In part 2 of the series, I will be taking a closer look at Windows Defender Application Guard (WDAG), specifically for Edge. Not to confused with Windows Defender Application Control (WDAC). Essentially WDAG runs application in a virtualized environment on your Windows 10 device. This way the operating system is protected from any applications that try to interfere with the system.
For Edge, WDAG helps to isolate untrusted websites. By isolating browsers users can safely browse the web without having to worry that they accidently end up on a site that they are not supposed to be on. This isolation happens within a Hyper-V-enabled container. This container is separate from the host operating system. Meaning that if a website turns out to be malicious the host device is protected, and the attacker cannot get the data.
Today this article is about Edge, more specifically the new Chromium version, but these same settings also work for the older Edge and even Internet Explorer. This level of isolation is also available for Microsoft Office, but this will not be covered today.
Other articles in the series:
- Windows Defender Application Control
- Windows Defender Application Guard
- Windows Defender Credential Guard
- Windows Defender Device Guard
Prerequisites
- A physical test client (64-bit, Virtualization options, minimum of 8GB), joined and enrolled in Endpoint Manager
- Windows 10 Enterprise currently supported version
- Microsoft subscription with Endpoint Manager
Enable Windows Defender Application Guard
To enable WDAG go to endpoint.microsoft.com, select Devices > Configuration Profiles > New Profile and select Windows 10 and later. For profile select Endpoint Protection.
Fill out the basic information and continue to the next step. Select Microsoft Defender Application Guard to reveal the options. I have applied the following settings, tailor them to your need if needed. In the link you can find the explication of all these settings. If you want to provide a nice experience for your users make sure to enable retain user generated browser data. This way cookies and preferences are saved. Finally apply the policy to a group.
Network boundaries
The next question is how to control what sites are blocked and what site are considered as trusted. The documentation of Microsoft is not particularly clear on this point, but is hidden way in one of the lines of text. Within Endpoint manager you have the options to create a Configuration Profile specifically for network boundaries.
To create a profile go to Devices > Configuration Profiles > New Profile and select Windows 10 and later. For profile select Network boundary. Depending on what you want to whitelist there are special rules and formats you need to apply by. Also take into account if you want to use wildcards or specific domains. See the explication of Microsoft how to whitelist certain domains. See the explination on how to whitelist domains:
| Value | Numbers of dots to the left | Meaning |
| contoso.com | 0 | Trust only the literal value of contoso.com. |
| www.contoso.com | 0 | Trust only the literal value of www.contoso.com. |
| .contoso.com | 1 | Trust any domain that ends with the text contoso.com. Matching sites include spearphishingcontoso.com, contoso.com, and www.contoso.com. |
| ..contoso.com | 2 | Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include shop.contoso.com, us.shop.contoso.com, www.us.shop.contoso.com, but NOT contoso.com itself. |
Here are some boundaries that I have added for this article. Most of the resources are Microsoft cloud services, but of course I also added my own website as a safe website.
| Network boundary | |
| Cloud Resources | portal.office.com|tasks.office.com|protection.office.com|meet.lync.com|teams.microsoft.com |
| Cloud Resources | outlook.office.com|outlook.office365.com|portal.office.com |
| Cloud Resources | /*AppCompat*/ |
| Cloud Resources | contoso.sharepoint.com| contoso-my.sharepoint.com| contoso-files.sharepoint.com |
| Neutral Resources | login.windows.net,login.microsoftonline.com |
| Neutral Resources | .stephanvdkruis.com,.microsoft.com |
Final result:
So now you configured WDAG, but what is happening on the background? By enabling WDAG the Windows Defender Application Guard feature is installed on the client. This installation requires a restart so the next time a user turns off its device the feature will be installed. After the feature is live users can start their browser and at first nothing is different then what they are used to. If they immediately start their browser, they might see an initialization popup meaning that the container is being provisioned.
They can go to any trusted site or cloud resources that have been defined as trusted in the boundary policy. However as soon as they try to go to an untrusted website a secure isolated browser is started. See the example below when we browse to google.com.
