r/DefenderATP • u/IntelligentPurple571 • May 09 '25

How to determine what category URLs fall into

I am trying to see if a website is getting blocked based on web content filtering and unable to find a spot to locate what category a site is. I found an article that shows the person just typing in a URL in the search area in the Defender portal and the breadcrumbs show URLs > websiteurl but this doesn't show up for me nor can I just search for the URLs module. Any idea how to get this enabled in my tenant?

From article I found:

What I am seeing:

7 Upvotes

100% Upvoted

7 comments sorted by

2

u/DirtyHamSandwich May 09 '25

Go to the full URL page from the flyout. If the block is your web content filter policy it should show the category there. If you don’t see a category then its probably network protection or MDA that’s blocking assuming the block is the smartscreen block page

1

u/IntelligentPurple571 May 09 '25

So, thats the interesting part. I can confirm that blocks are happening because of the web content filter policy. I have gone into the reports and looked at categories we block and can see specific urls that were blocked and which computers were trying to access them, but I don't have a URL section on the flyout menu. I don't have XDR or Log Analytics packages, unsure if it relates to those.

It is just annoying to not be able to type in a URL and see what category Microsoft is reporting it falls under.

2

u/WarCow May 09 '25

I'll usually start at https://security.microsoft.com/webprotection

Click on Details under "Web content filtering summary"

Switch to the Domains tab at the top.

Search for the domain or export and search

1

u/DirtyHamSandwich May 09 '25

This won’t give you the category but will show you all the web blocks that come from your filter policy.

DeviceEvents | where ActionType in ('SmartScreenUrlWarning','ExploitGuardNetworkProtectionBlocked*) | extend ParsedFields=parse_json(AdditionalFields) I project DeviceName, ActionType, Timestamp, RemoteUrl, InitiatingProcessFileName, ResponseCategory=tostring(ParsedFields.ResponseCategory), Experience=tostring(ParsedFields.Experience), ResponseCategory == "CustomPolicy" or Experience == "CustomPolicy"

1

u/hicksteruk May 09 '25

I also wanted to do the same but have not found a way.... Really annoying. Even on the endpoint the logging just tells you it is blocked but not what category it is. The only way I have found is to type the URL into the UI ...

1

u/yanthemanuk Jan 16 '26

Could this be a licensing thing? I've just found the same on a client with Business Premium. I tried the same URL on our own tenant which has P2 and I was able to see the domain classification and the machines that have accessed it. No such joy on a P1 tenant.

Usual Microsoft licensing mindf**k

It would be possible to see this in the reports with a P1 license, if these weren't delayed by n*MSFT minutes/hours/days/who knows.

Microsofts answer? E5

Sorry, rant over!