Smart App Control adds significant protection from new and emerging threats by blocking apps that are malicious or untrusted. Smart App Control also helps to block potentially unwanted apps, which are apps that may cause your device to run slowly, display unexpected ads, offer extra software you didn't want, or do other things you don't expect.
Smart App Control works alongside your other security software, such as Microsoft Defender or non-Microsoft antivirus tools, for added protection.
Important:
-
Smart App Control can be used on new Windows 11 installs only. If you received it as part of a Windows update on an already running device, you won't be able to turn it on unless you reset your PC or re-install Windows.
-
For the best experience with Smart App Control be sure you have the latest Windows and Defender updates installed on your device. Check for updates
How does Smart App Control work?
When you try to run an app on Windows, Smart App Control will check to see if our intelligent cloud-powered security service can make a confident prediction about its safety. If the service believes the app to be safe, Smart App Control will let it run. If the app is believed to be malicious or potentially unwanted, then Smart App Control will block it.
If the security service is unable to make a confident prediction about the app, then Smart App Control checks to see if the app has a valid signature. If the app has a valid signature, Smart App Control will let it run. If the app is unsigned, or the signature is invalid, Smart App Control will consider it untrusted and block it for your protection.
Where are the Smart App Control settings?
You can find the settings for Smart App Control in the App & browser control panel of the Windows Security app. The fastest way to access these settings is:
-
Tap the Start button in Windows.
-
Type Smart App Control in the search box.
-
Select the Smart App Control system settings from the results.
Evaluation mode
We start in evaluation mode. This is a period during which Windows tries to determine if you're a good candidate for Smart App Control. If you are a good candidate for Smart App Control, then it will automatically be turned on. If not, it'll be turned off.
Smart App Control won't block anything while it's in evaluation mode.
Once the evaluation is complete, or if you manually switch Smart App Control on or off, you won't be able to return to evaluation mode unless you reinstall or reset Windows.
Essentially, we're looking to see if Smart App Control is going to get in your way too often. There are some legitimate tasks that corporate users, developers, or others may do regularly that may not be a great experience with Smart App Control running. If we detect during evaluation mode that you're one of those users, we'll automatically turn Smart App Control off so you can work with fewer interruptions.
Yes, if it's available for your device, but we recommend you let evaluation mode do its job and determine if you're a good candidate for Smart App Control.
Why is Smart App Control turned off?
Smart App Control is only available on clean installs of Windows 11. Also, there are other reasons why Smart App Control could be turned off.
-
During evaluation mode we determined that you weren't a good candidate for Smart App Control.
-
It was turned off manually by you or another user signed into your machine.
-
Your device is running Windows in S mode. You'll need to turn S mode off, then reset your PC, to enter evaluation mode.
-
You have optional diagnostic data in Windows turned off. If you want to turn Smart App Control on, you'll need to reset this PC, or reinstall Windows, and select Send optional diagnostic data during the setup process.
In order to ensure a more secure experience, we only enable Smart App Control on clean installs of Microsoft Windows 11. We want to be sure that there aren't already untrusted apps running on the device when we turn Smart App Control on.
Tip: If you want to turn Smart App Control on after it's been turned off, you can reset Windows 11 by tapping the Start button, typing Reset in the search box, selecting Reset this PC from the search results, and starting a reset from the Recovery menu. You can choose the Keep my files reset that keeps your personal files and only removes apps and settings. For more information, see Recovery options in Windows.
Other frequently asked questions
Smart App Control works alongside your other security software, such as Microsoft Defender or non-Microsoft antivirus tools, for added protection.
There is currently no way to bypass Smart App Control protection for individual apps. You can turn Smart App Control off, or (better yet), contact the developer of the app and encourage them to sign their app with a valid signature.
When a developer creates an app, they are encouraged to "sign" the app using a digital certificate that verifies their identity, that the app is really published by them, and that the app hasn't been tampered with by somebody else after the developer published it. You can think of it a bit like a painter signing a piece of art, except harder to fake.
Signing is one part of what can make an app trusted or untrusted. The other part is experience. Our intelligent cloud-powered security service sees a huge number of apps every day and uses that knowledge to predict if an app is safe or not safe — even apps we've never seen before. However, in some cases, the service is unable to make a confident prediction either way.
If the security service can't make a confident prediction about the app, and the app doesn't have a valid signature, it's considered untrusted.
The simple answer is, sign your app with a valid certificate.
For more information see:
We're listening!
We'd love your feedback on Smart App Control. To let us know what you think or offer feature suggestions:
-
In Windows, go to the Feedback Hub. (from the Start menu or press Windows key + F).
-
When you get to Step 2 - Choose a category, select Security and Privacy - Smart App Control.
