Intune and Web Filtering

[Mr_Jiminy]

For those of you who have gone full cloud using Intune... What method of web filtering have you elected to use?

 

We're in the process of reviewing web filtering, with consideration of moving away from an onsite appliance to a cloud web filter.

[Aprice]

Currently working on this with one of our customers, but we have elected to stay with on premises Smoothwall. Generally we've found the on premise solutions to just be much easier to work with and more comprehensive. Also allows us complete flexibility when it comes to the network config onsite. I'm not saying the cloud solutions aren't any good, we just prefer on prem.

[ITWil]

We are using Securly and Intune deploys the browser extension to Chrome & Edge on all devices. Students and staff are asked to login using their M365 account before accessing anything on the web.

[Mr_Jiminy]

We are using Securly and Intune deploys the browser extension to Chrome & Edge on all devices. Students and staff are asked to login using their M365 account before accessing anything on the web.

 

So no on-premise appliance whilst in school and fully in the cloud?

[localzuk]

One thing to take into account is that the guidance on "appropriate filtering for education settings" requires network level filtering in schools. Edited May 25, 2023 by localzuk

[psydii]

It pains me to say it, but Network level filtering is ultimately doomed until US/EU legislation prohibits chrome and "vpns". These days you need something on-device, deep-in-the-OS network packet/payload inspection.

 

As a "network manager" it has taken me far too long to come to accept that. Mind you, we have LGfL doing their thing at the network level, and that is good enough that I don't lose any sleep.

 

For on-device we have Defender though MS E5, which is robust enough to keep the worst at bay when devices are outside of LGfL. Looking into LGfL's on device offer this year to beef thing up ahead of a possible 1:1 programme.

[jnfarmer]

We're using Lightspeed, which has an agent on Windows/macOS/iOS devices which continues to work in and outside of the network. The also have on-prem appliances for BYOD and Guest. They're just about to release better reporting for web activity, including live logging, which I'm very happy aobut.

[kennysarmy]

We are using Securly and Intune deploys the browser extension to Chrome & Edge on all devices. Students and staff are asked to login using their M365 account before accessing anything on the web.

 

Are staff able to view YouTube videos?

 

Are staff able to embed YouTube videos in to PowerPoints and still have them unfiltered?

 

We cannot get this to work

[RumTechie]

I've inherited a school which has gone server-less, just using 365 tools which seem to just about do the job, but I really feel we need some perimeter protection. Broadband company doesn't offer in-line filtering, and it seems like pieces of tin won't authenticate to Azure, though someone told me that Fortinet boxes do?

 

My options seem to be an agent-based solution (Lightspeed / Securly) which ignores the "network level guidance," or a DC in Azure (or on-prem) for authentication.

 

Oh, and we have satellite sites which complicates things even more, so I'm really interested in what people have to say.

[localzuk]

Smoothwall has Azure AD based auth I believe. As does Sophos XG.

[RumTechie]

Sounds like I do actually have some options, and some research to do, thanks.

[Wave9_Lee]

Sounds like I do actually have some options, and some research to do, thanks.

 

Hi @RumTechie

 

On-prem firewall remains a sensible approach for lots of reasons - happy to have a chat about how we could help if you'd like - drop me a PM or book a meeting below to suit your diary,

 

regards

 

Lee

[Oaktech]

We are on-prem smoothwall with both On-Prem AD and Azure AD authentication and it's pretty good - the only thing I'd say is that the cloud filtering is really slow to update group membership, between 2 and 8 hours generally