web security incidents and blocked attempts without managing separate vendor consoles.

What usually goes wrong

Deploying web filtering via Defender for Business is straightforward, but several common configuration traps prevent policies from enforcing correctly.

What to check first

Before deploying category blocking across your production estate, verify the health of your endpoint security baseline.

Evidence to collect

To provide robust compliance evidence for internal governance or external Cyber Essentials assessments, capture the following artifacts:

Fix path

Follow these structured steps to configure, deploy, and validate Microsoft Defender for Business web content filtering.

Step 1: Enable Web Content Filtering in the Defender Portal

1. Sign in to the Microsoft Defender XDR portal (security.microsoft.com) as a Security Administrator or Global Administrator.
2. In the left navigation menu, select Settings > Endpoints.
3. Under General, select Advanced features.
4. Scroll down to Web content filtering and toggle the setting to On.
5. Ensure Custom network indicators is also toggled to On (this allows you to create custom URL and IP allow/block lists).
6. Select Save preferences at the bottom of the page.

Step 2: Configure Network Protection in Microsoft Intune

Category filtering cannot inspect traffic unless Network Protection is actively running in Block mode on the client operating system:

1. Sign in to the Microsoft Intune admin center (intune.microsoft.com).
2. Navigate to Endpoint security > Attack surface reduction.
3. Select Create Policy.
4. Set Platform to Windows 10 and later.
5. Set Profile to Web protection.
6. Select Create.
7. Name the policy (for example, Windows-ASR-NetworkProtection-BlockMode).
8. Under Configuration settings:
   • Enable network protection: Set to Enabled (block mode).
   • Require SmartScreen for Microsoft Edge: Set to Yes.
   • Block malicious site access: Set to Yes.
   • Block unverified file download: Set to Yes.
9. Under Assignments, target All Devices (or your designated corporate laptop group).
10. Complete the wizard and save the policy.

Step 3: Build your Web Content Filtering category policy

1. Return to the Microsoft Defender portal (security.microsoft.com).
2. Navigate to Settings > Endpoints > Web content filtering.
3. Select Add policy.
4. Specify a policy name (such as Standard-Corporate-WebFilter-Policy).
5. Choose the categories to block:
   • Adult content: Explicit, adult, nudity, sex education (recommended block).
   • High bandwidth: Streaming media, games, download sites, peer-to-peer (block or monitor based on bandwidth policy).
   • Legal liability: Gambling, criminal activity, copyright infringement, weapons (recommended block).
   • Uncategorised: Websites whose reputation has not yet been classified (leave unblocked initially to prevent false positives).
6. Scope the policy to All device groups (or select specific machine groups).
7. Review your selections and select Save. Note that policy replication to endpoints typically takes 2 to 4 hours.

Step 4: Add custom indicators for corporate exceptions

If internal workflows require access to a specific site in a blocked category, or if you need to immediately block an emerging threat domain:

1. In the Defender portal, go to Settings > Endpoints > Indicators.
2. Select the URLs/Domains tab and click Add item.
3. Enter the URL (such as partner-portal.example.com).
4. Set the Action to Allow (or Block execution).
5. Specify an expiration date or keep it permanent.
6. Provide a clear business justification in the description.
7. Select the target device groups and click Save.

Step 5: Test client-side enforcement

To safely test and verify that filtering is active on an onboarded Windows endpoint:

1. Open PowerShell as an administrator on the test machine and verify Network Protection:

   # Verify Network Protection is set to 1 (Block)
   Get-MpPreference | Select-Object EnableNetworkProtection
   

2. Open Google Chrome or Mozilla Firefox (not Microsoft Edge, to verify cross-browser Network Protection).
3. Attempt to navigate to Microsoft's safe Network Protection test domain: http://smartscreentestratings2.net
4. The browser should display a Windows Defender notification or block page stating that the connection was terminated by your organisation's security policy.
5. Open Event Viewer (eventvwr.msc) and check: Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational Look for Event ID 1125 (Network Protection blocked connection to malicious IP/URL) or Event ID 1126 (Network Protection audited connection).

Common mistakes

• Leaving Network Protection in Audit mode: Setting Network Protection to "Audit" records blocks in telemetry but allows the user to browse the site unobstructed. Cyber Essentials requires active boundary blocking, not passive auditing.
• Relying solely on Edge SmartScreen: Edge SmartScreen only protects traffic within the Edge browser. If an employee uses Chrome, Firefox, or an unmanaged desktop application, web traffic bypasses Edge controls unless Network Protection is enabled.
• Blocking Uncategorised domains prematurely: Blocking uncategorised sites sounds secure in theory, but in practice, it frequently blocks new regional supplier websites, local council portals, and newly registered SaaS vendors. Run in monitor mode before considering uncategorised blocks.
• Forgetting to decommission legacy DNS agents: Leaving old software like Cisco Umbrella or Webroot installed alongside Defender leads to race conditions in the Windows DNS cache, resulting in intermittent DNS lookup timeouts and user complaints.
• Neglecting indicator maintenance: Adding domain exceptions without expiry dates or documented justifications creates administrative sprawl over time. Review Indicators quarterly as part of routine security maintenance.

Related route

If your organisation needs assistance auditing Defender policies, consolidating redundant third-party security software, or hardening endpoints to prevent malware execution, explore our Microsoft Defender endpoint cleanup service.

References

• Microsoft Learn: Web content filtering in Microsoft Defender for Endpoint
• NCSC: Cyber Essentials Requirements for Infrastructure and Gateways
• Microsoft Learn: Enable network protection in Microsoft Defender
• Microsoft Learn: Manage indicators in Microsoft Defender for Endpoint