How to Configure URL Filtering

Overview:

Why blocking a site by domain alone doesn't scale

A single blocked domain is easy to manage. A real policy, block social media during work hours on some machines, cap streaming data usage on others, allow a specific list of learning sites while blocking distracting ones, is not one rule but a small system of rules that has to stay coherent as it grows. Managing that by editing a flat blocklist by hand gets unmanageable fast, and it gives you no way to express "blocked, except during lunch" or "allowed, but capped at 2GB a day."

URL Filtering separates this into two layers: a URL Category groups the actual domains (what to block, what to allow, and where to redirect a blocked request), and a URL Filter Profile defines the policy logic on top of that category, time-based (block this category during these hours, on these days) or usage-based (allow this category up to a data cap). The profile is then deployed to specific endpoints independently of the category or the rule logic underneath it.

This guide walks the full workflow end to end: building a URL category with block/allow lists and a redirect URL, creating a time-based filter profile with a schedule, creating a usage-based filter profile with a data cap, deploying a profile to endpoints, monitoring the deployment and its per-endpoint task status, and removing a filter cleanly when it's no longer needed.

• Separate the domain list from the policy logic: a category can be reused across multiple profiles with different schedules or caps.
• Enforce by time, not just by presence: a Time Based profile blocks a category only during the days and hours you specify.
• Enforce by data, not just by category: a Usage Based profile allows a category up to a defined data limit before it's restricted.
• Redirect instead of dead-ending: a blocked request can land on a defined redirect URL rather than a generic browser error.
• Deploy and remove independently: applying and removing a filter profile are both tracked deployments, not silent edits to a shared list.

Prerequisites

Confirm all four before creating a category. A profile built on a category with no block list, or deployed to the wrong scope, produces a filter that looks configured but doesn't actually restrict anything.

1. Administrator access: your account holds a role permitted to manage URL Filtering. Read-only operators can view deployment status but cannot create categories, profiles, or deployments.
2. Agent installed and reporting: the endpoint agent is installed, registered, and reporting healthy on every target device.
3. Domain lists prepared: know the exact domains for the block list, allow list, and (if needed) a redirect destination before starting. Lists can be typed directly or pasted from a prepared text file.
4. Policy intent decided: know whether this filter should be time-based (a schedule) or usage-based (a data cap) before creating the profile, since that choice determines which fields you'll configure.

Architecture: how a category and a profile combine into an enforced filter

A category defines the domains. A profile defines the enforcement logic against that category, either a time schedule or a data limit. A deployment binds the profile to endpoints and triggers enforcement.

Step 1: Open URL Filtering

Get oriented before creating anything, so you know where categories, profiles, and deployments each live.

Instructions

1. From the main console, go to Endpoints → URL Filtering.
2. Note the sections available: URL Categories, URL Filter Profiles, and Deployments.

Path: Console / Endpoints / URL Filtering

Result: You're in the URL Filtering module with visibility into any existing categories and profiles before creating new ones.

Step 2: Create a URL category

Define the actual domain lists this filter will act on: what to block, what to allow, and where a blocked request should land.

Instructions

1. Go to URL Categories → Create URL Category.
2. Enter a Category Name describing its theme, e.g. Study Timing.
3. Under Block List, enter the domains to block, one per line, e.g. www.facebook.com, www.instagram.com, www.snapchat.com. Domains can be typed directly or pasted from a prepared list.
4. Under Allow List, enter the domains to explicitly permit, e.g. www.coursera.org, www.udemy.com, www.khanacademy.org, www.shiksha.com.
5. Optionally set a Redirect URL so a blocked request lands on a defined page instead of a generic error, e.g. https://example.com.
6. Save the category.

Path: Console / URL Filtering / URL Categories / Create URL Category

Console: category definition

Result: A reusable category exists with its domain lists defined. It has no enforcement schedule or scope yet, that's set in the profile and deployment steps.

Step 3: Create a Time Based URL filter profile

Define a schedule-driven policy: block a category only during specific days and hours.

Instructions

1. Go to URL Filter Profiles → Create URL Filter Profile.
2. Enter a Profile Name, e.g. Block Social Media.
3. Set Profile Type to Time Based.
4. Add a Description, e.g. Block Social Media.
5. Under Rule 1, set URL Category to the category created in Step 2, e.g. Study Timing.
6. Set Schedule Days using the day toggles, or the Weekdays, Weekend, or Everyday shortcuts.
7. Set Start Time and End Time for the block window.
8. Select Add Rule if this profile needs more than one category/schedule combination.
9. Save the profile.

Path: Console / URL Filtering / URL Filter Profiles / Create URL Filter Profile

Console: Time Based profile

Result: A profile exists that enforces the category's Block List only within the configured schedule, outside of which the category is not actively restricted by this profile.

Step 4: Create a Usage Based URL filter profile

Define a data-driven policy instead of a schedule: allow a category up to a defined data limit.

Instructions

1. Go to URL Filter Profiles → Create URL Filter Profile.
2. Enter a Profile Name and an optional Description.
3. Set Profile Type to Usage Based.
4. Under Rule 1, set URL Category to the target category.
5. Set Data Limit to the numeric cap and Data Unit (e.g. GB).
6. Save the profile.

Path: Console / URL Filtering / URL Filter Profiles / Create URL Filter Profile

Console: Usage Based profile fields

Result: A profile exists that restricts the category's traffic once the configured data limit is reached, independent of any time schedule.

Step 5: Deploy the filter profile to endpoints

Bind the profile to specific endpoints with a deployment of type Apply.

Instructions

1. Go to Deployments → Create URL Filter Profile Deployment.
2. Enter a Deployment Name, e.g. Block URL.
3. Add an optional Description.
4. Set Scope Endpoints to Specific Endpoints and select the target device(s).
5. Set Deployment Type to Apply.
6. Set Select URL Filter Profiles to the profile from Step 3 or 4, e.g. Block Social Media.
7. Set Deployment Policy, e.g. OOB Instant deployment policy (type Instant).
8. Optionally set Notify to for completion alerts.
9. Select Publish.

Path: Console / URL Filtering / Deployments / Create URL Filter Profile Deployment

Console: deployment definition

Result: A task is created (e.g. ADR-064: Block URL) and appears in the task list with an initial status such as Ready to Deploy before moving to Initiated.

Step 6: Monitor the filter deployment

Track the deployment from initiation through completion, endpoint by endpoint.

Instructions

1. Go to Deployments to see all deployments with their Type (Apply, Remove), Stage (Initiated, Completed), Progress, and Policy.
2. Open the specific deployment task, e.g. ADR-064: Block URL, to see its per-endpoint Status and Last Updated time.
3. Watch the status progress, e.g. from Ready to Deploy to Initiated to a completed state, confirming the profile actually reached and applied on the target endpoint.

Path: Console / URL Filtering / Deployments

Console: task status (example)

Result: Confirmation that the deployment is progressing and, once complete, that the profile is enforced on the target endpoint.

Step 7: Remove a URL filter deployment

Reverse a filter cleanly through a Remove-type deployment rather than editing the underlying category or profile.

Instructions

1. Go to Deployments → Create URL Filter Profile Deployment.
2. Enter a Deployment Name for the removal, e.g. Remove Blocked URL.
3. Set Scope Endpoints to the same or a different target set.
4. Set Deployment Type to Remove.
5. Set Select URL Filter Profiles to the profile being removed.
6. Select Publish.

Path: Console / URL Filtering / Deployments / Create URL Filter Profile Deployment

Result: A Remove-type task runs and, once Completed, the filter profile is no longer enforced on the target endpoint.

Step 8: Confirm the deployment list reflects current state

Review the full deployments list to see every Apply and Remove action together, rather than tracking each one individually.

Instructions

1. Go to Deployments and review the full list: Deployment, Type (Apply/Remove), Stage, Progress, and Policy.
2. Confirm the most recent action for any given profile and endpoint pair reflects the enforcement state you expect, since Apply and Remove deployments for the same profile can both appear in the same list over time.
3. Use this list as your source of truth for what's currently enforced, rather than relying on memory of which deployments were run in what order.

Path: Console / URL Filtering / Deployments

Result: A single, chronological view of every filter deployment, Apply and Remove alike, across every profile and endpoint.

Step 9: Review categories and profiles before scaling up

Before deploying broadly, revisit the categories and profiles you've built to confirm they still reflect intent as the list grows.

Instructions

1. Return to URL Categories and confirm each category's Block List, Allow List, and Redirect URL are still accurate.
2. Return to URL Filter Profiles and confirm each profile's rules reference the correct category and the intended schedule or data limit.
3. Check for categories created for a one-off test that are still referenced by an active profile, or profiles that reference a category no longer maintained.

Path: Console / URL Filtering / URL Categories and Console / URL Filtering / URL Filter Profiles

Result: A clean, current set of categories and profiles, rather than an accumulation of one-off configurations from earlier testing.

Step 10: Combine categories and profiles for layered policies

Use multiple rules within one profile, or multiple profiles against the same category, to express more complex intent than a single block list can.

Instructions

1. Within a profile, select Add Rule to add a second URL Category with its own schedule or data limit, building a profile that covers more than one theme at once.
2. Alternatively, create a second profile against the same category with a different Profile Type or schedule, e.g. one Time Based profile for work hours and a separate Usage Based profile for weekend data capping.
3. Deploy each profile independently via its own deployment, so you can apply, adjust, or remove one layer without affecting the other.

Path: Console / URL Filtering / URL Filter Profiles / Create URL Filter Profile / Add Rule

Result: A layered filtering policy built from reusable, independently deployable pieces, rather than one large, hard-to-modify rule.

Best practices for URL filtering

Troubleshooting: common issues and resolutions

Frequently asked questions