Defender for Endpoint IP Address IOC Block

This guide will allow administrators to block access to specified external IPs for devices registered through Intune.

Role Requirements

Procedure Scope: Administrators

Required Group Membership: Admin.Security

Handbook Reference

Package: Device Security

Domain: Endpoint Indicator Management

Modifies: Unsanctioned IP Addresses

Defender for Endpoint IP Address IOC Block

1. Navigate to IP Addresses – O365 Defender, select Add Item.
   
2. In the IP Address input box, specify an IP address. Click Next.
   
3. For the response action, select Block Execution. If an alert should be generated when executed, check Generate Alert and fill in the Alert Title and Alert Severity. At the bottom of the page, fill in the Description with the intent of giving future context if the rule is to be reviewed at a later date. Click Next.
   
4. Click Save on the next page after reviewing the IOC. Actions should take effect in less than 4 hours.