Network Protection and Web Protection for macOS and Linux

Over the last two years, the world has dramatically changed both in our daily lives and how companies conduct business. In the pre-pandemic world, eroding boundaries and the maturity of SaaS applications precipitated endpoint-first design. The pandemic and post-pandemic era demand it, the world is embracing hybrid workplaces and zero trust postures.


 


When we first launched Network Protection for Windows and built powerful Web Protection and Microsoft Defender for Cloud Apps (MDA) capabilities on top of it, we knew our vision to bring you our proxy-less endpoint first architecture would remain incomplete until we delivered for macOS and . That day has arrived, and we could not be more excited to share that and Web Protection for macOS is now Generally Available and in Public Preview for !


 


Protection helps reduce the of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.


 


It is the foundation on which our Web Protection for Microsoft for Endpoint is built. These capabilities include Web threat protectionWeb content filtering, and IP/URL Custom indicators. Web protection enables you to secure your devices against web threats and helps to regulate unwanted content.


 


Network protection also integrates Microsoft Defender for Endpoint with Defender for Cloud Apps natively. Currently, the integration for macOS and only supports endpoint enforcement capabilities.


evaluate Network Protection and the features it enables:


 


Explore Network Protection on macOS


 


For Network Protection for macOS to be active on your devices, Network Protection must be enabled by your organization. We suggest deploying the audit or block mode policy to a small set of devices and verify there are no issues or broken workstreams before gradually deploying to a larger set of devices.


 


Prerequisites & Requirements  



  • Licensing: Microsoft for Endpoint tenant (can be trial) 

  • Onboarded Machines: 

    • Minimum macOS version: 11 (Big Sur)

    • MDE product version: 101.94.13




Once the prerequisites have been met, follow installation and configuration instructions in Use network protection to help prevent macOS connections to bad sites | Microsoft Docs


 


Here is how the experience looks on macOS: 


 NickWelton_0-1660729322542.png


 


Explore Network Protection on Linux


 


Prerequisites & Requirements  




Once the prerequisites have been met, follow installation and configuration instructions in Use network protection to help prevent Linux connections to bad sites | Microsoft Docs


 


How do I verify my Mac/Linux device is configured properly?



  1. Navigate to https://smartscreentestratings2.net/ which will block the browser from loading the page. On macOS an accompanying toast message will also be shown.


 On Linux the connection will be disallowed as shown below. There will be no accompanying toast message in Linux:


NickWelton_1-1660729322549.png


 


Alternatively, you can also test this from the Terminal by running the following command and noticing that the connection is blocked by the Network Protection: 


curl https://smartscreentestratings2.net


 


How do I explore the features?



  1. Protect your organization against web threats | Microsoft Docs

    1. Web threat protection is part of Web protection in Microsoft Defender for Endpoint. It uses network protection to secure your devices against web threats.



  2. Run through the IP/URL Custom Indicators of Compromise flow to get blocks on the Custom Indicator type. 

  3. Explore Web content filtering | Microsoft Docs 

    1. Note: if you are removing a policy or changing device groups at the same time, this might cause a delay in policy deployment.

    2. Pro Tip: You can deploy a policy without selecting any category on a device group. This action will create an audit only policy, to help you understand user behavior before creating a block policy.



  4. Integrate Microsoft Defender for Endpoint with Cloud App Security | Microsoft Docs and your Linux and macOS devices with Network Protection enabled will have endpoint policy enforcement capabilities.


Note: Discovery and other features are currently not supported on macOS and Linux platforms.


 


 NickWelton_2-1660729322556.png


 


 


On device experience 


When an end user attempts to access monitored domains on macOS/Linux, their navigation effort will be audited/blocked (depending on Network Protection policy). On macOS, the user will also be informed by Microsoft Defender for Endpoint via toast.


 


NickWelton_3-1660729322605.png


 


macOS


The user will get a plain block experience accompanied by the following toast message which will be displayed by the operating system including the name of the blocked application or website (e.g Blogger.com)  


 


No block pages are shown in third-party browsers, and the user sees a “Secure Connection Failed' page along with a toast notification. Depending on the policy responsible for the block, a user will see a different message in the toast notification. For example, web content filtering will display the message ‘This content is blocked'.


 


NickWelton_4-1660729322608.png


 


 We are looking forward to hearing your feedback and answering any questions you may have!


 


Reference Documents


Microsoft Defender for Endpoint on Mac documentationMicrosoft Defender for Endpoint on Mac | Microsoft Docs 


Microsoft Defender for Endpoint on Linux documentation – Microsoft Defender for Endpoint on Linux | Microsoft Docs


About Microsoft Defender for Endpoint Network Protection – Use network protection to help prevent connections to bad sites | Microsoft Docs 


About Microsoft Defender for Endpoint Network Protection on Linux – Use network protection to help prevent Linux connections to bad sites | Microsoft Docs


About Microsoft Defender for Endpoint Network Protection on macOS – Use network protection to help prevent macOS connections to bad sites | Microsoft Docs


Enable Network Protection – Turn on network protection | Microsoft Docs


Web Protection – Web protection | Microsoft Docs 


Custom Indicators – Create indicators | Microsoft Docs 


Web Content Filtering (WCF) – Web content filtering | Microsoft Docs 


Microsoft Defender for Cloud Apps – Integrate Microsoft Defender for Endpoint with Cloud App Security | Microsoft Docs 


Edge Browser Setup – https://www.microsoft.com/en-us/edge/features 


 


Microsoft Defender for Endpoint is an industry-leading, cloud-powered endpoint security solution offering vulnerability management, endpoint protection, endpoint detection and response, and mobile threat defense in a single unified platform. With our solution, threats are no match. If you are not yet taking advantage of Microsoft's unrivaled threat optics and proven capabilities, sign up for a free trial of Microsoft Defender for Endpoint today.


Microsoft Defender for Endpoint team

 

This article was originally published by Microsoft's Defender for Endpoint Blog. You can find the original article here.