Azure AD DNS Filtering with WebTitan

Azure AD DNS Filtering: What is it and What are the Benefits?

Azure AD DNS filtering is the practice of applying DNS-based web filtering policies based on Azure Active Directory (AD) user identities and groups. By integrating DNS filtering with Azure AD, organizations can control which websites users can access regardless of device or location using the same identity and access structure already in place.

DNS filtering works by blocking or allowing domains at the DNS resolution stage. When a domain is on a blocklist, users cannot reach it; when a domain is on an allowlist, access is permitted. This prevents users from navigating to malicious or inappropriate sites, such as phishing pages or malware-infected domains. Azure DNS filtering extends this protection to Azure-hosted services, creating controlled and safe access zones in cloud environments.

A DNS filtering solution, especially one that can selectively adapt to zero-hour threats, provides major benefits to protect your organization from web-borne cyber-attacks:

Dynamically Block Inappropriate or Malicious Website Access

Malware-infected websites are used as bait to attract users and infect any devices connecting to the malicious domain IP address. Other sites may contain inappropriate material. Users are encouraged to open such sites using social engineering techniques. If a user navigates to a malicious site, malicious code takes advantage of vulnerabilities in poorly patched or configured browsers, infecting the device with malware.

It can be difficult for traditional antivirus or antispam solutions to prevent the impact of these sites as new variants pop up that are designed to evade detection by traditional security measures. One of the latest tactics is to use Azure apps as a vector for malware infection/credential theft. Hackers use realistic-looking, but malicious, Azure apps to encourage users to navigate to an attacker-controlled website to execute the full attack. The use of a DNS filter stops attacks such as this by cutting off the route to the malicious website. By using a DNS filter based on Azure AD membership, an enterprise can quickly and dynamically map an active directory user or role to stop access to established and new malicious websites.

Block Phishing Websites

In 2025, 3.4 billion phishing emails were sent every day across the globe. These attacks often lead users to visit a phishing website. Once the user enters that malicious site, login credentials, data, and/or access to corporate resources are at risk. AI-driven smart technology will ensure that even zero-hour threats are mitigated.

Stops Ransomware Infection and Data Theft

Ransomware is the malware of the moment. Ransomware is no longer about encrypting data and extorting money for a decryption key. Now, according to IBM X-Force, 59% of ransomware incidents also include data exfiltration, the stolen data then being used to put pressure on organizations to pay up. However, even if a ransom is paid there is no guarantee stolen data will not be sold on and used for fraud. Ransomware, often, infects a company through phishing emails and infected websites. The Verizon Data Breach Investigation Report (DBIR) says that in 85% of data breaches a human being is involved, usually by navigating to an infected website or clicking a link in a phishing email. Azure DNS filtering prevents Azure AD members from becoming part of the 85% of humans that help ransomware infections to propagate.

Protect Devices

Remote and homeworking have meant that personal devices are being used for work tasks. However, personal devices are much harder to protect as policies are more difficult to apply and manage remotely. By using an Azure AD DNS filter that uses device-based agents that are remotely managed, even personal devices can be protected from malicious software infections.

Simple to Setup and Use

Finally, any DNS filter needs to be easy to set up and must be configurable remotely for a cloud-based/remote workforce. Cloud environments are continuously changing, adding new apps and new endpoints, that require appropriate policies for different environments. DNS filters need to be easy to set up, configure, and modify. API-based content filters allow for remote configuration and monitoring. Mapping Azure AD to website access provides an easy way to create security policies on a per user/per role basis.

By applying the powerful control of Azure AD integrated DNS filtering to web access, an organization can improve its security posture and reduce web-related risk. A DNS filter offers an organization a way to improve the safe web browsing of its workforce, preventing data and credential theft, ransomware, and other cyber-attacks as well as inappropriate web use.

What is a DNS? And Where Does Microsoft Azure Fit?

A DNS (Domain Name System) underpins the internet by mapping a human-readable domain name to a machine-readable IP address (IP stands for Internet Protocol), e.g.,

https://wtc1.webtitancloud.com:8443

maps to

IP address: 52.32.39.15

When a user types a web address into a browser, a ‘DNS resolver’ matches this domain to an IP address using DNS servers. In other words, the DNS system resolves the address and maps it to the IP address. This IP address is used to make the connection between the device and the IP address before loading the content.

Things like a remote worker's mobile device also have an IP address. The billions of objects, people, and websites are all dependent on a functioning DNS to deliver content and data.

A DNS is highly distributed and does not rely on a single server. The domains in Azure are hosted on a global network of DNS name servers that are managed by the Azure cloud infrastructure. The whole system is configured to optimize speed and high availability for a given domain. Azure administrators use Azure DNS for services including website hosting, applications, APIs, and cloud service hosting, and DNS Zone management.

What is Azure DNS filtering?

Azure DNS filtering is the application of DNS-based web filtering controls within Azure environments to protect users and resources from accessing malicious or unauthorized domains. It works by blocking or allowing domain requests at the DNS resolution stage. When a domain is placed on a blocklist, users cannot reach it; when it’s on an allowlist, access is permitted.

This form of filtering helps prevent common internet-based threats such as phishing and malware by stopping connections before they are established. Azure DNS filtering can be applied to Azure-hosted services and virtual machines to create secure access zones and can also extend to specific devices, such as Chromebooks, through tailored filtering policies.

Azure Active Directory (AD) Based DNS filtering

Azure AD is a directory used to apply role-based access control. Azure DNS filtering uses policies that span an entire organization, applying and monitoring them based on AD group membership. WebTitan, for example, is deeply integrated with Azure AD, using an Azure AD Enterprise App to scan any Azure sign-in to find new users. These users are then paired with the IP of any Virtual Machine used to sign in, and security and access policies are applied as appropriate.