DNS Filter Integration

Connect DNSFilter to Atlas AVD: see protection status for your networks, manage sites, allow and block lists and policy safe search, and more.

Before you begin

  • An Enterprise plan or above. The Integrations hub is locked below Enterprise
  • The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
  • A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
  • A DNSFilter API key, created by a DNSFilter administrator

What you can do

  • See at a glance whether every network is protected, and which ones have no IP address registered.
  • Register, edit and remove DNSFilter sites (networks) and the policy each one uses.
  • Add and remove domains on each policy's allow list and block list, with an optional note.
  • Rename a policy and turn safe search on or off for it.
  • Review the most recent DNS queries, filtered by domain and result, and traffic reports for any date range.
  • Export every site's allow-list domains as a CSV.
  • Ask Atlas Advisor what DNS Filter is blocking, with or without an AI provider set up.

Step 1: Create an API key in DNSFilter

In the DNSFilter dashboard, create an API key from your account's API settings and copy it. Use a key from an administrator account that can see and manage the policies and sites you want Atlas to work with.

Step 2: Connect in Atlas

Once connected, click Manage on the card to open the DNS Filter page. Your DNSFilter organization name appears under the page title. Entering a new key later replaces the stored one.

  1. Select the tenant in the tenant picker.
  2. Go to Administration → Integrations and click Connect on the DNS Filter card (or open its page and use the Connect box there).
  3. Paste the API Key and click Connect. Atlas checks the key with DNSFilter before saving it; an invalid key is not stored.

Protection status and Overview

Across the top, a banner reads Fully Protected when every network has an IP address registered, or Partial Protection when some do not, with cards for Active Policies, Networks protected, and blocked and threat requests over the Reports date range. The Overview tab lists networks that need action, each with Register IP and Setup Guide buttons, a threat summary with the top categories, and every network with its IP address, policy and protection status.

Sites

  • Add Site registers a new site in DNSFilter with a name, public IP address and policy.
  • The edit (pencil) button changes a site's name, policy or IP addresses. Enter several addresses separated by commas; IPv4, IPv6, CIDR ranges and dynamic-DNS host names are accepted, up to 50.
  • The delete button removes the site from DNSFilter after you confirm. This cannot be undone.
  • Export Allow Lists downloads a CSV of every site with its policy and allow-listed domains.
  • Diagnose IPs opens the raw network data DNSFilter returned, to work out why a site shows no IP. Allow pop-ups for Atlas to use it.

Policies and Allow / Block Lists

The Policies tab lists each policy with its ID, safe search setting and allow and block list sizes. Click the pencil to rename a policy, or open Policy Settings to turn Force safe search on search engines on or off. Both change the policy in DNSFilter.

On Allow / Block Lists, pick a policy, then Add to Allow List or Add to Block List with a domain and an optional note. Atlas strips any https://, path or port you paste. Remove a domain with the delete button. The changes apply in DNSFilter straight away; notes are kept in Atlas only.

Query Logs and Reports

  • Query Logs shows the 100 most recent DNS queries with time, domain, category, result, source and network. Search by domain, or show only blocked queries or threats.
  • Reports shows total requests, blocked requests and threat detections, and the top domains and top categories, for the date range you pick (the last 7 days by default).

Protecting new host pools

To filter a new host pool, deploy it with a NAT Gateway so its outbound traffic leaves from one static public IP, then add that IP as a site on the Sites tab with the policy you want. When DNS Filter is connected, the deploy wizard's networking step can also fill in DNSFilter's DNS servers (103.247.36.36 and 103.247.37.37) for the new network.

The Sites tab also has an AVD Auto-Registration card, and the deploy wizard a Register NAT Gateway IP to Policy picker. Both save your choice, but they do not register the site yet, so add the NAT Gateway's IP as a site yourself after each deployment.

Find the NAT Gateway's public IP in the Azure portal under the host pool's resource group → the NAT gateway → Outbound IP.

What the integration does not do

  • It does not create or delete policies from the DNS Filter page, or change which content categories a policy blocks. Do that in DNSFilter. (The deploy wizard can create a new, empty policy.)
  • It does not register a new host pool's IP automatically yet (see above).
  • Query Logs shows only the latest 100 queries, with no date range or paging; the Allowed filter currently shows all queries. Use DNSFilter for full log searches.
  • The Top Blocked Domains list on Reports shows No data for now.
  • It works with the DNSFilter organization the API key belongs to. There is no picker for MSP sub-organizations.
  • It does not deploy DNSFilter's roaming client or relay.
  • There is no Disconnect button for DNS Filter yet (see below).

GCC High tenants

On a tenant or deployment in Azure Government (GCC High), calls to DNSFilter are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from DNSFilter stay empty. The operator who runs your Atlas deployment can approve DNSFilter as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.

Disabling and disconnecting

Disable at the top of the DNS Filter page turns the integration off in Atlas's integration list but keeps the API key saved, so it is not a disconnect. To stop Atlas using DNSFilter, revoke the API key in the DNSFilter dashboard: the page then shows the Connect box again. Nothing in DNSFilter is removed either way; sites, policies and list entries you made from Atlas stay.

Troubleshooting

  • DNS Filter API key is invalid or expired: create a new key in DNSFilter and connect again.
  • DNS Filter API key lacks permission: use a key from an administrator account.
  • DNS Filter rate limit exceeded — try again shortly, or DNS Filter request timed out: wait a moment and click Refresh.
  • Resource not found in DNS Filter: the policy or site was deleted in DNSFilter. Refresh the page.
  • Partial Protection, or a network marked No IP registered: traffic from that network is not filtered. Use Register IP or edit the site to add its public IP. If DNSFilter shows an IP that Atlas does not, use Diagnose IPs and send the result to support.
  • Invalid domain: enter a bare domain such as example.com.

Next steps