When Smart App Control blocks an app: there is no per-app exception to find
An app you downloaded will not start, and Smart App Control is named as the thing blocking it. Most people then go looking for a setting to allow that one app. Microsoft states that no such setting exists. What exists is turning the feature off, or asking the developer to sign the app. And the rule many people remember — that enabling it needs a clean installation — is stated three times on the same page to have changed. This guide was written on 2026-09-21 from Microsoft's FAQ. Nothing was tested on hardware here.
Published · Updated · FaultNote editorial policy
Who this guide is for and what to prepare
- People whose app has been blocked by Smart App Control
- People looking for a per-app exception setting
- People who found the feature already off and want to know why
What you need
- Be able to check where the blocked app came from and whether it is signed
- Confirm you can open the Windows Security app
- Understand what turning the feature off changes, before deciding to do it
1. What the decision is actually based on
The FAQ sets out the order clearly: When you try to run an app on Windows, Smart App Control will check to see if our intelligent cloud-powered security service can make a confident prediction about its safety. If the service believes the app to be safe, Smart App Control will let it run. If the app is believed to be malicious or potentially unwanted, then Smart App Control will block it.
Then the branch for when it cannot decide: If the security service is unable to make a confident prediction about the app, then Smart App Control checks to see if the app has a valid signature. If the app has a valid signature, Smart App Control will let it run. If the app is unsigned, or the signature is invalid, Smart App Control will consider it untrusted and block it for your protection.
So: a cloud prediction first, and only where no confident prediction is possible does the signature decide. Unsigned or invalidly signed means untrusted, and untrusted means blocked.
The part worth holding on to is that a block does not necessarily mean the app was judged harmful. No confident prediction plus no signature produces the same outcome. Microsoft uses untrusted for both.
2. There is no per-app exception
The FAQ answers the question directly: There is currently no way to bypass Smart App Control protection for individual apps. You can turn Smart App Control off, or (better yet), contact the developer of the app and encourage them to sign their app with a valid signature.
Two options, and an explicit preference between them. Nothing in between.
That one sentence saves the time otherwise spent searching the settings for an allow list. There is nothing to find.
Disabling is available: You are able to disable Smart App Control in the Windows Security App settings. Before deciding, read the next section — the constraint most people weigh that decision against has changed.
03. The clean-install rule no longer applies
The best-known constraint on this feature is contradicted three separate times on the same page. Recent Windows updates allow Smart App Control to be enabled without requiring a clean installation.
Again, in the context of turning it on: Recent Windows updates allow Smart App Control to be enabled within the Windows Security App without requiring a clean installation.
And for anyone who has turned it off: Recent Windows updates allow Smart App Control to be re-enabled without requiring a clean installation.
So once you turn it off you can never get it back does not match what this page now says. This guide does not say which update changed it, because the FAQ says only recent Windows updates and nothing was verified on hardware here.
4. Why it is already off on your machine
The FAQ lists the reasons it can be off, and the table reproduces them.
The first row is the telling one. Microsoft writes that some legitimate tasks corporate users, developers or others do regularly may not be a great experience with the feature running, and that if such a user is detected it is turned off automatically so they can work with fewer interruptions. Finding it off is not, by itself, a sign that anything is wrong.
Scroll horizontally to see the full table →
| Reason given in the FAQ | What the page states |
|---|---|
| It was turned off automatically | If Microsoft detects a corporate user, developer or similar, it is turned off automatically so they can work with fewer interruptions |
| The device is enterprise-managed, or developer mode is configured | Listed as given |
| It was turned off manually, by you or another user of the machine | Listed as given |
| The device is running Windows in S mode | S mode has to be turned off, then the PC reset |
| Optional diagnostic data is turned off | To turn the feature on you would need to reset the PC or reinstall Windows and select Send optional diagnostic data during setup |
5. What you can actually do about a block
Set out, the choices are few. The table lists what the FAQ supports, not an order this site recommends.
One more thing the FAQ settles: Smart App Control works alongside your other security software, such as Microsoft Defender or non-Microsoft antivirus tools, for added protection. It is additional, not a replacement.
Scroll horizontally to see the full table →
| Option | What the FAQ states | Worth knowing |
|---|---|---|
| Make an exception for that one app | Stated not to exist currently | Searching the settings for it is time spent on nothing |
| Ask the developer to sign the app | Named as the better of the two options | Slow, but it addresses the actual basis of the decision |
| Turn the feature off | Available in the Windows Security app settings | Re-enabling is stated not to require a clean installation |
| Reconsider where the file came from | Not addressed in the FAQ | Checking the source and hash before running an unsigned file is covered separately on this site |
Limitations and requirements
- Nothing was tested on hardware for this guide. The mechanism and conditions quoted are from Microsoft's published FAQ.
- A block does not necessarily mean the app was judged harmful — no confident prediction plus no signature gives the same result. Nor is the absence of a block a guarantee of safety.
- Whether to turn the feature off is the reader's decision. This guide does not advise it; the FAQ positions the feature as additional protection alongside other security software.
- The wording quoted was read on 2026-09-21. The FAQ says recent Windows updates without naming which.
Frequently asked questions
Is there a setting to allow just this one app?
Microsoft states that there is currently no way to bypass Smart App Control protection for individual apps. The options given are turning the feature off, or encouraging the developer to sign the app with a valid signature.
If I turn it off, do I need a clean install to get it back?
The FAQ states that recent Windows updates allow Smart App Control to be re-enabled without requiring a clean installation, and says the same about enabling it in the first place.
Does a block mean the app is dangerous?
Not necessarily. The FAQ states that where the security service cannot make a confident prediction and the app has no valid signature, it is considered untrusted and blocked.
It was already off on my machine.
The FAQ states that where a corporate user, developer or similar is detected, it is turned off automatically to reduce interruptions. It also lists enterprise management, developer mode, manual disabling, S mode and optional diagnostic data being off.
Does it replace antivirus software?
No. The FAQ states that it works alongside other security software such as Microsoft Defender or non-Microsoft antivirus tools, for added protection.
Sources and verification date
Sources checked: . These sources support the specifications, procedures or prices discussed here. Check each source for applicable conditions and current information.
Related practical guides
- Verify a Download's SHA-256 Hash Against the Publisher's Value in Windows
- When memory integrity refuses to turn on: the incompatible driver, and what to check before buying
- Before you swap in a new SSD: check whether the drive is encrypted, and where the recovery key lives
- Adding Windows Hello: fingerprint reader or IR camera, and what Enhanced sign-in security rules out
- 4K text too small? Choosing size, resolution and Windows scaling from published PPI
- Use your phone as a webcam, or buy one? What Windows 11 documents, and what it does not