Note: Microsoft Defender Application Guard requires the Internet Connection Sharing (ICS) (SharedAccess) service in order to operate, so an exception to disabling this service (see Section 5) will be required if choosing to enable Microsoft Defender Application Guard.

Impact: Microsoft Defender Application Guard will be turned on for Microsoft Edge. While in isolation, improper user interactions and app vulnerabilities can't compromise the kernel or any other apps running outside of the virtualized environment. Rationale: Microsoft Defender Application Guard uses Windows Hypervisor to create a virtualized environment for apps that are configured to use virtualization-based security isolation. Therefore the additional available options of 2 and 3 in this setting are not yet valid. Note #3: At time of publication, Microsoft Defender Application Guard in all currently released versions of Windows 10 does not yet support protection for Microsoft Office, only for Microsoft Edge. More information on system requirements for this feature can be found at System requirements for Microsoft Defender Application Guard (Windows 10) | Microsoft Docs Note #2: At time of publication, Microsoft Defender Application Guard in all currently released versions of Windows 10 does not yet support protection for Microsoft Office, only for Microsoft Edge. This feature is not officially supported on virtual hardware, although it can work on VMs (especially for testing) provided that the hardware-assisted CPU virtualization feature is exposed by the host to the guest VM. Note: Microsoft Defender Application Guard requires a 64-bit version of Windows and a CPU supporting hardware-assisted CPU virtualization (Intel VT-x or AMD-V). Enable Microsoft Defender Application Guard for Microsoft Edge AND Microsoft Office The recommended state for this setting is: Enabled: 1 (Enable Microsoft Defender Application Guard for Microsoft Edge ONLY). Enable Microsoft Defender Application Guard for Microsoft Office ONLY 3.

Enable Microsoft Defender Application Guard for Microsoft Edge ONLY 2. Disable Microsoft Defender Application Guard 1. Information This policy setting enables application isolation through Microsoft Defender Application Guard (Application Guard).

How to turn on microsoft defender