What Is Smart App Control in Windows 11?

What is Smart App Control? It's a Windows 11 security feature that blocks apps Microsoft can't confirm are safe before they run. It checks each app against Microsoft's cloud security service, then looks for a valid digital signature, and blocks anything that is unknown and unsigned. Until 2026, turning it off was permanent without a reinstall. Microsoft's current documentation says recent updates let you switch it back on from Windows Security without a clean install.

What Is Smart App Control and How Does It Work?

Smart App Control (SAC) is an app-blocking layer in Windows 11 that decides whether a program is allowed to start at all. Antivirus looks for known malware. SAC takes a stricter approach: if an app can't prove it's trustworthy, it doesn't run.

According to Microsoft's Smart App Control FAQ, each check happens in two stages:

1. Cloud reputation check. Microsoft's cloud-powered security service predicts whether the app is safe. Apps it judges safe run normally. Apps it judges malicious or potentially unwanted are blocked.
2. Signature check. If the service can't make a confident prediction, SAC looks for a valid code signature. A digital signature proves who published the app and that nobody has altered it since. Signed apps run. Unsigned apps, or apps with an invalid signature, are treated as untrusted and blocked.

The cause and effect matter here. Most well-known software is either widely seen by Microsoft's service or properly signed, so it passes. Small utilities, hobby projects, old installers and some open-source tools are often unsigned and rarely downloaded, so SAC is far more likely to block them. "Potentially unwanted apps" covers things like installers that bundle extra software or programs that show unexpected ads.

Can Smart App Control Be Turned Back On After You Turn It Off?

Yes, on an up-to-date Windows 11 PC. Microsoft's FAQ now states that recent Windows updates allow Smart App Control to be re-enabled without requiring a clean installation. Older articles that say a reset is mandatory describe the original behaviour.

Here's how the rule changed:

Because the change rolled out in stages, a PC that has missed several months of updates may still behave the old way. Install the latest cumulative update from Settings → Windows Update before you assume a reset is needed.

How Do You Turn Smart App Control On or Off?

Smart App Control lives in the Windows Security app, not in the main Settings categories. To change it:

1. Open Start, type Smart App Control and select the system settings result. Alternatively, open Windows Security → App & browser control → Smart App Control settings.
2. Choose On to block untrusted apps, or Off to disable the feature.
3. Approve the administrator (UAC) prompt.
4. If you turned it off to install one specific program, turn it back on once the installation has finished.

On a new installation you may also see Evaluation. In evaluation mode, SAC watches how you use the PC without blocking anything. It then switches itself on, or off if your normal work, such as software development, would trigger frequent blocks. Once you make a manual choice, you can't return to evaluation mode without resetting or reinstalling Windows.

Why Is Smart App Control Off or Unavailable?

SAC is turned off or greyed out when Windows decides the PC doesn't suit it, or when another setting conflicts with it. Microsoft lists these common reasons:

• The device is managed by an organisation, or developer mode is turned on.
• Someone turned it off manually on this PC.
• Windows is running in S mode. S mode already limits you to Microsoft Store apps, so the two features don't run together. Our guide to S mode in Windows 11 explains how to switch out of it.
• Optional diagnostic data is turned off. SAC relies on the cloud service, so Microsoft says you need to send optional diagnostic data for it to be available. For older builds, that meant choosing the setting during a reset or reinstall.

Edition isn't one of the reasons. Smart App Control is available in both Windows 11 Home and Pro, so upgrading editions won't enable it.

Is Smart App Control Worth Keeping On?

For most home users, yes. If you mainly use mainstream apps from well-known publishers and the Microsoft Store, SAC rarely gets in the way. It also protects against new threats that antivirus signatures haven't caught yet, because unknown unsigned code simply isn't allowed to run.

It works alongside Microsoft Defender or a third-party antivirus. It doesn't replace them. If you're choosing protection for a new PC, our roundup of the best antivirus for Windows 11 covers how the built-in tools compare.

Consider turning it off if you write code, use niche unsigned tools every day, or deploy software with transform (MST) files. MST files can't currently be digitally signed, so SAC may block them when the cloud service can't vouch for them. In that case, switch SAC off for the install and back on afterwards.

What Should You Do When Smart App Control Blocks a File?

When SAC blocks a file, the app simply won't open and Windows shows a notification. There's no "run anyway" button and no allow-list for individual apps. Your options are:

1. Check where the file came from. Download it again from the publisher's official site. A tampered or repackaged copy can fail the signature check when the original passes.
2. Look for a signed or Microsoft Store version. Many publishers offer both.
3. Ask the developer to sign the app. Microsoft's advice to developers is to sign with a valid certificate.
4. Turn SAC off temporarily if you trust the app completely, install it, then turn SAC back on.

Defender exclusions don't affect this decision. Adding a folder or file to the Microsoft Defender exclusion list, covered in our guide to Windows Defender exclusions, only changes antivirus scanning. Smart App Control makes its own decision.

A Common Mistake We See

Many people turn Smart App Control off to install one awkward program and never turn it back on. Others reset their whole PC because an older guide told them a reset was the only way to restore it. On a fully updated Windows 11 PC, neither is necessary. Check for updates first, then use the toggle in Windows Security.

The same applies after a fresh installation. If you're doing a clean install or a reset anyway, keep optional diagnostic data switched on during setup so SAC can enter evaluation mode.

Frequently Asked Questions

Is a clean install still mandatory to turn Smart App Control back on?

Not on current Windows 11. Microsoft's FAQ says recent updates let you re-enable Smart App Control from Windows Security without a clean installation. The change rolled out during 2026, so install the latest cumulative update first. A reset may still be needed on PCs that are far behind on updates.

How do I turn off Smart App Control?

Open Windows Security, select App & browser control, then Smart App Control settings, and choose Off. You'll need administrator approval. Turn it off only when you have a trusted program it keeps blocking, and switch it back on once that program is installed.

What does "Smart App Control blocked a file that may be unsafe" mean?

It means Microsoft's cloud service couldn't confirm the file is safe and the file has no valid digital signature, so Windows stopped it from running. The file isn't necessarily malware. Download it again from the official source, look for a signed version, or turn SAC off temporarily if you trust it.

Does Smart App Control replace Microsoft Defender?

No. Smart App Control decides whether an app may start, while Microsoft Defender or another antivirus scans files and watches for malicious behaviour. Microsoft designed them to work together. Keep your antivirus running even with SAC on, because each covers threats the other can miss.

Can I allow one app through Smart App Control?

No. Microsoft says there's currently no way to bypass Smart App Control for an individual app. You can either turn the whole feature off or ask the developer to sign the app with a valid certificate. Defender exclusions don't change SAC's decision.

Is Smart App Control available on Windows 11 Home?

Yes. Smart App Control works on both Windows 11 Home and Pro. It's unavailable in S mode, on organisation-managed devices, with developer mode turned on, or when optional diagnostic data is turned off. The edition you run doesn't change how it behaves.

Conclusion

So, what is Smart App Control? It's Windows 11's "prove it first" gate for apps, and on an updated PC you can now turn it off and back on without reinstalling. Keep it on unless your work depends on unsigned tools. If you're setting up a new PC with a genuine licence, browse our Windows 11 product keys to get started.

Useful Links