mTime is blocked by a web filter

What to do when your organisation’s web filter — most often Microsoft Defender — stops people from opening mTime, and why it happens.

Overview

Some organisations filter the websites their staff can open, by category: social media, streaming, webmail and so on. mTime is a time registration system, not any of those — but a filter can file it under the wrong heading, and then everyone on a managed device is locked out at once.

The most common case is Microsoft Defender for Endpoint with web content filtering turned on. Microsoft’s category database has listed mtime.app as Web-based email, so any organisation that blocks the Web-based email category blocks mTime with it. Nothing has gone wrong in mTime itself, and nothing has gone wrong with your account.

You will recognise it by what the person sees:

If Defender is also installed on your organisation’s phones, the mobile app can be blocked the same way; the allow rule below covers it too. Email notifications from mTime keep arriving either way.

Unblock mTime now

Only an administrator of your organisation’s Microsoft Defender tenant can do this; mTime cannot lift a block from the outside.

1. Open the Microsoft Defender portal at https://security.microsoft.com.
2. Go to Settings › Endpoints › Rules › Indicators and open the URLs/Domains tab.
3. Choose Add item and enter mtime.app as the URL/Domain. Give it a title such as mTime time registration, and leave Expires on as Never.
4. On the Action step choose Allow, then pick the device groups it applies to (the default is all devices) and submit.

An allow indicator overrides the category block. Microsoft says it can take up to two hours to reach every device; in practice it is usually faster.

If you also use the kiosk or read this Knowledge Center from managed devices, add kiosk.mtime.app and help.mtime.app the same way. Adding the bare mtime.app does not cover its subdomains.

Fix it for good

The allow rule unblocks your organisation. The wrong category stays in Microsoft’s database until someone asks Microsoft to correct it — and only an organisation that runs Defender can ask. We cannot do it on your behalf, because the request has to come from inside a Defender tenant that has seen the domain. We would be grateful if you would:

1. In the Defender portal open Reports › Web protection, then Web content filtering categories details, then the Domains tab.
2. Find mtime.app, open the … menu next to it and choose Dispute category.
3. Suggest the category Business (or Productivity, if your portal offers it) and, in the details, write something like: “mtime.app is a workforce time registration and absence management service (SaaS). It is not a webmail service.”
4. Submit. Microsoft reviews these requests within one business day and corrects the category for everyone, not just your tenant.

Keep your allow rule in place regardless; it does no harm once the category is corrected.

Why it happens

Microsoft does not say how it classifies a site, so this is our best understanding. Two things about mtime.app look, to an automated classifier, like a webmail service:

• The domain sends email. Notifications such as approval requests come from notification@mtime.app, so the domain carries the mail records (MX, SPF, DKIM, DMARC) that any legitimate sending domain must have.
• The only public page is a sign-in form with an email field. There is no marketing site at mtime.app; everything behind the sign-in is private to your workspace.

Both are correct and deliberate, so we do not change them. The page that a classifier can read does describe mTime as a time management system, and we keep that description accurate — but a correction request from a Defender customer is what actually moves the category.

Other web filters and firewalls

If your organisation uses a different web filter or a proxy with category blocking (Zscaler, Palo Alto, Fortinet, Cisco Umbrella, Netskope and others), the same two steps apply: add an allow rule for the domains below, and use the vendor’s site-review form to request the category Business or Productivity. Those vendors accept requests from anyone, so tell support (through the in-product help system) which product it is and we will submit one too.

Domains to allow:

Email from mTime comes from notification@mtime.app. If your mail filter quarantines it, allow that sender.

Troubleshooting