---
title: "Is IP filtering used to prevent connections from known-malicious addresses?"
url: https://insuranceposture.com/questions/network-and-logging/ip-filtering-prevent-connections-from-known-malicious-addresses
category: "Network, logging and monitoring"
canonical_key: q_net_006
evidence_state: partial
updated: 2026-08-24
---

# Is IP filtering used to prevent connections from known-malicious addresses?

URL: https://insuranceposture.com/questions/network-and-logging/ip-filtering-prevent-connections-from-known-malicious-addresses
Section: Network, logging and monitoring
Evidence state: Partly verifiable from your tenant

Reputation blocking is cheap, automatic, and removes a large volume of low-effort traffic. It is not a control that stops a targeted attacker.

## What the carrier is actually asking

The carrier is asking whether connections to and from known-malicious addresses are blocked, usually through threat intelligence feeds applied at the firewall or the cloud edge.

## Why it is underwritten

Most inbound noise comes from known-bad infrastructure, and blocking it reduces both exposure and alert volume. On the outbound side, blocking known command and control addresses interrupts a specific stage of an intrusion. Carriers treat it as a baseline hygiene indicator.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Cloud-side filtering is measurable, and the on-premises equivalent is attested.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Azure | Azure Firewall threat intelligence mode | Set to alert and deny rather than alert only |
| Azure | Network security group rules and service tags | Restriction to expected sources rather than open ranges, which achieves more than reputation blocking alone |
| Azure | Web application firewall on public applications | Deployed in prevention mode with a current rule set |
| Azure | Storage and database firewall rules | Default deny with explicit allow, so data services are not reachable from arbitrary addresses |
| On-premises | Firewall threat feed subscription and geo-blocking rules | Feeds current and enforcing. Attested |

**Allow-listing beats block-listing**

Blocking known-bad addresses is endless. Restricting a service to the addresses that legitimately need it is finite and far more effective. Where an allow-list is possible, it answers this question better than any reputation feed.

## What a defensible yes requires

- Threat intelligence filtering is enabled in a blocking mode where available.
- Public services restrict source addresses where the audience is known.
- Outbound filtering blocks known command and control destinations.
- A web application firewall protects public applications in prevention mode.
- Data services deny by default rather than accepting connections from anywhere.

## How this answer goes wrong

Threat intelligence is enabled in alert-only mode, so malicious traffic is logged and permitted. Or the answer is yes on the strength of a feed while the storage account holding sensitive data accepts connections from any address on the internet.

## If this answer turns out to be wrong

Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Is geo-blocking useful?

It reduces noise when you have no legitimate traffic from a region, and it is trivially bypassed by an attacker using local infrastructure. Useful as noise reduction, not as a control.

### Does this stop targeted attacks?

Rarely. Targeted attackers use fresh infrastructure that no feed knows about. It removes volume, which makes the remaining signal easier to see.

### What about outbound?

The more valuable direction, and the one most often unfiltered. Blocking known command and control destinations interrupts an intrusion mid-sequence.

### Do we need a paid feed?

Cloud platform threat intelligence is included and adequate for this question. Paid feeds matter more for a mature detection function.

## Related questions

- [Are protective DNS or DNS filtering services in use?](https://insuranceposture.com/questions/network-and-logging/protective-dns-dns-filtering-services)
- [Is web gateway technology used to monitor and filter malicious or suspicious URLs?](https://insuranceposture.com/questions/network-and-logging/web-gateway-technology-monitor-filter-malicious-suspicious-urls)
- [Does the Applicant employ external/perimeter and internal firewalls?](https://insuranceposture.com/questions/network-and-logging/applicant-employ-external-perimeter-internal-firewalls)
- [Is inbound and outbound traffic to critical servers restricted using an allow-list approach?](https://insuranceposture.com/questions/network-and-logging/inbound-outbound-traffic-critical-servers-restricted-using-allow-list)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.