MS-Defender

Exclude the Microsoft Defender endpoints that are used for protection, telemetry, updates, portal access, and certificate validation from SSL decryption. The context supports these key URLs and patterns:

• Microsoft Defender Antivirus cloud protection:
  • *.wdcp.microsoft.com
  • *.wdcpalt.microsoft.com
  • *.wd.microsoft.com
• Microsoft Defender Antivirus telemetry and configuration:
  • *.events.data.microsoft.com
  • *ecs.office.com/config/v1/MicrosoftWindowsDefenderClient
• SmartScreen, Network Protection, and custom URL indicators:
  • *.smartscreen-prod.microsoft.com
  • *.smartscreen.microsoft.com
• Security intelligence and product updates:
  • *.update.microsoft.com
  • *.delivery.mp.microsoft.com
  • *.windowsupdate.com
  • ctldl.windowsupdate.com
• Defender portal and sign-in endpoints used for admin/security operations:
  • *.blob.core.windows.net
  • https://*.microsoftonline-p.com
  • https://secure.aadcdn.microsoftonline-p.com
  • https://static2.sharepointonline.com
  • https://login.microsoftonline.com
  • https://*.securitycenter.windows.com
  • https://*.api.security.microsoft.com
  • https://security.microsoft.com
• If using Security Management for Microsoft Defender for Endpoint:
  • enterpriseregistration.windows.net
  • *.dm.microsoft.com
• If using Microsoft Monitoring Agent (older MMA-based scenarios):
  • *.ods.opinsights.azure.com
  • *.oms.opinsights.azure.com
  • *.blob.core.windows.net
• If using vulnerability assessment for network devices:
  • *.blob.core.windows.net/networkscannerstable/*
• Certificate validation destinations that the OS uses:
  • crl.microsoft.com/pki/crl/*
  • ctldl.windowsupdate.com
  • www.microsoft.com/pkiops/*
  • http://www.microsoft.com/pki/certs

Notes:

• Port 443 is used for the Defender connectivity URLs, and port 80 is also required for some certificate validation URLs.
• For certificate validation checks, the operating system must be able to connect to those destinations, or the device must be updated with the latest certificate trust lists if direct retrieval is not possible.
• Some endpoints are optional depending on deployment model, such as WSUS/Configuration Manager/file-share managed updates, Security Management, MMA-based onboarding, or network scanner usage.

References:

• Configure and validate Microsoft Defender Antivirus network connections
• Microsoft Defender for Endpoint standard connectivity URLs - commercial
• Microsoft Defender for Endpoint streamlined connectivity URLs - commercial
• Microsoft Defender for Endpoint streamlined connectivity URLs - US government environments (Preview)