Windows Defender Application Guard: Firewall rules

Question

Dear all,
I would like to limit the traffic that the Edge browser in WDAG (Windows Defender Application Guard) can initiate (outbound). The idea is to prevent access to internal network addresses in cases where the WDAG container gets taken over. Therefore I would like to prevent access to local sites.

How can I achieve this? How can I define firewall rules for the WDAG traffic?

Furthermore, is it possible to change the routing of the WDAG traffic e.g. to go via a second network adapter (VPN or physical)?

Thanks!
Peter

Answer 1

You may define Network Boundry, and the policy is located on Computer Configuration\Administrative Templates\Network\Network Isolation.
Have a look at:
https://learn.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard