Why is SmartScreen blocking code.visualstudio.com but yet visualstudio.com works fine?

Question

We're trialing Defender as a replacement to Sophos (I'm tired of being let down by Sophos's product team).

We've got what appears to be a healthy configuration in testing - including content filtering blocks.

Testers can access visualstudio.com just fine (as they should) but get a smartscreen denial for code.visualstudio.com (which they shouldn't be denied on) - trying to understand why Microsoft are blocking one of their own sites...

In addition to which, the ADMX controls for bypass. don't appear to work:

Open to suggestions at this point - as it's really not playing ball:

Answer 1

Hi @Rob Brown,

I read your description. According to the screenshot, the value of the "SmartScreenAllowListDomains" policy is configured correctly. So according to this prompt, please first confirm one thing: whether your company has configured relevant policies to prohibit access to "code.visualstudio.com".

In addition, please note that if your organization has enabled Microsoft Defender for Endpoint, this policy and any allow list created with it will be ignored. You must configure your allow and block lists in Microsoft 365 Defender portal using Indicators (Settings > Endpoints > Indicators). You can refer to this link for more detailed information.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,

Jinxin Wang

Answer 2

@Jinxin Wang (Shanghai Wicresoft Co Ltd)
Found the issue. Turns out when you enable the integration between Defender Portal and InTune portal, the switch for custom indicators gets reset and needs to be re-enabled again - and I'd missed it when reviewing the problem.

Switch is enabled again, and now indicators are working properly.

Would strongly suggest an update to the Defender guidance\FAQ.