Edit

STEP 2: Configure your devices to connect to the Defender for Endpoint service using a proxy

  • Article

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

Important

Devices that are configured for IPv6-only traffic are not supported.

The Defender for Endpoint sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Defender for Endpoint service. The embedded Defender for Endpoint sensor runs in system context using the LocalSystem account.

Tip

For organizations that use forward proxies as a gateway to the Internet, you can use network protection to investigate connection events that occur behind forward proxies.

The WinHTTP configuration setting is independent of the Windows Internet (WinINet) browsing proxy settings (see, WinINet vs. WinHTTP). It can only discover a proxy server by using the following discovery methods:

  • Autodiscovery methods:

    • Transparent proxy

    • Web Proxy Auto-discovery Protocol (WPAD)

      Note

      If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings.

  • Manual static proxy configuration:

    • Registry-based configuration

    • WinHTTP configured using netsh command: Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy)

Note

Defender antivirus and EDR proxies can be set independently. In the sections that follow, be aware of those distinctions.

Configure the proxy server manually using a registry-based static proxy

Configure a registry-based static proxy for Defender for Endpoint detection and response (EDR) sensor to report diagnostic data and communicate with Defender for Endpoint services if a computer isn't permitted to connect to the Internet.

Note

When using this option on Windows 10, or Windows 11, or Windows Server 2019, or Windows Server 2022, it is recommended to have the following (or later) build and cumulative update rollup:

These updates improve the connectivity and reliability of the CnC (Command and Control) channel.

The static proxy is configurable through group policy (GP), both the settings under group policy values should be configured to the proxy server for using EDR. The group policy is available in Administrative Templates.

  • Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service.

    Set it to Enabled and select Disable Authenticated Proxy usage.

    The Group Policy setting1 status pane

  • Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry:

    Configure the proxy.

    The Group Policy setting2 status pane

Group Policy Registry key Registry entry Value
Configure authenticated proxy usage for the connected user experience and the telemetry service HKLM\Software\Policies\Microsoft\Windows\DataCollection DisableEnterpriseAuthProxy 1 (REG_DWORD)
Configure connected user experiences and telemetry HKLM\Software\Policies\Microsoft\Windows\DataCollection TelemetryProxyServer servername:port or ip:port

For example: 10.0.0.6:8080 (REG_SZ)

Note

If you are using 'TelemetryProxyServer' setting on devices that are otherwise completely offline, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is required to add the additional registry setting PreferStaticProxyForHttpRequest with a value of 1.

Parent registry path location for "PreferStaticProxyForHttpRequest" is "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection"

The following command can be used to insert the registry value in the correct location:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v PreferStaticProxyForHttpRequest /t REG_DWORD /d 1 /f

The above registry value is applicable only starting with MsSense.exe version 10.8210.* and later, or version 10.8049.* and later.

Configure a static proxy for Microsoft Defender Antivirus

Microsoft Defender Antivirus cloud-delivered protection provides near-instant, automated protection against new and emerging threats. Note, the connectivity is required for custom indicators when Defender Antivirus is your active anti-malware solution. For EDR in block mode has primary anti-malware solution when using a non-Microsoft solution.

Configure the static proxy using the Group Policy available in Administrative Templates:

  1. Administrative Templates > Windows Components > Microsoft Defender Antivirus > Define proxy server for connecting to the network.

  2. Set it to Enabled and define the proxy server. Note, the URL must have either http:// or https://. For supported versions for https://, see Manage Microsoft Defender Antivirus updates.

    The proxy server for Microsoft Defender Antivirus

  3. Under the registry key HKLM\Software\Policies\Microsoft\Windows Defender, the policy sets the registry value ProxyServer as REG_SZ.

    The registry value ProxyServer takes the following string format:

    <server name or ip>:<port>

    For example: http://10.0.0.6:8080

Note

If you are using static proxy setting on devices that are otherwise completely offline, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is required to add the additional registry setting SSLOptions with a dword value of 0. Parent registry path location for "SSLOptions" is "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"
For resiliency purposes and the real-time nature of cloud-delivered protection, Microsoft Defender Antivirus will cache the last known working proxy. Ensure your proxy solution does not perform SSL inspection. This will break the secure cloud connection.

Microsoft Defender Antivirus will not use the static proxy to connect to Windows Update or Microsoft Update for downloading updates. Instead, it will use a system-wide proxy if configured to use Windows Update, or the configured internal update source according to the configured fallback order.

If required, you can use Administrative Templates > Windows Components > Microsoft Defender Antivirus > Define proxy auto-config (.pac) for connecting to the network. If you need to set up advanced configurations with multiple proxies, use Administrative Templates > Windows Components > Microsoft Defender Antivirus > Define addresses to bypass proxy server and prevent Microsoft Defender Antivirus from using a proxy server for those destinations.

You can use PowerShell with the Set-MpPreference cmdlet to configure these options:

  • ProxyBypass
  • ProxyPacUrl
  • ProxyServer

Note

To use the proxy correctly, configure these three different proxy settings:

  • Microsoft Defender for Endpoint (MDE)
  • AV (Antivirus)
  • Endpoint Detection and Response (EDR)

Configure the proxy server manually using netsh command

Use netsh to configure a system-wide static proxy.

Note

  • This will affect all applications including Windows services which use WinHTTP with default proxy.

  1. Open an elevated command line:

    1. Go to Start and type cmd.
    2. Right-click Command prompt and select Run as administrator.

  2. Enter the following command and press Enter:

    netsh winhttp set proxy <proxy>:<port>

    For example: netsh winhttp set proxy 10.0.0.6:8080

To reset the winhttp proxy, enter the following command and press Enter:

netsh winhttp reset proxy

See Netsh Command Syntax, Contexts, and Formatting to learn more.

Next step

STEP 3: Verify client connectivity to Microsoft Defender for Endpoint service URLs

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.