Smart App Control and SmartScreen Security Guide

Smart App Control and Microsoft Defender SmartScreen both decide what runs or opens on Windows by asking Microsoft's cloud about reputation, but they block different things, are managed differently and fail in different ways. Users see them as the same "Windows protected your PC" experience, and administrators often assume one covers the other. This guide explains how each feature makes its trust decision, who can turn it on or off, how they relate to App Control for Business, the exact Group Policy and Intune settings to enforce, the events to monitor and the mistakes that leave the protection decorative. It is for endpoint engineers, security operations teams and IT staff in small organisations, and builds on the Application Allowlisting Guide without repeating it.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

Smart App Control blocks execution, SmartScreen warns at the door. Smart App Control is a code integrity policy that stops untrusted binaries from loading; SmartScreen checks sites, downloads and app reputation and, by default, lets users click through.
Smart App Control is a consumer preset of App Control for Business. It turns itself off on enterprise-managed devices within 48 hours unless a user enables it, and it offers no per-app exceptions, so managed fleets use App Control for Business with the Intelligent Security Graph instead.
Enforce SmartScreen with "prevent bypass". Microsoft's recommended configuration turns on SmartScreen in Windows and Edge and blocks users from ignoring warnings for sites and downloads.
Signing is the developer's lever. Code with no reputation runs under Smart App Control only if it carries a valid RSA signature from a certificate authority in the Microsoft Trusted Root Program; ECC signatures are not supported.
Neither feature sees everything. SmartScreen does not protect files opened from internal shares, and the CodeIntegrity log shows blocked files, not failed installations, so pair both with antivirus, allowlisting and monitoring.

How identity and access work in Smart App Control and SmartScreen

These features do not authenticate users; their "identity" decisions are about code and content. Each answers the question "is this file or site trustworthy?" using a mix of signals, and the answer decides whether it runs.

Aspect	Smart App Control	Microsoft Defender SmartScreen
Control type	Code integrity policy enforced by the Windows kernel when a binary loads	Reputation check in Windows, Edge and the shell before a site opens or a downloaded file runs
Trust signals	Microsoft app intelligence (the Intelligent Security Graph) prediction, then a valid signature from a Trusted Root Program CA	Lists of reported phishing and malware sites, lists of frequently downloaded files, URL, file and signing certificate reputation
Default outcome for unknown, unsigned code	Blocked in enforcement mode	Warning the user can bypass unless policy prevents it
Scope	All binaries and scripts that load, whatever their source	Internet sites and files from the internet; not UNC paths or SMB shares
Per-app exceptions	None: turn the feature off or have the developer sign the app	Users can override unless "prevent bypass" is set; false positives can be submitted to Microsoft
Management	Windows Security settings; registry value for testing and turning off at scale	Group Policy, Intune (MDM CSPs), Edge policies
Editions	Windows 11	Windows 10 and 11 (Pro, Enterprise, Education), Microsoft Edge

Smart App Control states

Smart App Control appears in Settings > Windows Security > App and Browser Control with three states. In Evaluation it observes the device to judge whether it is a good fit, without blocking. Microsoft turns it off automatically for users whose legitimate work, such as development or corporate tasks, would cause frequent blocks, and on most other devices it moves to On (enforcement) with a toast notification. Off means no protection. Microsoft's developer documentation states that switching to On or Off in Settings is a one-way change unless the current state is Evaluation. The original requirement was a clean install of Windows 11 (a reset counts); Microsoft's support article now says recent updates allow Smart App Control to be enabled without a clean installation, while also noting that devices with optional diagnostic data turned off still need a reset. Check the current behaviour on your build rather than assuming either.

You can confirm the active policy with citool.exe -lp: a friendly name of VerifiedAndReputableDesktop with Is Currently Enforced set to true means enforcement, and VerifiedAndReputableDesktopEvaluation means evaluation. In enforcement Microsoft also blocks some older Microsoft binaries that attackers misuse; the list sits in the App Control for Business documentation.

Where Enhanced Phishing Protection fits

Enhanced Phishing Protection, part of SmartScreen on Windows 11 22H2 and later, is the one piece with a direct identity role. It watches for the work or school password used to sign in to Windows being typed into a site SmartScreen flags as malicious, reused on other sites, or saved in Notepad or Office documents. It does not fire for Windows Hello for Business PIN or biometric sign-in, which is another reason to move users to phishing-resistant sign-in; see the Passwordless and Passkeys Guide.

Admin roles and privileged access

Both features are only as strong as the control over who can turn them off.

Local administrators: on an unmanaged device any local administrator can switch Smart App Control off in Settings, and its state is held in the VerifiedAndReputablePolicyState value under HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy (0 off, 1 enforce, 2 evaluation). Microsoft documents changing the registry for testing only and warns that doing so can compromise the protection. Removing everyday users from the local Administrators group is the main control; see the Local Administrator Password Solution (LAPS) Guide for managing the built-in administrator.
Enterprise administrators: on managed devices Smart App Control leaves evaluation and turns off within 48 hours unless a user turns it on first. Microsoft documents setting VerifiedAndReputablePolicyState to 0 and running CiTool.exe -r to turn it off consistently across endpoints, which avoids a mixed fleet where some devices block and others do not.
Policy owners for SmartScreen: when "Configure Windows Defender SmartScreen" is enabled by Group Policy, users cannot turn it off; when disabled, users cannot turn it on. Whoever controls the GPO or Intune profile controls the protection, so treat those policy objects as privileged configuration.
Users and warnings: SmartScreen's default allows users to click past warnings. Microsoft recommends preventing bypass, which moves the decision from the user to the administrator and requires a process for false positives.

Choosing between Smart App Control and App Control for Business

Situation	Use	Why
Home users, sole traders, unmanaged family or volunteer devices	Smart App Control in enforcement, SmartScreen on	Strong protection with no policy authoring
Small business without device management, few custom apps	Smart App Control where it stays on, plus enforced SmartScreen	No exceptions possible, so check that every business app is signed first
Managed fleet (Intune, Configuration Manager, Group Policy)	App Control for Business with the Intelligent Security Graph option, starting from the SmartAppControl.xml example policy	Same reputation logic as Smart App Control plus trust for line-of-business apps and audit mode
Developer and build machines	App Control for Business with a tailored policy	Smart App Control will usually turn itself off for this profile

Microsoft ships the Smart App Control example policy at %windir%\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml. If you use it as a base for your own policy you must remove the option Enabled:Conditional Windows Lockdown Policy. The rollout from audit to enforcement is covered in the App Control for Business (WDAC) guide.

Integrations, API tokens and service accounts

Code signing certificates: for software vendors and internal developers, a code signing certificate is the credential that decides whether your app runs under Smart App Control. Microsoft accepts certificates from trusted providers in the Trusted Root Program, signed with RSA keys; ECC signatures are not currently supported. Microsoft names Trusted Signing (formerly Azure Code Signing) as its preferred signing route, with SignTool as the standard tool. Protect signing keys as high-value non-human credentials, ideally in a hardware security module or managed signing service, and restrict which pipelines can request signatures. See the Code Signing Security Guide.
Test every code path: Smart App Control evaluates binaries as they load, so installers, uninstallers, plug-ins and add-ins such as Office add-ins must all be signed. Microsoft's audit policies (SmartAppControlAudit.bin, and SmartAppControlAuditNoISG.bin to test signing without cloud reputation) log what would be blocked.
Antivirus interaction: neither feature replaces antivirus. When Smart App Control or App Control with the Intelligent Security Graph is on and a non-Microsoft antivirus handles real-time protection, Microsoft Defender Antivirus runs in passive or hybrid mode, which Microsoft describes as expected.
Custom identity provider sign-in pages: Enhanced Phishing Protection can raise false warnings for internal sign-in URLs; Microsoft documents adding them through the EnableWebSignIn policy in the Authentication Policy CSP.
Defender for Endpoint: Enhanced Phishing Protection alerts and phishing sensor data appear in the Microsoft Defender portal for onboarded devices, which is where most organisations will review them.

Logging and detection

Source	Event or data	Use
Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational	Event 3076 (evaluation or audit: would have been blocked)	Find unsigned or low-reputation files before enforcement; evaluation mode logs nothing unless an audit policy is applied
Same log	Event 3077 (enforcement: blocked)	Blocked binaries in enforcement; investigate repeated blocks from download or temp folders as possible malware
`citool.exe -lp`	Active policy friendly names	Confirm which devices actually enforce Smart App Control
Microsoft Defender portal	Enhanced Phishing Protection alerts	Users typing or reusing work passwords on malicious or other sites: trigger a password reset
Intune or Group Policy reporting	SmartScreen policy compliance	Devices where SmartScreen is off or bypass is allowed

Microsoft notes that the CodeIntegrity log records blocked or audited files and configuration changes, not which installations failed or why. When a user reports a broken installer, look for 3076 and 3077 events for the individual files inside it.

Metrics: share of Windows 11 devices with Smart App Control or App Control enforcement on; share of devices with SmartScreen enforced and bypass prevented; 3077 blocks per 1,000 devices per week, split by path; false positive tickets and time to resolution; Enhanced Phishing Protection password alerts and the time to reset the affected password.

Threat	ATT&CK	Which feature helps
User runs a malicious download or attachment	T1204.002 Malicious File	Smart App Control blocks unsigned unknown code; SmartScreen warns or blocks downloads
Phishing link to credential harvesting or malware site	T1566.002 Spearphishing Link	SmartScreen site reputation; Enhanced Phishing Protection for password entry
Drive-by download from a compromised site	T1189 Drive-by Compromise	SmartScreen in Edge and Windows
Container files used to strip Mark of the Web	T1553.005 Mark-of-the-Web Bypass	Smart App Control still evaluates the binary when it loads; SmartScreen depends on origin information
Malware signed with stolen or fraudulent certificates	T1553.002 Code Signing	Partially: reputation can still flag it, but a valid signature is a trust signal, so antivirus and EDR remain necessary

Hardening baseline

Inventory the fleet. Record Windows version, management state and current Smart App Control state with citool.exe -lp, and SmartScreen policy state from your management tool.
Enforce SmartScreen in Windows. Group Policy: Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen, Enabled with "Warn and prevent bypass". Intune: SmartScreen/EnableSmartScreenInShell = 1 and SmartScreen/PreventOverrideForFilesInShell = 1.
Enforce SmartScreen in Edge. Enable Configure Microsoft Defender SmartScreen, Prevent bypassing Microsoft Defender SmartScreen prompts for sites, and Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads. MDM equivalents: Browser/AllowSmartScreen, Browser/PreventSmartScreenPromptOverride and Browser/PreventSmartScreenPromptOverrideForFiles, each set to 1.
Consider App Install Control. "Configure App Install Control" (SmartScreen/EnableAppInstallControl) limits installing downloaded apps from outside the Microsoft Store; it does not affect files from USB drives or network shares, so it complements rather than replaces allowlisting.
Turn on Enhanced Phishing Protection. Microsoft recommends enabling Automatic Data Collection, Service Enabled, Notify Malicious, Notify Password Reuse and Notify Unsafe App. Leaving Service Enabled alone runs it in audit mode, which logs events but warns no one.
Decide Smart App Control per device class. Keep it on for unmanaged Windows 11 devices where it is in enforcement. For managed devices, turn it off consistently and deploy App Control for Business with the Intelligent Security Graph in audit mode, then enforce in rings.
Pilot and roll back. Pilot SmartScreen bypass prevention with one department for two weeks, track false positive tickets, then widen. Rollback is a policy change back to warning mode, which takes effect at the next policy refresh; for Smart App Control on test devices Microsoft documents the registry method.
Sign internal software. Require RSA code signing for every internal tool and script package, test with the NoISG audit policy, and track unsigned software as technical debt.

Common misconfigurations

Leaving SmartScreen in warn-only mode: the default lets users click "Run anyway", and social engineering lures tell them to do exactly that. Without "prevent bypass" the control depends on user judgement at the worst moment.
Assuming Smart App Control protects managed devices: it switches off on enterprise-managed devices within 48 hours unless a user enables it. Reports showing "Windows Security healthy" do not mean execution control is running.
Treating SmartScreen as protection for internal shares: Microsoft states SmartScreen does not protect against malicious files on UNC paths or SMB shares. Malware staged on a file server after an intrusion is outside its view; allowlisting is the control for that.
Turning Smart App Control off to run one app: because there are no per-app exceptions, users disable it for a single unsigned tool and lose protection for good on builds where it cannot be re-enabled. Ask the publisher for a signed build or move the device to managed App Control.
Running Enhanced Phishing Protection in audit mode only: it then records password events but warns nobody, and alerts are useful only if someone resets the exposed password.
Signing keys stored without protection: organisations that sign internal software to satisfy reputation checks sometimes keep the certificate on a build server or developer laptop. A stolen signing key turns this control against you, so keep signing keys in an HSM or managed signing service.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
Execution control and reputation blocking	CM-7 Least Functionality; SI-3 Malicious Code Protection	PR.PS-05	Control 2 Inventory and Control of Software Assets; Control 10 Malware Defenses	A.8.7 Protection against malware; A.8.19 Installation of software on operational systems
Code signing requirements	CM-14 Signed Components	PR.PS-05	Control 2	A.8.19
Phishing protection and password warnings	SI-3; AT-2 Literacy Training and Awareness	PR.AT-01	Control 9 Email and Web Browser Protections	A.8.23 Web filtering
Block and audit event monitoring	SI-4 System Monitoring	DE.CM-09	Control 8 Audit Log Management	A.8.16 Monitoring activities

Practitioner checklist

Record Smart App Control state on every Windows 11 device with citool.exe -lp and know which devices actually enforce.
Enable SmartScreen in Windows with "Warn and prevent bypass" through Group Policy or the SmartScreen CSPs.
Enable SmartScreen in Edge and prevent bypass for both sites and downloads.
Enable all five Enhanced Phishing Protection settings and route its alerts to a password reset process.
For managed fleets, replace Smart App Control with App Control for Business using the Intelligent Security Graph, starting in audit mode.
Collect CodeIntegrity events 3076 and 3077 centrally and review blocks weekly.
Require RSA code signing for internal software and keep signing keys in an HSM or managed signing service.
Publish a false positive process that uses Microsoft's file submission portal and an internal exception route through App Control, not by turning protection off.
Keep allowlisting or other controls for files on internal shares, which SmartScreen does not cover.

Smart App Control and SmartScreen: How Windows Reputation Protection Works and When to Use It