Defender for Endpoint custom indicators: block or allow files, IPs, URLs and certificates

Before you start

A quick check on a Windows device:

• Tenant switches: in Settings › Endpoints › General › Advanced features, turn on Allow or block file (for file indicators) and Custom network indicators (for IPs and URLs), then save.
• Defender Antivirus in active mode with cloud-based protection and behavior monitoring on. Indicators aren't supported when the antivirus runs in passive mode.
• Platform version: anti-malware client 4.18.1901.x or later for files and certificates, 4.18.1906.x or later for IPs and URLs.
• Network protection in block mode for non-Microsoft browsers and other processes; Edge follows its SmartScreen setting.
• File types: on Windows, file indicators cover portable executables (.exe and .dll) only. On macOS they cover Mach-O executables, shell scripts and AppleScript files (real-time protection on); on Linux, ELF and .sh files from version 101.85.27.
• File hash computation improves blocking accuracy, at some performance cost when copying large files.

Get-MpComputerStatus | Select-Object AMRunningMode, AMProductVersion, BehaviorMonitorEnabled
Get-MpPreference | Select-Object EnableNetworkProtection, MAPSReporting, EnableFileHashComputation
Set-MpPreference -EnableFileHashComputation $true   # test devices only; use Intune or Group Policy for fleets

How it works

Indicators live in the Microsoft Defender portal under Settings › Endpoints › Indicators (Rules section).

• A tenant can hold 15,000 indicators, and Microsoft doesn't raise that limit, so treat indicators as a precise tool, not a bulk blocklist.

Checklist

1. 1

   Create the indicator

   • Go to Settings › Endpoints › Indicators and pick the tab: File hashes, IP addresses, URLs/Domains or Certificates.
   • Select Add item (Add indicator on the Certificates tab), enter the value and an expiration date, so temporary blocks don't live forever.
   • Choose the action and description. For block actions, decide whether to generate an alert.
   • Under Scope, select device groups (start with a pilot group), review the summary and save.

   You can also add a file indicator from a file's page during an investigation, or import a CSV; use the current template from the bottom of the import panel, because the format changed when the actions were renamed.

2. 2

   Write the value correctly

   • Domains: contoso.com also matches every subdomain.
   • URL paths: https://contoso.com/block matches only under that path, and HTTPS paths are matched only in Microsoft Edge. HTTP paths work in any browser.
   • IP addresses: single external IPv4 addresses, or all eight IPv6 segments. No ranges, CIDR blocks, wildcards or internal addresses.
   • Certificates: the leaf signing certificate. Parent and child certificates aren't covered, and Microsoft-signed certificates can't be blocked.
3. 3

   Use Warn deliberately

   Warn shows a prompt that users can bypass, with an optional redirect URL to your usage policy. On Windows, the toast only appears if the Files or activities are blocked notification is enabled (FilesBlockedNotificationDisabled = 0 under the Windows Defender Security Center virus and threat protection key).

Verify

• From a device in scope, open the blocked URL in Edge and in another browser, then run:

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType in ("SmartScreenUrlWarning", "ExploitGuardNetworkProtectionBlocked")
| extend AF = parse_json(AdditionalFields)
| project Timestamp, DeviceName, ActionType, RemoteUrl, InitiatingProcessFileName,
          Category = coalesce(tostring(AF.ResponseCategory), tostring(AF.Experience))

• Custom indicator hits show the category CustomBlockList. Don't be misled by a ConnectionSuccess row in DeviceNetworkEvents: network protection decides after the TCP handshake, so that row is logged even when the site was blocked.

search in (DeviceEvents, DeviceFileEvents, DeviceProcessEvents) Timestamp > ago(30d)
| where AdditionalFields contains "EUS:Win32/CustomEnterpriseBlock!cl"
     or AdditionalFields contains "EUS:Win32/CustomEnterpriseNoAlertBlock!cl"
     or AdditionalFields contains "EUS:Win32/CustomCertEnterpriseBlock!cl"

• Microsoft lists a known limitation for alerts: Block and Warn indicators raise only generic informational alerts (your custom title and severity aren't used), Audit raises alerts with your severity, and Allow raises none. More queries are in advanced hunting for Intune admins.

Tips & gotchas

• Chrome or Firefox ignores a domain block: network protection reads the domain from the TLS handshake, so QUIC and Encrypted Client Hello must be turned off in those browsers (Chrome policies QuicAllowed and EncryptedClientHelloEnabled). Sites loaded through HTTP/2 connection coalescing are only blocked in Edge.
• Nothing happens anywhere: check the tenant switch, the device group, the expiration date and the time to apply first.
• A blocked file still runs: it might not be a PE file, the antivirus might be passive (see passive mode and EDR in block mode), or a Defender Antivirus exclusion covers it, because exclusions win over block indicators. Microsoft-signed files can't be blocked.
• Your settings keep changing: indicators synced from Defender for Cloud Apps are overwritten on each sync, including the alert setting.