Is web gateway technology used to monitor and filter malicious or suspicious URLs?
Web filtering inspects what DNS filtering only blocks by name, and it is where control over unsanctioned cloud services lives.
What the carrier is actually asking
The carrier is asking whether web traffic is inspected and filtered for malicious and suspicious destinations. It covers category blocking, malicious URL detection, and increasingly control over which cloud services users can reach.
Why it is underwritten
Web browsing delivers malware, hosts phishing pages, and provides the exfiltration route for data leaving through personal cloud storage. Filtering reduces all three, and the associated telemetry is useful during an investigation.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Web gateways are third-party or endpoint-delivered, so mostly attested. The Microsoft components are measurable.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Defender for Cloud Apps and its integration with endpoint tooling | Cloud application discovery and the ability to block unsanctioned services |
| Microsoft 365 | Network protection and web content filtering on endpoints | Endpoint-delivered filtering that follows the device off the corporate network |
| Microsoft 365 | Safe Links coverage for links in mail and documents | Time-of-click evaluation, which overlaps with web filtering for the mail-delivered case |
| Gateway vendor | Categories blocked and inspection configuration | Blocking of malicious and high-risk categories, with an exception path. Attested |
| Coverage | Whether filtering applies to remote devices | Endpoint-based or cloud-delivered filtering rather than an on-network appliance only |
The classic use of a web gateway was blocking categories of website. The valuable use now is discovering and controlling which cloud services hold your data, which is where unsanctioned file sharing and data exfiltration actually happen.
What a defensible yes requires
- Filtering covers malicious and high-risk categories and follows the device off-network.
- Unsanctioned cloud services are discovered and can be blocked.
- Filtering coexists with mail link protection rather than duplicating gaps.
- An exception path exists so blocks do not get lifted wholesale.
- Blocked events are logged and reviewed as intrusion indicators.
How this answer goes wrong
An appliance filters traffic on the corporate network for a workforce that mostly works elsewhere. Or filtering is deployed and inspection is disabled for most traffic because of certificate issues, leaving category blocking based on domain alone.
Frequently asked
Is this needed alongside DNS filtering?
They overlap and are not identical. DNS filtering is broader and coarser; web filtering inspects and can distinguish parts of a site. Most carriers accept either as a reasonable answer.
Does encrypted traffic limit this?
Without inspection, filtering falls back to domain-level decisions. Inspection has its own operational and privacy considerations, which is why many organisations rely more on endpoint and DNS layers.
What about remote workers?
Endpoint-delivered or cloud-delivered filtering is the only design that covers them. Appliance-based filtering does not.
Does this help with data loss?
Yes, by controlling uploads to unsanctioned services. It pairs directly with the data loss prevention answer.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture