Configure device proxy and Internet connection settings (2023)

Applies to:

• Microsoft Defender for Endpoint Plan 2
• Microsoft 365 advocates

Want to try Defender for Endpoint?Sign up for a free trial.

The Defender for Endpoint sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Defender for Endpoint service. The embedded Defender for Endpoint sensor runs in the system context using the LocalSystem account.

The WinHTTP settings are independent of the Windows Internet Browsing (WinINet) proxy settings (seeWinINet versus WinHTTP). You can only detect a proxy server using the following detection methods:

• Automatic detection methods:

  • transparenter Proxy

  • Web Proxy Auto Discovery Protocol (WPAD)

    monitoring

    If you use a transparent proxy or WPAD in your network topology, you don't need any special configuration. For more information on Defender for Endpoint URL exclusions in the proxy, seeEnable access to Defender for Endpoint service URLs on the proxy server

• Manual static proxy configuration:

  • Registry-Based Configuration

  • WinHTTP configured with the netsh command: only suitable for desktops in a stable topology (e.g. a desktop in a corporate network behind the same proxy)

Manually configure the proxy server with a registry-based static proxy

Configure a registry-based static proxy for the Defender for Endpoint Detection and Response (EDR) sensor to report diagnostic data and communicate with Defender for Endpoint services when a computer can't connect to the internet.

Static proxy can be configured via Group Policy (GP), both settings in Group Policy values ​​must be configured for proxy server to use EDR. Group Policy is available under Administrative Templates.

• Administrative Templates > Windows Components > Data Collection and Display Builds > Configure the connected user experience and telemetry service to use an authenticated proxy.

  configure itCapableand selectDisable the use of authenticated proxy.

• Administrative Templates > Windows Components > Data Collection and Visualization Builds > Configure Experiences and Telemetry for Signed-in Users:

  Configure the proxy.

Configure a static proxy for Microsoft Defender Antivirus

Microsoft Defense AntivirusProtection provided in the cloudprovides near-instant automated protection against new and emerging threats. Please note that connectivity is requiredcustom indicatorsif Defender Antivirus is your antimalware solution of choice. toEDR in lockdown modeHave a primary anti-malware solution if using a non-Microsoft solution.

Configure the static proxy using Group Policy available in the Administrative Templates:

1. Administrative Templates > Windows Components > Microsoft Defender Antivirus > Set proxy server for network connection.

2. configure itCapableand configure the proxy server. Note that the URL must contain either http:// or https://. For versions compatible with https://, seeManage Microsoft Defender Antivirus updates.

3. under the registration keyHKLM\Software\Policies\Microsoft\Windows Defender, the policy sets the registry valueProxy Serveras REG_SZ.

   The registry valueProxy Servertakes the following string format:

   <server name or IP>:<port> For example: http://10.0.0.6:8080

Set the proxy server manually using the netsh command

Use netsh to configure a system-wide static proxy.

1. Open an elevated command line:

   1. Go toBeginand typecmd.
   2. The right mouse buttoncommand soonand selectExecute as administrator.

2. Enter the following command and pressGet into:

   netsh winhttp establece Proxy <proxy>:<porta>

   For example:netsh winhttp definir Proxy 10.0.0.6:8080

To reset the winhttp proxy, type the following command and pressGet into:

netsh winhttp redefinir Proxy

verSyntax, contexts and format of Netsh commandsLearn more.

Enable access to Microsoft Defender for Endpoint service URLs on the proxy server

If a proxy or firewall blocks all traffic and only allows certain domains by default, add the domains listed on the download sheet to the list of allowed domains.

The following downloadable worksheet lists the services and their associated URLs that your network should be able to connect to. Ensure that no network filter or firewall rules are denying access to these URLs. Optionally, you may need to create oneto allowrule specially for them.

If a proxy or firewall has HTTPS inspection (SSL inspection) enabled, exclude the domains listed in the table above from HTTPS inspection. On your firewall, open all URLs where the geographic column is WW. For rows where the geographic column is not WW, open the URLs for your specific data location. For information about checking the data location settings, seeCheck data location and update data retention settings for Microsoft Defender for Endpoint. Don't delete the URL*.blob.core.windows.netany kind of network inspection.

If a proxy or firewall blocks anonymous traffic like Defender for Endpoint Sensor and connects from the system context to ensure anonymous traffic is allowed on the URLs listed above.

Microsoft Monitoring Agent (MMA): Proxy and firewall requirements for previous versions of Windows client or Windows server

The information in the Firewall and Proxy Configuration Information list is required to communicate with the Log Analytics agent (commonly known as Microsoft Monitoring Agent) for earlier versions of Windows such as Windows 7 SP1, Windows 8.1 and Windows Server 2008 R2*.

Confirm the URL requirements for the Microsoft Monitoring Agent (MMA) service.

Read the instructions below to remove the wildcard (*) requirement for your specific environment when using the Microsoft Monitoring Agent (MMA) for earlier versions of Windows.

1. Legacy OS integration with Microsoft Monitoring Agent (MMA) in Defender for Endpoint (seeIntegrate older versions of Windows with Defender for EndpointmiIntegrated Windows servers).

2. Make sure the machine is properly reported in the Microsoft 365 Defender portal.

3. Run the TestCloudConnection.exe tool from C:\Programs\Microsoft Monitoring Agent\Agent to validate connectivity and get the required URLs for your specific workspace.

4. For the full list of requirements for your region, see the list of Microsoft Defender endpoint URLs (see Service URLsspreadsheet).

   

Wildcards (*) used in *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, and *.agentsvc.azure-automation.net URL endpoints can be replaced with your workspace specific . The workspace ID is specific to your environment and workspace. You can find it in the Onboarding your tenant section of the Microsoft 365 Defender portal.

The *.blob.core.windows.net URL endpoint can be replaced with the URLs shown in the Firewall Rule: *.blob.core.windows.net section of the test results.

Verify client connectivity to Microsoft Defender for Endpoint Service URLs

Verify that the proxy configuration completed successfully. WinHTTP can detect and communicate through the proxy server in your environment, and then the proxy server will allow traffic to the Defender for Endpoint service URLs.

1. download theMicrosoft Defender Tool for Endpoint Client Analyzerto the PC running the Defender for Endpoint sensor. For lower servers, use the latest preview version available for downloadMicrosoft Defender Beta Tool for Endpoint Client Analyzer.

2. Extract the contents of MDEClientAnalyzer.zip to the device.

3. Open an elevated command line:

   1. Go toBeginand typecmd.
   2. The right mouse buttoncommand soonand selectExecute as administrator.

4. Enter the following command and pressGet into:

   Disk Path\MDEClientAnalyzer.cmd

   Substitutedisk pathwith the path where the MDEClientAnalyzer tool was downloaded. For example:

   C:\Work\tools\MDEClientAnalyzer\MDEClientAnalyzer.cmd

5. The tool creates and extracts theMDEClientAnalyzerResult.zipto use the file in the folderdisk path.

6. OpenMDEClientAnalyzerResult.txtand make sure you've followed the proxy configuration steps to enable server discovery and access to service URLs.

   The tool verifies the connectivity of Defender for Endpoint service URLs. Make sure the Defender for Endpoint client is configured to interact. The tool prints the results on theMDEClientAnalyzerResult.txtFile for each URL that could potentially be used to communicate with Defender for Endpoint services. For example:

   Test URL: https://xxx.microsoft.com/xxx1 - Default proxy: OK (200)2 - Automatic proxy detection (WPAD): OK (200)3 - Proxy disabled: OK (200)4 - Proxy with name: No 't exist5 - command line proxy: does not exist

If one of the connectivity options returns a status (200), the Defender for Endpoint client can successfully communicate with the tested URL using this connectivity method.

However, if the connectivity check results show an error, an HTTP error is displayed (see HTTP status codes). You can then use the URLs in the table inEnable access to Defender for Endpoint service URLs on the proxy server. The URLs available for use depend on the region selected during the onboarding process.

related posts

• Separate environments, proxies and Microsoft Defender for Endpoint
• Use Group Policy settings to configure and manage Microsoft Defender Antivirus
• Windows built-in devices
• Troubleshoot Microsoft Defender for Endpoint Integration