How to block a website URL with Defender

Introduction

Web browsing is one of the most common attack vectors in business environments. To strengthen security, Microsoft Defender for Endpoint offers a powerful feature : blocking malicious or non-compliant URLs using indicators. This approach allows administrators to define precise rules to prevent access to dangerous sites, while maintaining flexibility tailored to the organization’s needs.

In last month’s article HERE, it was possible to see in the Purview DSPM for AI console that connections to the AI ​​site Deepseek were made, and it would be best to block it for security reasons.

Prerequisites

A Windows 10/11 PC

• A Windows 10/11 PC enrolled in Defender.

Required licenses

• Microsoft 365 Business Premium, Microsoft 365 E3 and Microsoft 365 E5.
• Microsoft Defender for Endpoint Plan 1 or Microsoft Defender for Endpoint Plan 2 in addition to another license (Business Standard, …).

Administrator role

• An account with the Global Administrator or Security Administrator role to access the Microsoft Defender Portal.

Step 1 : Sign in to the Microsoft Defender Portal

Sign in to the Microsoft Defender Portal by opening your web browser to https://security.microsoft.com.

Step 2 : Activate Custom network indicators

In the left menu, click System, then Settings.

Click Endpoints, then Advanced features, and activate the Custom network indicators switch.

Step 3 : Declare the URL to block

Still in the Endpoints menu, click Indicators, then the ULRs/Domains tab, and Add item to create a new policy.

Enter the URL you wish to block and choose whether the policy expires or not.

Choose the Block execution action.

After a few seconds, the policy is deployed.

Step 4 : Confirm website blocking

Here on my computer, you can see that the attempt to navigate to the Deepseek AI website is automatically blocked.

Step 5 : Let’s analyze the logs

In the left menu, click Reports, then Web protection.

We can see here 3 attempts to access Custom Indicators.

The two PC vm-win11 and vm-demo attempted to access the URL of Deepseek AI.

What if I want to allow browsing but display an alert ?

In the URL blocking policy, it’s possible to replace the Block execution action with Warn. Here, we’re applying a policy for the Facebook website.

Access is blocked …

… but clicking the Allow button bypasses the block.

What if I use Google Chrome as my browser?

The settings shown work as is with the Microsoft Edge browser ; by default, Google Chrome will allow you to access blocked websites. You can deploy the Microsoft Defender Browser Protection extension via Intune if you want your settings to apply to it. I will write an article about this soon.

Conclusion

You now know how to block website URLs via Defender.

Sources

Microsoft Learn - Indicators for IPs and URLs/domains

Did you enjoy this post ? If you have any questions, comments or suggestions, please feel free to send me a message from the contact form.

Don’t forget to follow us and share this post.