Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Create indicators for IPs and URLs/domains

4 September 2026Doc update+15 / −13 lines

In brief

The documentation now uses a local link, updates the URL precedence example, clarifies network protection logging, and restates that policy changes can take up to 48 hours to apply, usually under two hours.

What Defender admins need to know

Administrators have clearer guidance for configuring and troubleshooting indicators; no configuration change is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create indicators for IPs and URLs/domains

Network Protection requirements

Network allow and block indicators in Microsoft browsers are controlled by the browser's SmartScreen setting.

For other browsers and applications, network allow and block indicators require that the Microsoft Defender for Endpoint component Network Protection is enabled in block mode. For more information on Network Protection and configuration instructions, see Enable network protection.

  • Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators
  • HTTP URLs (including a full URL path) can be blocked for any browser or process
  • HTTPS fully qualified domain names (FQDN) can be blocked in non-Microsoft browsers (indicators specifying a full URL path can only be blocked in Microsoft Edge)
  • Blocking FQDNs in non-Microsoft browsers requires that QUIC and Encrypted Client Hello be disabled in those browsers
  • FQDNs loaded via HTTP2 connection coalescing can only be blocked in Microsoft Edge
  • If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy https://support.microsoft.com/officemicrosoft-365/ takes precedence over the URL indicator policy https://support.microsoft.com.

Network protection implementation

The determination of whether to allow or block access to a site is made after the completion of the three-way handshake via TCP/IP and any TLS handshake. Thus, when a site is blocked by network protection, you might see an action type of ConnectionSuccess under NetworkConnectionEvents in the Microsoft Defender portal, even though the site was blocked. NetworkConnectionEvents are reported from the TCP layer, and not from network protection. After the three-way handshake has completed, access to the site is allowed or blocked by network protection.

Here's an example of how that works:network protection blocking is logged:

  1. Suppose that a user attempts to access a website on their device. The site happens to be hosted on a dangerous domain, and it should be blocked by network protection.

  2. The TCP/IP handshake commences. Before it completes, a NetworkConnectionEvents action is logged, and its ActionType is listed as ConnectionSuccess. However, as soon as the TCP/IP handshake process completes, network protection blocks access to the site. All of thisThe handshake, logging, and blocking sequence happens quickly. A similar process occurs with Microsoft Defender SmartScreenMicrosoft Defender SmartScreen; it's after the handshake completes that a determination is made, and access to a site is either blocked or allowed.

  3. In the Microsoft Defender portal, an alert is listed in the alerts queue. Details of that alert include both NetworkConnectionEvents and AlertEvents. You can see that the site was blocked, even though you also have a NetworkConnectionEvents item with the ActionType of ConnectionSuccess.

Create an indicator for IPs, URLs, or domains from the settings page

To create an indicator for IPs, URLs, or domains from the Microsoft Defender portal, perform the following steps:

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).
  2. Review the details in the Summary tab, then select Save.

To create an indicator for IPs, URLs, or domains from the Microsoft Defender portal, perform the following steps:

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).
  2. Review the details in the Summary tab, then select Save.

Related content