Windows 11 Smart App Control explained

In the ever-evolving cybersecurity landscape, Microsoft has introduced various new features in Windows 11 designed to protect users from modern workplace threats. Among such features, Smart App Control (SAC) changes how Windows devices block unwanted or potentially malicious applications.

But what exactly is Smart App Control? How does it work, who benefits most, and are there any caveats? In this story we’ll share some history and also try to explain why SAC has been — and remains — something of a stealth feature in Windows 11.

What is Smart App Control?

Smart App Control is a security feature in Windows 11 designed to block untrusted or potentially dangerous applications from running on a PC. Built directly into the operating system (through Windows Security), SAC leverages code signing, Microsoft’s intelligence cloud, and artificial intelligence to make real-time decisions about whether or not an app or application should be allowed to execute. Its goal is to minimize the risk of malware, ransomware, and unwanted software running on users’ systems — with minimal user intervention.

At its heart, Smart App Control is a kind of gatekeeper. When you attempt to run an app, SAC evaluates its trustworthiness. That evaluation is based on numerous criteria: Is the app digitally signed? Is it widely used and recognized as safe by Microsoft’s threat intelligence network? Has it been flagged previously for questionable behavior? If an app fails one or more such checks and is found suspicious or untrustworthy, SAC blocks its execution, silently preventing a potential security event before it starts.

SAC first appeared in a March 2022 Insider Preview release (Build 22567) in the Dev Channel. It began to work its way into production with Windows 11 version 22H2 that September.

Please note that Smart App Control shows up only in clean installs of Windows 11 22H2 or newer. Installs upgraded from older versions of Windows 11 will always show SAC in the “Off” state. I’ll dig into this more deeply later in the story.

How does Smart App Control work?

SAC operates using a combination of cloud-based intelligence, local analysis, and digital signatures. Here’s a step-by-step breakdown of how it functions:

App verification: When a user attempts to launch an application, SAC inspects the file. It first checks if the app is digitally signed by a trusted publisher, an important indicator of legitimacy.

Cloud intelligence search: SAC then consults Microsoft’s extensive security databases in the cloud. These aggregate threat data from millions of Windows devices worldwide. If the app has been flagged already or is recognized as part of any malware campaign, it is blocked.

AI-based analysis: For less clear-cut instances, SAC uses AI to evaluate an app’s behavior. That is, it looks for telltale signs of malware or unwanted code. Such a dynamic analysis helps catch emerging threats not yet known to the cloud.

When an app is blocked, the user gets a clear, informative notification. Usually, there’s no way to override SAC’s decision, which puts security ahead of convenience. It also ensures that users will quickly report false positives.

Smart App Control is designed to be simple and automatic. Unlike conventional antivirus or endpoint security, it requires no updates to definitions, nor manual scans. SAC works behind the scenes to block threats in real time. Because it uses both local and cloud-based intelligence, it’s always current.

On the downside, some legitimate apps, especially older or custom business software, may not be digitally signed, resulting in false positives. If SAC decides an app is unsafe, the only way to run the app is to turn SAC off — and turning it back on later requires a clean Windows reinstall.

Enabling and configuring Smart App Control: Unintentional stealth

Notably, Smart App Control is enabled by default — ut that happens only on “clean installs” of Windows 11 version 22H2 or later. If you upgrade your system from an older version, SAC will not automatically activate.

Microsoft made this decision to avoid potential compatibility issues with legacy or line-of-business applications. That means most users can’t benefit from SAC unless they get a new PC or somebody reinstalls Windows 11 from scratch on an older one.

To check if SAC is enabled:

Open the Windows Security app.

Navigate to App & Browser Control.

Look for the “Smart App Control” section. You’ll see the current status: On, Off, or Evaluation mode.

Figure 1 shows a screencap from my 2018 vintage ThinkPad X1 Extreme, which has only been upgraded to newer Windows versions, never clean installed. Perforce, it shows Smart App Control turned off.

Figure 1: On PCs upgraded from earlier Windows versions, SAC is always “Off.”
Ed Tittel / Foundry

To my way of thinking, this makes SAC guilty of unintentional stealth. Until I investigated this facility and its use, for example, I had no idea it required either a new and recent Windows 11 installed image (turned on by default) or a new and recent clean install on an older PC (also turned on by default after the OOBE [Out-of-Box Experience] phase of getting to the desktop concludes).

Modes of operation

SAC has three distinct modes:

On: SAC actively monitors and blocks untrusted apps. If Windows 11 is in evaluation mode, you can force it into On mode by clicking this radio button. On a new Lenovo Yoga All-in-One 32ILL10, I was able to turn it on that way. But once turned on, it cannot be set back into evaluation mode.

Off: SAC is disabled and will not intervene. If you turn it off manually, it cannot be turned back on. It will be turned on by default — in evaluation mode — only after a clean install of Windows 11 22H2 or higher.

Evaluation: SAC quietly observes your usage patterns and system needs before fully activating. If it detects incompatible software, it may remain off to avoid disrupting workflows. Some users at Windows ElevenForum (a favorite haunt of mine) have reported periods from several weeks to a month before the switchover occurs.

To double-check this status, I used the Quick Create option in Hyper-V Manager to hurriedly build a Windows 11 Dev environment inside a virtual machine (it came up as Windows 11 22H2, Build 22621.3880 as I wrote this story). As you can see in Figure 2, the VM comes up with SAC in Evaluation mode by default. I’ll let it stay there as long as it wants to.

Figure 2: On a new Windows 11 installation (even a VM), SAC operates in Evaluation mode by default.
Ed Tittel / Foundry

Indeed, organizations or users who run custom software or specialized workflows should leave SAC in Evaluation mode to ensure that business functions keep working. If SAC decides things are safe, it will turn itself on after a while. Otherwise, it will eventually turn itself off.

It’s important to understand that once SAC is turned off, it cannot be re-enabled without reinstalling Windows 11. (See my Windows clean install tutorial for complete instructions.)

This restriction underscores Microsoft’s commitment to maintaining the integrity of the feature and avoiding loopholes that could be exploited. It also shows that Microsoft is serious about avoiding trouble on user PCs with its conservative approach to enablement for SAC. IT pros and power users may find it necessary to clean up questionable software before they can get SAC to turn itself on and stay that way, though.

Smart App Control compared to other Windows 11 protections

Microsoft has long offered security features like Windows Defender, Controlled Folder Access, and Application Control. SAC differs in its general, automated approach. Rather than relying on static definitions, group policies, or user input, SAC leverages real-time intelligence and AI.

In many ways, SAC takes the best bits of Application Control (previously available through Device Guard and Windows Defender Application Control) and makes them accessible to a wider audience. It also involves little or no manual setup and few, if any, policy issues. Then again, as covered earlier in the story, SAC also functions as a black box: one either lives with its judgments, or lives without it.

Real-world impact and industry reception

Early feedback from the IT community has been mostly positive. Security researchers note SAC’s ability to block emerging threats before traditional antivirus solutions can respond. But SAC is hardly bullet-proof: a number of studies cite focused exploits or workarounds to bypass or trick SAC. For instance, Elastic Security Labs documented multiple techniques to break SAC in 2021, with follow-ons from Hacker News and TechRadar.

As always, a proactive approach to cybersecurity that includes teaching users to avoid trouble remains a key ingredient in establishing and maintaining a strong security posture.

For end users, SAC’s presence may go largely unnoticed — until, that is, it intercepts a malicious download or prevents installation of a suspicious or malicious program. Or, as the case may sometimes be, when users try to run old, unsigned software that SAC won’t allow.

Tips for IT administrators

For IT professionals considering deploying devices with SAC, certain best practices are worth implementing:

Test SAC in Evaluation mode before rolling out widely, especially if your organization relies on custom or legacy software, or if anything important is unsigned.

Educate users about SAC’s presence and purpose so they understand why certain apps may be blocked. Set up a procedure to request support and/or fixes, particularly if important software gets blocked. Possible workarounds include restricted VMs with SAC turned off to run unsigned applications.

Maintain an up-to-date inventory of critical applications and ensure as many as possible are digitally signed by trusted publishers.

Monitor Microsoft resources Learn, Support, and Answers forums for SAC updates, compatibility lists, and troubleshooting tips.

The future of Smart App Control

As threats continue to evolve, Microsoft should continue to expand SAC’s capabilities. Undoubtedly it will use more advanced AI models and deeper integration with Windows Defender and Microsoft 365 security. Future updates may introduce more granular controls for enterprise environments, including managed exceptions and better reporting tools.

For now, SAC represents a useful additional tool for Windows security. It’s intended to shift the balance in favor of the good guys in the ongoing war against malware. So far, it’s been a modest step forward. But it’s not unthinkable that SAC could offer more and better protection in upcoming Windows releases, especially in Windows 11 25H2 and beyond.Windows 11 Smart App Control explained – ComputerworldRead More