Edge-only
Where Defender enforces HTTPS URL paths, per Microsoft Learn
How Cybereinforce enforces Microsoft Defender threat intelligence in every browser, stops the phishing sites nobody has reported yet, and watches for look-alikes of your own brand, across every operating system and every team that depends on it.
Every organization that relies on Microsoft Defender for Endpoint has already made the right investment in threat intelligence. The gap this whitepaper documents is not in that intelligence but in where it gets enforced. Microsoft's own documentation confirms that full URL-path blocking over HTTPS is a Microsoft Edge capability: in other browsers, Defender's Network Protection sees the domain a browser connects to, never the path or query string, because that detail stays inside the encrypted session.
Cybereinforce closes that gap with a native browser extension that enforces the same indicator policy at the one point the full URL is still visible: inside the browser, before the request is sent. On top of your own indicators it adds what no reputation feed can offer on day one: newly registered domains blocked on first sight, brand look-alikes confirmed with evidence, phishing-lure detection, and a default block on the Microsoft device-code sign-in step used to steal Microsoft 365 sessions. Brand Protection extends the same watch to look-alikes of your own company.
Enforce existing Defender indicators at full URL in every browser and send every block to Sentinel, without replacing anything already deployed.
Enterprise-grade browser protection with no SOC, SIEM or Microsoft stack required, running on Cybereinforce's own curated threat intelligence.
Look-alikes of your domains and company name found from the first certificate or registration, blocked, reported and taken down.
A new managed revenue line, as Pay-As-You-Go revenue share or prepaid Credits with a locked-in discount.
One enforced control that produces standing evidence across ISO 27001, NIS2, NIST CSF 2.0, DORA and SOC 2.
The same policy on iOS and iPadOS Safari and Firefox for Android, with no separate mobile product.
Defender for Endpoint's custom indicators can block a specific URL path, not just a domain. Microsoft is explicit that this level of precision is Edge-specific for HTTPS:
Outside Edge, enforcement falls to Network Protection, which inspects traffic at the network layer, below the browser, after encryption has already begun:
In practice, Network Protection reads the hostname from the ClientHello/SNI field before the encrypted session begins. The URL path and query string travel inside that session and are invisible to any network-layer control. Microsoft's Web Content Filtering documentation states it plainly: "For HTTPS traffic, full URL paths can be blocked only in Microsoft Edge."
Two further conditions narrow enforcement even for domain-level blocking outside Edge: QUIC and Encrypted Client Hello must be disabled in the browser, and Network Protection must run in block mode. On macOS and Linux, Edge itself "only integrates Web Threat Protection".
Separately, the indicator system has a hard ceiling shared by every indicator type:
A phishing domain registered an hour ago is on no blocklist yet. A device-code lure sends the victim to a genuine Microsoft page. A look-alike of your own brand is aimed at your customers, not your network. Each needs a control that decides on evidence available from the first minute, inside the browser.
Cybereinforce is a native browser extension. It does not sit on the network and does not wait for a TLS handshake to guess at a hostname: it enforces policy inside the browser, where the full request, path and query string included, is available before it is sent. QUIC and Encrypted Client Hello can stay on.
Your Defender URL and domain indicators arrive through a Logic App in your own Azure subscription, on the schedule you choose. Block, Warn and Allow actions are honoured, and Allow becomes an exemption for the right Defender device groups. Add your own rules, MITRE ATT&CK tagged, or run on Cybereinforce Threat Intelligence with no Microsoft stack at all.
Malicious destinations are blocked before the page loads, with a block page that names the reason. Suspicious ones show a warning page: the user goes back to safety or continues at their own risk, and the decision is recorded. Confirmed threats are blocked instantly on repeat visits, even if the service is briefly unreachable.
Every block is logged with the device, the time and the exact indicator or detection that matched. Direct Sentinel Export sends events to the CybereinforceCTE_CL table in near real time, deployed with one Azure template and no secrets to copy, with analytics rules, incidents and a workbook ready to deploy.
| Operating system | Supported browsers |
|---|---|
| Windows & Linux | Chrome, Edge, Brave and other Chromium-based browsers, Firefox |
| macOS | Safari, Chrome, Edge, Brave and other Chromium-based browsers, Firefox |
| iOS & iPadOS | Safari (App Store) |
| Android | Firefox (Firefox Add-ons) |
URL indicators can live in Cybereinforce, up to 5,000 rules per tenant on Enterprise+ plus the curated feed, leaving Defender's 15,000-indicator allowance for file, certificate and IP indicators.
Cybereinforce Threat Intelligence combines a curated, human-reviewed feed with signals that exist from the very first minute of an attack: how old a domain is, what it imitates and how it behaves. Every check runs in real time, before the page loads, and every verdict carries its reason.
| Layer | What it catches | Plans |
|---|---|---|
| Curated indicator feed | 600,000+ malicious domains, URLs and IPs, matched at full-URL precision so one bad path does not condemn a whole legitimate site. | Corporate+ |
| Newly registered domains | Domains under 6 months old blocked on first sight, 6 to 12 months shown with a warning, using the registry's own date across 1,181 extensions, with certificate history where no date is published. | Corporate+ |
| Brand look-alikes | Imitations of 250+ of the most impersonated brands, every major Microsoft product included, recognised by structure and confirmed with age, certificate and page evidence. | Corporate+ |
| Phishing lures | Fake sign-in pages, "shared file" lure chains, fake device-login flows and phishing pages on cloud storage. | Corporate+ |
| Infrastructure & abuse | Machine-generated throw-away domains on risky hosting, and hijacked legitimate sites such as password-reset link abuse. | Corporate+ |
| High-risk TLD controls | A curated list of high-abuse domain endings, plus your own list of TLDs to block, enforced in real time. | Own list: all |
| Device Code Attacks | The Microsoft device-code sign-in page used to steal Microsoft 365 sessions, blocked by default. | All plans |
| Your own rules | Defender indicators and your own allow and block rules, which always come first. | All plans |
Automation finds candidates; people confirm what becomes shared intelligence. Whitelists and false-positive clean-ups keep the feed trustworthy, not just large.
A young domain, look-alike or machine-generated name blocked in one customer's browser is queued for analysts. Confirmed threats protect every customer.
About 10,000 new website certificates are checked every minute, and new registrations daily across hundreds of extensions.
Enterprise+ customers send suspected domains and URLs to our analysts. Anyone can check a domain free with the IOC Lookup at cybereinforce.com/community.
A domain one letter away from yours is all it takes to send your customers a fake invoice or your staff a fake sign-in page. Brand Protection watches your domains and company name in every spelling attackers use: misspellings, look-alike letters, Cyrillic and Greek characters, local spellings, and your name next to words like invoice, login or support in eight languages. Your own domains are never flagged.
| Where we look | How fast |
|---|---|
| Website certificates | Minutes. Every publicly trusted certificate is published in Certificate Transparency logs, often before the page is online. |
| New registrations | Day one, across hundreds of domain extensions, often before the domain hosts a website or sends an email. |
| Your likeliest look-alikes | Every hour, across 40 domain extensions, country domains such as .de and .eu included. |
| Existing domains | A look-back over existing registrations the moment you switch it on, and an optional Extended Check deep search. |
Each look-alike is followed through the steps an attacker takes: registered, given a certificate, set up for email. Every step opens its own Microsoft Sentinel incident with the domain as its entity, and the moment mail servers appear your administrators get an email, usually before the first fake invoice. One click asks us to take it down with the evidence, at $199 per takedown, charged only once the domain is down.
Included for Enterprise clients from 100 licences (one domain per 500 licences); a $29 per month add-on, billed annually, for every other plan.
In a Device Code Attack the victim types an attacker's code into Microsoft's genuine device sign-in page and approves MFA. Microsoft then issues the session to the attacker: no password stolen, no malware, no look-alike domain, and sign-in logs that look entirely normal. Cybereinforce blocks that sign-in step in the browser for every organisation on every plan, by default. However the lure arrives, by email, Teams, SMS or QR code, the browser stops there. It uses none of your rule allowance, and organisations that rely on legitimate device-code sign-ins can permit them through the Whitelist.
Defender indicators are enforced at full URL in every browser without re-authoring anything, and every block lands in Sentinel as an investigation-ready event. Day-zero domains, look-alikes and device-code lures add protection no indicator list can.
No SOC, SIEM or Microsoft E5 licence required. On the Corporate plan Cybereinforce Threat Intelligence protects from the moment the extension is installed, deployed with a company policy or a one-click join link.
Look-alikes of the company's domains and name are found from the first certificate or registration, blocked for every Cybereinforce customer, reported to the SOC and by email, and taken down on request.
Partners choose Pay-As-You-Go, a revenue share starting at 25% and rising to 50% at 60,001+ managed licences with zero upfront commitment, or prepaid Credits, which lock in the volume discount immediately. Credits convert at 1× for Standard, 1.5× for SME, 2× for Corporate and 3× for Enterprise+. The MSSP portal runs every client's organisation, threat intelligence and block pages.
| Framework | Controls / articles evidenced |
|---|---|
| ISO 27001 | A.5.9, A.5.23, A.8.7, A.8.15, A.8.20 |
| NIS2 | Art. 21(2): incident handling and supply-chain security |
| NIST CSF 2.0 | PR.PS-05, DE.CM-01, DE.CM-09 |
| DORA | Art. 9: ICT risk protection and prevention measures |
| SOC 2 | CC6.1 (logical access), CC7.3 (detection) |
Detection alone does not satisfy a control; enforcement does. Every block is timestamped, attributable evidence, kept in your chosen data region.
The same policy extends to iOS and iPadOS through the Safari app and to Android through Firefox, deployed through the same MDM and reporting to the same console, with no separate mobile licence.
| Step | What happens |
|---|---|
| 1. Roll out | A Windows script for Intune, Group Policy and Defender for Endpoint, or a macOS configuration profile, installs the extension for every user, profile and browser. A one-click join link works for pilots. |
| 2. Enrol | Automatic and silent. Devices re-enrol themselves if their credentials ever stop working, and wait for a free seat when licences are full. |
| 3. Bring your intelligence | Deploy the Defender indicator sync from the console, add your own rules, or switch on Cybereinforce Threat Intelligence. |
| 4. Connect your SOC | Deploy Direct Sentinel Export and the analytics rules (SME and higher), test, then switch on. |
| Tier | Retention | Event logs | Rule limit | Adds |
|---|---|---|---|---|
| Standard | 0 days | None | 500 | Full-URL enforcement, Defender sync, Device Code protection |
| SME | 30 days | Up to 500 | 1,000 | Sentinel export, analytics rules, incidents, workbooks |
| Corporate | 90 days | Up to 1,000 | 2,000 | Cybereinforce Threat Intelligence and all detection layers |
| Enterprise+ | 365 days | Up to 2,000 | 5,000 | Analyst investigations (50 a year), custom block page, IOC submissions, Brand Protection from 100 licences |
From $0.99 per browser endpoint per month on Standard, with SME, Corporate and Enterprise+ at 1.5×, 2× and 3×. Minimum 50 endpoints and 12 months. Brand Protection is a $29 per month add-on for every plan. Also on the Microsoft Commercial Marketplace.
2 weeks free, up to 100 rules and 50 devices, no credit card required.
Sources: Microsoft Learn: indicators-overview, indicator-ip-domain, network-protection, web-content-filtering (learn.microsoft.com/en-us/defender-endpoint/), checked October 2026. ISO/IEC 27001, NIS2 Directive (EU) 2022/2555, NIST Cybersecurity Framework 2.0, DORA Regulation (EU) 2022/2554 and AICPA SOC 2 Trust Services Criteria referenced for framework mapping. Cybereinforce is not affiliated with Microsoft; quotations are reproduced for accuracy and are subject to change on Microsoft's part. Contact: info@cybereinforce.com.