Windows 11 Smart App Control: Modes and the New Switch

A Smart App Control block can look like a malware verdict, but it does not always mean Windows has confirmed that a file is malicious. Windows may also stop an app it cannot confidently trust. Before switching the feature off, check which mode is active and whether the January 2026 update that changes On/Off switching has reached your PC.

Information checked through 7 February 2026. The new switching option was being delivered gradually, so two Windows 11 PCs on the same version might not show it at the same time.

What Evaluation, On and Off mean

Smart App Control (SAC) has three states:

Evaluation: Windows observes whether SAC suits the device. It does not block apps in this mode. Windows decides whether to turn the feature on or off when evaluation ends.
On: SAC actively checks apps before they run. Microsoft’s Windows 11 Security Book describes cloud-based app intelligence and code-integrity checks that block apps it considers untrusted or potentially harmful. Signing an app helps establish who published it and whether it has been altered, but no single signal is a guarantee that software is safe.
Off: SAC is not enforcing its app checks. This status describes SAC; it does not tell you whether Microsoft Defender Antivirus or another security product is running.

There is an important difference between Evaluation and the On/Off switch. Microsoft’s support guidance says that once evaluation ends, or if you manually switch SAC on or off, you cannot return to Evaluation without resetting or reinstalling Windows. The January 2026 update introduced an On/Off control for eligible devices, but it does not restart the evaluation phase.

Check the status and update on your PC

Before changing anything, check what your device actually has:

Open Windows Security from Start.
Select App & browser control, then Smart App Control settings. Note whether the state is Evaluation, On or Off.
Open Settings > System > About and note the Windows version and OS build. Microsoft’s device information guide shows where to find them.
Open Settings > Windows Update > Update history. Look for the January 2026 preview update KB5074105.

Microsoft’s 29 January release notes cover Windows 11 versions 24H2 and 25H2. A 30 January note says the SAC change is included: the feature can be switched on or off without a clean install. Microsoft listed it under gradual rollout, which means availability varies by device. Having the update or matching build is not proof that the new control has reached your Settings page.

If Smart App Control settings does not offer the switch, do not turn SAC off expecting to reverse it later. Microsoft’s existing guidance says re-enabling SAC on a device where it is off may require resetting or reinstalling Windows. Do not reset just to chase a staged feature; check the release notes and your device’s state first. On a work or school PC, an administrator may manage security settings.

If Smart App Control blocks an app

First note the app name and file path shown in the warning. Confirm that it is the program you meant to open and get a fresh copy from the software maker’s official site. If the publisher is legitimate but Windows still blocks the app, ask the publisher whether it provides a current signed version. For a managed device, send the details to IT.

A block means SAC did not consider the app trusted enough to run under its current checks. That can include software Windows identifies as harmful, as well as software it cannot confidently assess and verify. Treat the warning as a reason to check the exact file and publisher, not as proof of malware and not as a prompt to download a replacement from an unofficial mirror.

Turning SAC off changes this device-wide app protection; it is not a one-app exception. If you need to make that trade-off, first confirm the app and understand which state your PC will allow you to return to. If the warning instead names Controlled folder access, that is a different Windows feature that limits apps from changing protected files; see our guide to Controlled Folder Access .