Skip to content

Commit ca8b57a

Browse files
committed
Update indicator-ip-domain.md
1 parent 07efa21 commit ca8b57a

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

defender-endpoint/indicator-ip-domain.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,20 +152,20 @@ In the case where multiple different action types are set on the same indicator
152152

153153
### Defender for Cloud Apps Indicators
154154

155-
If your organization has enabled integration between Defender for Endpoint and Defender for Cloud Apps, block indicators will be created in Defender for Endpoint for all unsanctioned cloud applications. If an application is put in monitor mode, warn indicators (bypassable block) will be created for the URLs associated with the application. Allow indicators cannot be created for sanctioned applications at this time. Indicators created by Defender for Cloud Apps follow the same policy conflict handling described in the previous section.
155+
If your organization has enabled integration between Defender for Endpoint and Defender for Cloud Apps, block indicators are created in Defender for Endpoint for all unsanctioned cloud applications. If an application is put in monitor mode, warn indicators (bypassable block) are created for the URLs associated with the application. Allow indicators can't be created for sanctioned applications at this time. Indicators created by Defender for Cloud Apps follow the same policy conflict handling described in the previous section.
156156

157157
## Policy precedence
158158

159159
Microsoft Defender for Endpoint policy has precedence over Microsoft Defender Antivirus policy. In situations when Defender for Endpoint is set to `Allow`, but Microsoft Defender Antivirus is set to `Block`, the policy defaults to `Allow`.
160160

161161
### Precedence for multiple active policies
162162

163-
Applying multiple different web content filtering policies to the same device will result in the more restrictive policy applying for each category. Consider the following scenario:
163+
Applying multiple different web content filtering policies to the same device result in the more restrictive policy applying for each category. Consider the following scenario:
164164

165165
- **Policy 1** blocks categories 1 and 2 and audits the rest
166166
- **Policy 2** blocks categories 3 and 4 and audits the rest
167167

168-
The result is that categories 1-4 are all blocked. This is illustrated in the following image.
168+
The result is that categories 1-4 are all blocked. This scenario is illustrated in the following image.
169169

170170
:::image type="content" source="media/web-content-filtering-policies-mode-precedence.png" alt-text="Diagram that shows the precedence of web content filtering policy block mode over audit mode.":::
171171

0 commit comments

Comments
 (0)