Defender for Endpoint URL/Domain IOC Block

This guide will allow administrators to enforce a URL ban that will prevent onboarded devices from accessing the domain.

Role Requirements

Procedure Scope: Administrators

Required Group Membership: Admin.Security

Handbook Reference

Package: Device Security

Domain: Endpoint Indicator Management

Modifies: Unsanctioned URLs/Domains

Defender for Endpoint URL/Domain IOC Block

1. Navigate to URL/Domains – O365 Defender, select Add Item.
   
2. In the URL/Domain input box, specify the address. Click Next.
   
3. For the response action, select Block Execution. If an alert should be generated when executed, check Generate Alert and fill in the Alert Title and Alert Severity. At the bottom of the page, fill in the Description with the intent of giving future context if the rule is to be reviewed at a later date. Click Next.
   
4. Click Save on the next page after reviewing the IOC. Actions should take effect in less than 4 hours.