Windows Defender Antivirus network isolation protection rules blocking legitimate internal cloud application routing pipelines

Network protection in block mode is enforcing reputation-based blocking on outbound HTTP(S) connections, so the internal logistics portal (or its endpoints) is being treated as an untrusted or malicious destination. To restore access while keeping protection, use a combination of verification, audit, and targeted exclusions.

1. Confirm prerequisites and mode Ensure the environment meets the supported conditions so behavior is expected and consistent:
   • Windows 10 Pro/Enterprise, version 1709 or higher.
   • Microsoft Defender Antivirus is the sole, active antivirus.
   • Real-time protection, Behavior Monitoring, and Cloud-delivered protection are enabled.
   • Cloud Protection network connectivity is functional.
   • Network protection is indeed in block mode (not audit).
   These prerequisites are described under “Confirm prerequisites” for network protection.
2. Temporarily switch to audit mode to validate impact To understand exactly what network protection would block without actually breaking access, switch affected test devices to audit mode and reproduce the issue:

      Set-MpPreference -EnableNetworkProtection AuditMode
   

   Then:
   1. Use the logistics portal from a test device.
   2. Review network protection events in Event Viewer:
      • Log: Microsoft-Windows-Windows Defender/Operational
      • Event IDs:
        • 1125 – network connection audited
        • 1126 – network connection blocked
   3. Confirm which domains/hosts or IPs for the logistics portal are being flagged.
   If the portal works in audit mode and events show it would be blocked in block mode, network protection is the cause.
3. Add targeted exclusions for the internal application Once the specific endpoints are identified, use the supported exclusion mechanisms to allow only the required traffic rather than disabling protection globally: Available options:
   • Custom allow indicator for the domain/hostname (recommended for Defender for Endpoint-managed environments).
   • IP exclusions for specific internal IPs:

          Add-MpPreference -ExclusionIpAddress 10.0.0.10
     

   • Process exclusion if a dedicated client process is used to connect to the logistics portal.
   These options are listed under “Add exclusions” for network protection. Use the narrowest possible scope (specific IPs or domains) to avoid weakening protection.
4. Return to block mode after validation After confirming that the exclusions correctly allow the logistics portal while other malicious destinations remain blocked, re-enable block mode on the pilot devices, then roll out broadly:

      Set-MpPreference -EnableNetworkProtection Enabled
   

5. If the portal is still flagged as malicious If the internal cloud-hosted portal uses public domains or infrastructure that Defender intelligence is classifying as malicious or suspicious, and the behavior persists even after exclusions are tuned, submit it as a potential false positive:
   • Use the Windows Defender Security Intelligence web-based submission form to report a false positive for network protection.
   • If licensed with E5, include a link to any associated alert from the Microsoft Defender portal.
   This workflow is described under “Report a false positive or false negative”.
6. Operational monitoring and tuning
   • Continue to monitor Event IDs 1125 and 1126 to ensure only intended endpoints are being allowed.
   • Use audit mode on a small subset of devices when introducing new internal services to see how network protection would treat them before enforcing block mode globally.

This approach preserves the security benefits of network protection while restoring and maintaining connectivity to the internal logistics portal through precise exclusions and, where appropriate, false-positive reporting.

References:

• Troubleshoot network protection
• Evaluate network protection
• Use network protection to help prevent connections to malicious or suspicious sites