Is IP filtering used to prevent connections from known-malicious addresses?
Reputation blocking is cheap, automatic, and removes a large volume of low-effort traffic. It is not a control that stops a targeted attacker.
What the carrier is actually asking
The carrier is asking whether connections to and from known-malicious addresses are blocked, usually through threat intelligence feeds applied at the firewall or the cloud edge.
Why it is underwritten
Most inbound noise comes from known-bad infrastructure, and blocking it reduces both exposure and alert volume. On the outbound side, blocking known command and control addresses interrupts a specific stage of an intrusion. Carriers treat it as a baseline hygiene indicator.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Cloud-side filtering is measurable, and the on-premises equivalent is attested.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Azure Firewall threat intelligence mode | Set to alert and deny rather than alert only |
| Azure | Network security group rules and service tags | Restriction to expected sources rather than open ranges, which achieves more than reputation blocking alone |
| Azure | Web application firewall on public applications | Deployed in prevention mode with a current rule set |
| Azure | Storage and database firewall rules | Default deny with explicit allow, so data services are not reachable from arbitrary addresses |
| On-premises | Firewall threat feed subscription and geo-blocking rules | Feeds current and enforcing. Attested |
Blocking known-bad addresses is endless. Restricting a service to the addresses that legitimately need it is finite and far more effective. Where an allow-list is possible, it answers this question better than any reputation feed.
What a defensible yes requires
- Threat intelligence filtering is enabled in a blocking mode where available.
- Public services restrict source addresses where the audience is known.
- Outbound filtering blocks known command and control destinations.
- A web application firewall protects public applications in prevention mode.
- Data services deny by default rather than accepting connections from anywhere.
How this answer goes wrong
Threat intelligence is enabled in alert-only mode, so malicious traffic is logged and permitted. Or the answer is yes on the strength of a feed while the storage account holding sensitive data accepts connections from any address on the internet.
Frequently asked
Is geo-blocking useful?
It reduces noise when you have no legitimate traffic from a region, and it is trivially bypassed by an attacker using local infrastructure. Useful as noise reduction, not as a control.
Does this stop targeted attacks?
Rarely. Targeted attackers use fresh infrastructure that no feed knows about. It removes volume, which makes the remaining signal easier to see.
What about outbound?
The more valuable direction, and the one most often unfiltered. Blocking known command and control destinations interrupts an intrusion mid-sequence.
Do we need a paid feed?
Cloud platform threat intelligence is included and adequate for this question. Paid feeds matter more for a mature detection function.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture