STEP 2: Configure your devices to connect to the Defender for Endpoint service using a proxy
Applies to:
- Microsoft Defender for Endpoint Plan 1
- Microsoft Defender for Endpoint Plan 2
- Microsoft Defender XDR
Want to experience Defender for Endpoint? Sign up for a free trial.
Important
Devices that are configured for IPv6-only traffic are not supported.
The Defender for Endpoint sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Defender for Endpoint service. The embedded Defender for Endpoint sensor runs in system context using the LocalSystem account.
Tip
For organizations that use forward proxies as a gateway to the Internet, you can use network protection to investigate connection events that occur behind forward proxies.
The WinHTTP configuration setting is independent of the Windows Internet (WinINet) browsing proxy settings (see, WinINet vs. WinHTTP). It can only discover a proxy server by using the following discovery methods:
Autodiscovery methods:
Transparent proxy
Web Proxy Auto-discovery Protocol (WPAD)
Note
If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings.
Manual static proxy configuration:
Registry-based configuration
WinHTTP configured using netsh command: Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy)
Note
Defender antivirus and EDR proxies can be set independently. In the sections that follow, be aware of those distinctions.
Configure the proxy server manually using a registry-based static proxy
Configure a registry-based static proxy for Defender for Endpoint detection and response (EDR) sensor to report diagnostic data and communicate with Defender for Endpoint services if a computer isn't permitted to connect to the Internet.
Note
When using this option on Windows 10, or Windows 11, or Windows Server 2019, or Windows Server 2022, it is recommended to have the following (or later) build and cumulative update rollup:
- Windows 11
- Windows 10, version 1809 or Windows Server 2019, or Windows Server 2022 - https://support.microsoft.com/kb/5001384
- Windows 10, version 1909 - https://support.microsoft.com/kb/4601380
- Windows 10, version 2004 - https://support.microsoft.com/kb/4601382
- Windows 10, version 20H2 - https://support.microsoft.com/kb/4601382
These updates improve the connectivity and reliability of the CnC (Command and Control) channel.
The static proxy is configurable through group policy (GP), both the settings under group policy values should be configured to the proxy server for using EDR. The group policy is available in Administrative Templates.
Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service.
Set it to Enabled and select Disable Authenticated Proxy usage.
Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry:
Configure the proxy.
Group Policy | Registry key | Registry entry | Value |
---|---|---|---|
Configure authenticated proxy usage for the connected user experience and the telemetry service | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
DisableEnterpriseAuthProxy |
1 (REG_DWORD) |
Configure connected user experiences and telemetry | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
TelemetryProxyServer |
servername:port or ip:port For example: 10.0.0.6:8080 (REG_SZ) |
Note
If you are using 'TelemetryProxyServer' setting on devices that are otherwise completely offline, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is required to add the additional registry setting PreferStaticProxyForHttpRequest
with a value of 1
.
Parent registry path location for "PreferStaticProxyForHttpRequest" is "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection"
The following command can be used to insert the registry value in the correct location:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /v PreferStaticProxyForHttpRequest /t REG_DWORD /d 1 /f
The above registry value is applicable only starting with MsSense.exe version 10.8210.* and later, or version 10.8049.* and later.
Configure a static proxy for Microsoft Defender Antivirus
Microsoft Defender Antivirus cloud-delivered protection provides near-instant, automated protection against new and emerging threats. Note, the connectivity is required for custom indicators when Defender Antivirus is your active anti-malware solution. For EDR in block mode has primary anti-malware solution when using a non-Microsoft solution.
Configure the static proxy using the Group Policy available in Administrative Templates:
Administrative Templates > Windows Components > Microsoft Defender Antivirus > Define proxy server for connecting to the network.
Set it to Enabled and define the proxy server. Note, the URL must have either http:// or https://. For supported versions for https://, see Manage Microsoft Defender Antivirus updates.
Under the registry key
HKLM\Software\Policies\Microsoft\Windows Defender
, the policy sets the registry valueProxyServer
as REG_SZ.The registry value
ProxyServer
takes the following string format:<server name or ip>:<port>
For example: http://10.0.0.6:8080
Note
If you are using static proxy setting on devices that are otherwise completely offline, meaning the operating system is unable to connect for the online certificate revocation list or Windows Update, then it is required to add the additional registry setting SSLOptions with a dword value of 0. Parent registry path location for "SSLOptions" is "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"
For resiliency purposes and the real-time nature of cloud-delivered protection, Microsoft Defender Antivirus will cache the last known working proxy. Ensure your proxy solution does not perform SSL inspection. This will break the secure cloud connection.
Microsoft Defender Antivirus will not use the static proxy to connect to Windows Update or Microsoft Update for downloading updates. Instead, it will use a system-wide proxy if configured to use Windows Update, or the configured internal update source according to the configured fallback order.
If required, you can use Administrative Templates > Windows Components > Microsoft Defender Antivirus > Define proxy auto-config (.pac) for connecting to the network. If you need to set up advanced configurations with multiple proxies, use Administrative Templates > Windows Components > Microsoft Defender Antivirus > Define addresses to bypass proxy server and prevent Microsoft Defender Antivirus from using a proxy server for those destinations.
You can use PowerShell with the Set-MpPreference
cmdlet to configure these options:
- ProxyBypass
- ProxyPacUrl
- ProxyServer
Note
To use the proxy correctly, configure these three different proxy settings:
- Microsoft Defender for Endpoint (MDE)
- AV (Antivirus)
- Endpoint Detection and Response (EDR)
Configure the proxy server manually using netsh command
Use netsh to configure a system-wide static proxy.
Note
- This will affect all applications including Windows services which use WinHTTP with default proxy.
Open an elevated command line:
- Go to Start and type cmd.
- Right-click Command prompt and select Run as administrator.
Enter the following command and press Enter:
netsh winhttp set proxy <proxy>:<port>
For example:
netsh winhttp set proxy 10.0.0.6:8080
To reset the winhttp proxy, enter the following command and press Enter:
netsh winhttp reset proxy
See Netsh Command Syntax, Contexts, and Formatting to learn more.
Next step
STEP 3: Verify client connectivity to Microsoft Defender for Endpoint service URLs
Related articles
- Disconnected environments, proxies and Microsoft Defender for Endpoint
- Use Group Policy settings to configure and manage Microsoft Defender Antivirus
- Onboard Windows devices
- Troubleshoot Microsoft Defender for Endpoint onboarding issues
- Onboard devices without Internet access to Microsoft Defender for Endpoint
Tip
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.
Feedback
Submit and view feedback for