You tried to open an app and got hit with this message: “Smart App Control has blocked this app.” Windows won’t let it run. No button to override. No obvious fix. Just a block.
I’ve been there. It’s frustrating, especially when you know the app is safe. This article walks you through exactly what’s happening, why Windows is doing this, and how to deal with it without putting your system at risk.
Smart App Control Is Blocking Your App and Here Is Why
Smart App Control (SAC) is a security feature Microsoft introduced in Windows 11 (build 22621 and later). It also exists in a limited way on Windows 10 through Microsoft Defender SmartScreen, though the full SAC experience is Windows 11 specific.
SAC works at the OS level. It checks every app you try to run against Microsoft’s cloud-based reputation service. If the app has a known good reputation or a valid digital signature from a trusted publisher, it runs fine. If it doesn’t, SAC blocks it.
It is not a virus scanner. It doesn’t look inside the app. It just asks: does this app have a reputation? If the answer is no or unclear, it blocks it.
That’s why totally legitimate apps get blocked. A small developer who doesn’t pay for an Extended Validation (EV) code signing certificate won’t have a reputation score. Their app is new. Microsoft hasn’t seen it enough times to trust it. So SAC says no.
The Three Modes SAC Runs In
| Mode | What Happens |
|---|---|
| On | Blocks anything without a verified reputation or valid signature |
| Evaluation | Monitors silently, learns your habits, decides whether to turn on |
| Off | Completely disabled, no reputation checks |
You can check your current mode by going to Windows Security > App and browser control > Smart App Control settings.
One important thing: once SAC is turned Off, you cannot turn it back on without resetting or reinstalling Windows. This is intentional. Microsoft doesn’t want users toggling it off and on.
What Triggers the Block
SAC blocks an app when one or more of these conditions apply:
- The app has no digital signature at all
- The app is signed but the certificate is self-signed (not from a trusted CA)
- The app is new and has not built a reputation in Microsoft’s cloud service yet
- The app was downloaded from an uncommon source that hasn’t been seen often
- The app’s signature has expired or been revoked
- You are in Evaluation mode and SAC is still learning
This is especially common with:
- Open-source tools distributed as raw .exe files
- Games from indie developers
- Portable apps not installed via a traditional installer
- Apps downloaded from GitHub releases
- Older software that was never submitted to Microsoft’s reputation service
How to Fix “Smart App Control Has Blocked This App”
There is no “allow this one time” button in SAC. That’s by design. Your options are below, from safest to most drastic.
Option 1: Check If the App Is Actually Safe
Before doing anything else, verify the app. Check the developer’s official website. Look at the file hash if the developer publishes one. Scan it on VirusTotal by uploading the file. If 0/70 engines flag it and it matches the hash from the official site, you’re probably fine.
Option 2: Wait and Try Again
If SAC is in Evaluation mode, sometimes just running the app a few times or letting Windows collect more data helps. This isn’t a reliable fix but worth trying before anything else.
Option 3: Turn Off Smart App Control
This is the permanent fix. It disables SAC entirely.
- Open Windows Security
- Go to App and browser control
- Click Smart App Control settings
- Select Off
Windows will warn you this can’t be undone without reinstalling. That’s true. After turning it off, the app will run. Microsoft Defender will still protect you through real-time scanning, so you’re not completely unprotected.
Only do this if you regularly use software from sources that SAC doesn’t trust and you have another layer of protection in place.
Option 4: Use Windows Defender SmartScreen Instead (Softer Approach)
If you turn off SAC, SmartScreen still runs. When SmartScreen blocks an app (a different, softer block), you can click More info and then Run anyway. This gives you a case-by-case override instead of an all-or-nothing setting.
This is actually the better workflow for most people. Turn off SAC, keep SmartScreen on, and manually approve apps you trust.
Option 5: Install via Microsoft Store or Winget
Some apps that get blocked when downloaded directly are available through the Microsoft Store or Windows Package Manager (winget). Store apps are signed and trusted automatically.
Open PowerShell and try:
winget search appname
winget install appnameIf the app is in the winget repository, it installs without SAC interference.
Option 6: Ask the Developer to Get Their App Signed
If you’re a developer or you know the developer, the long-term fix is getting the app properly code-signed with a certificate from a trusted CA. Once the app builds reputation through Microsoft’s Windows Defender Application Control system, SAC won’t block it anymore.
For developers: submit your app to Microsoft’s WDSI (Windows Defender Security Intelligence) at microsoft.com/wdsi to build reputation faster.
Windows 10 vs Windows 11: Different Behavior
On Windows 10, you don’t have SAC in the same form. You have SmartScreen, which gives you the “More info / Run anyway” bypass. If you’re seeing a block on Windows 10 with no override option, it’s likely a Group Policy setting or a managed device restriction, not SAC.
On Windows 11 22H2 and later, SAC is active by default on new installations. If you upgraded from Windows 10, SAC may start in Evaluation mode rather than On mode.
| Windows Version | Feature | Override Available? |
|---|---|---|
| Windows 10 | SmartScreen | Yes, click “Run anyway” |
| Windows 11 (upgrade) | SAC in Evaluation | Sometimes |
| Windows 11 (fresh install) | SAC in On mode | No, must disable SAC |
Should You Disable Smart App Control?
Honestly, it depends on how you use your PC.
Keep SAC on if:
- You mostly install software from the Microsoft Store or well-known publishers
- You’re not technical and don’t want to think about this stuff
- Your device is shared with others who might click anything
Turn SAC off if:
- You regularly use open-source tools, indie software, or developer utilities
- You understand what you’re downloading and verify your sources
- You want control over your own machine
Turning it off doesn’t mean you’re unprotected. Windows Defender, SmartScreen, and real-time protection still run. SAC is just one extra layer, and a frustrating one when it blocks legitimate work.
For Developers: Why Your App Gets Blocked and How to Fix It
If you’re building software and your users keep hitting this error, here’s the reality:
SAC relies on reputation data collected from users across Microsoft’s network. A brand-new app with zero installs has zero reputation. That means it gets blocked regardless of how clean the code is.
Your options:
- Get an EV Code Signing Certificate from a CA like DigiCert, Sectigo, or GlobalSign. EV certs carry inherent trust and bypass many reputation checks immediately.
- Submit your app to Microsoft’s malware analysis portal to request reputation review.
- Distribute via the Microsoft Store or partner with a package manager like winget/chocolatey that carries its own trust.
- Educate your users on how to disable SAC or add exceptions via SmartScreen when they download your app directly.
The code signing landscape changed in 2023 when Microsoft started requiring EV certificates for kernel-mode drivers. For user-mode apps, a standard OV (Organization Validated) certificate still works but may not immediately grant reputation.
Quick Reference: Common Scenarios and Fixes
| Scenario | Best Fix |
|---|---|
| One-off app from a known developer | Verify hash, disable SAC, run it |
| Open-source tool from GitHub | Check VirusTotal, disable SAC if clean |
| Game from an indie site | Verify site, check reviews, disable SAC |
| Work software on managed device | Contact IT admin, may be GPO restriction |
| Your own developed app | Get code signing cert, submit for reputation |
| App available on Microsoft Store | Install from Store instead |
Conclusion
“Smart App Control has blocked this app” is Windows doing exactly what it was designed to do: stop software without a verified reputation from running. It’s a blunt instrument. It doesn’t distinguish between malware and a clean app from a developer who just hasn’t paid for a code signing certificate.
The fastest fix for most people is to verify the app is safe (VirusTotal is your friend), then turn SAC off in Windows Security settings and keep SmartScreen on as a fallback. If you’re a developer, invest in an EV code signing certificate. It pays off immediately in fewer support tickets from users hitting this exact wall.
FAQs
Can I whitelist a single app without turning off Smart App Control entirely?
No, SAC doesn’t have a per-app allowlist in the traditional sense. It’s an all-or-nothing system. The only workaround is to turn SAC off and rely on SmartScreen for case-by-case decisions. SmartScreen does let you click “Run anyway” after showing a warning, so it’s more flexible for people who need to run unsigned apps occasionally.
My app was working fine last week and now Smart App Control is blocking it. What changed?
This usually happens in one of two situations: SAC moved from Evaluation mode to On mode after Windows finished assessing your usage patterns, or a Windows update changed SAC’s behavior or updated the reputation database. It can also happen if the app’s certificate expired. Check the app version you have and download a fresh copy from the official site if the certificate may have lapsed.
Does turning off SAC affect Windows Defender or other security features?
No. SAC is an independent layer. Turning it off leaves Microsoft Defender, real-time protection, firewall, and SmartScreen all intact and running. You lose the reputation-based pre-execution block, but everything else stays active. Most home users are well-protected with just Defender and SmartScreen anyway.
I’m on a work computer and I don’t see the option to turn off Smart App Control. Why?
Your IT department has likely locked SAC settings through Group Policy or Intune. On managed enterprise devices, users often can’t modify security settings. Contact your IT admin and explain which app you need to run. They can add exceptions or push a policy change. Trying to bypass it yourself on a managed device could violate your company’s security policy.
Does Smart App Control block apps that are already installed, or only new ones?
SAC primarily checks apps at the point of execution, not just installation. So yes, it can block apps that were already on your system if they haven’t built reputation or their trust status changed. This is more common after a fresh Windows installation where SAC starts in On mode, or when the reputation database gets updated. Already-trusted apps with valid signatures from major publishers are not affected.
