A client rings up. Staff are burning half the day on betting sites, or someone clicked something they shouldn’t have, and now they want you to “lock down the web.”
So you go and price a web filter. Cisco Umbrella, DNSFilter, a firewall add-on. Another line item, another agent, another renewal to babysit.
Stop.
If that client is on Microsoft 365 Business Premium, you already sold them a web filter. It’s been sitting inside Defender, switched off, the whole time.
That’s not an upsell. That’s a setting.
What is web content filtering, really?
It watches where your devices go on the web and lets you block whole categories of sites by name. Gambling. Adult content. Peer-to-peer. Hacking. You tick a category, and people in the groups you choose stop being able to reach it, whether they’re in the office or working from a café.
Microsoft calls it web content filtering, and it rides on protection that’s already on the machine. In Edge, the blocks are enforced by SmartScreen. In Chrome, Firefox, Brave and Opera, they lean on network protection. Both of those have to be switched on, or nothing happens.
Here’s the part most people miss. Any category you don’t block gets audited automatically. So before you stop a single site, you get a report of exactly where your client’s staff have been going.
You can’t filter what you can’t see. So start by seeing.
Step-by-Step: turn it on, then point it at something
Switch on the feature
In the Microsoft Defender portal, go to Settings > Endpoints > Advanced features and flip Web content filtering to On. Save.
Create a policy and just watch
Go to Settings > Endpoints > Rules > Web content filtering and add a policy. Target a device group. Don’t block your client’s contentious categories yet. Let the audit data build.
Read the report
Open Reports > Web protection and look at the Web activity by category card. Give it time, there’s up to a 12-hour lag before activity shows up. This is the bit that changes the conversation. You’re no longer guessing what staff do online. You’re looking at it.
Block what actually matters
Now edit the policy and tick the categories the report told you to care about.
Microsoft Defender portal → Settings → Endpoints
Advanced features → Web content filtering = On
Rules → Web content filtering → + Add policy
Reports → Web protection → Web activity by category
Notice what’s missing? No PowerShell. No third agent. No new licence. Every step lives in a portal your client is already paying for.
Why this actually changes behaviour
Because you walk into the renewal with evidence, not a hunch.
“Here are 4,000 hits to gambling sites last month, off three machines.” That’s a discussion the business owner can act on. A quote for Umbrella is just a number they’ll push back on.
“But we already quoted them a web filter.” Fine. Now you can show them what they’d be paying for, and that they already own it.
A few things will bite you if you’re not watching for them:
- Edge uses SmartScreen, everything else uses network protection. If network protection is in audit mode or off, your blocks are theatre. Lovely report, no enforcement.
- Non-Microsoft browsers won’t honour HTTPS category blocks unless QUIC and Encrypted Client Hello are disabled. Leave them on and Chrome quietly routes around you.
- Expect lag. Up to 12 hours before activity lands in the report, up to two hours before a block bites. Don’t test it in the first five minutes and declare it broken.
And when you genuinely need an exception, you don’t loosen the whole category. You carve out one site with a custom indicator, which sits above the filter in the order of precedence. Allow always wins over block. That’s your release valve when the boss insists on one specific site.
Run the audit, read the Web protection report, then block with proof in hand.
Web content filtering isn’t there to add a product to your stack. It’s there to delete one.
If you’re billing a client for a separate web filter on top of Business Premium, you’re charging them for something they already own. Show them the report instead.
That’s not filtering. That’s value you can prove.