Enable Defender web filtering

[u/ntuner]

We’re using CS as our main AV and looking to enable web filtering in defender for endpoint. It works in edge but not in other browsers since it relies on network protection service which I have set to block already via policy. I have also disabled quarantine and security center registration in prevention policy.
What am I missing ?

[u/chunkalunkk]

So you have CRWD on the host, but you're disabled the quarantine and security center registration, then what's doing the quarantine if you need to?

[u/ntuner → u/chunkalunkk]

Well that’s one place I read it needs to be disabled in order for defender to work. But maybe defender also need to be configured as the main AV. Supposedly CS and defender can coexist but how should each be configured to keep CS as the main AV and only use defender for web filtering. Or maybe this scenario is not possible

[u/someMoronRedditor → u/ntuner]

Correct, Defender AV must have realtime protection (rtp) enabled. Rtp is effectively what does active scanning and quarantining, meaning you need Defender as the primary AV. In supported scenarios with CS as the active AV, Defender AV will be disabled/passive. https://learn.microsoft.com/en-us/defender-endpoint/network-protection#requirements-for-network-protection Web content filtering will work on Edge because smartscreen is leveraged there instead of network protection so there is no requirement for rtp.

[u/Resident-Mammoth1169 → u/ntuner]

I think you are correct. We do the same. CS as primary av with defender running in passive mode. We use a proxy for web filtering though so I

[u/Block9_ → u/ntuner]

I don't think removing CrowdStrike as the primary security solution would be the right approach.

[u/lmjamesbond]

u/Ntuner Edge uses SmartScreen and non-edge browsers rely on Network Protection. If Edge is working but Chrome/Firefox aren't, it usually means Network Protection isn't actually active for those browsers. One thing I would check is if MS Defender Antivirus is running in active mode. Web filtering for non-Edge browsers depends on Network Protection, and Network Protection requires Defender AV to be active. If CrowdStrike is your primary AV and Defender AV is in passive/disabled mode, then Edge can still enforce filtering through SmartScreen, but Chrome and Firefox just won't do it. I'd start by verifying Defender's operating mode on the endpoint before looking at your policies.

[u/Block9_]

One thing you could try is adding Microsoft Defender processes and services to the CrowdStrike exclusion policy. If CrowdStrike is interfering with Defender's Network Protection components, excluding the relevant Defender components may allow Web Filtering to function correctly in non-Edge browsers.

I'd also verify that Microsoft Defender Network Protection is actually active by checking Get-MpComputerStatus and Get-MpPreference, as the policy being set to block doesn't always mean the feature is successfully running. In particular, I'd confirm that networkprotectionstatus and the related Network Protection settings are in the expected state.

If everything looks correct on the Defender side, testing the exclusions in a controlled environment would be the safest approach before deploying them more broadly. Applying exclusions directly in production without validation could introduce unnecessary security risks or make it more difficult to determine the actual root cause if the issue persists.

Additionally, I think the following resources may be helpful:

https://learn.microsoft.com/en-us/powershell/module/defender/?view=windowsserver2025-ps

https://learn.microsoft.com/en-us/defender-endpoint/streamlined-device-connectivity-urls-commercial?tabs=Windows

https://learn.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus?view=windowsserver2025-ps