How to Install Microsoft Defender Application Guard on Windows 11

This article explains how to install or remove Microsoft Defender Application Guard for the Microsoft Edge browser in Windows 11.

IMPORTANT NOTICE: Microsoft has officially announced the deprecation of Microsoft Defender Application Guard for Microsoft Edge. Starting with Windows 11, version 24H2, this feature is no longer being updated and will be removed in future releases. We recommend exploring modern alternatives like Microsoft Edge for Business and cloud-based security solutions.

Why use Microsoft Defender Application Guard?

This tool helps keep your computer safe. It uses hardware-based isolation to create a secure “container” for your browser. This keeps risky websites and files from touching your personal files or trusted system settings. It acts like a digital vault for your web activity.

What happens when done?

Once finished, you can browse the internet in an isolated environment. If you visit a dangerous site, the threat stays trapped in the container. Your main computer remains protected from viruses and malware. Your host device security is maintained because the browser session is virtualized.

How to install or remove it using the Windows Security app

You can manage this feature easily through your settings. Note: This requires administrative access to your computer.

1. Open the Windows Security app. You can find this by clicking your Start menu and typing “Windows Security.”

2. Click on the App & browser control section.

3. Under the Isolated browsing area, click the link to install or uninstall the feature.

4. A new window will appear. Check the box next to Microsoft Defender Application Guard to install it. If you want to remove it, uncheck the box.

Windows will download the files needed. If you are uninstalling, you will be asked to restart your computer to finish the process.

How to install or remove it using PowerShell

You can also use commands to change this setting quickly. Admin Privilege Required: You must run these steps with admin privileges. Open Windows PowerShell or Command Prompt as an administrator.

To install the feature, run this command:

Dism /online /Enable-Feature /FeatureName:"Windows-Defender-ApplicationGuard"

To remove the feature, run this command:

Dism /online /Disable-Feature /FeatureName:"Windows-Defender-ApplicationGuard"

If the computer asks if you want to restart, type Y and press Enter.

Troubleshooting and Verification

After installation, you can verify if the feature is active by checking the Windows Features list or by attempting to open a new Application Guard window. If the option is missing, ensure your hardware supports virtualization and that it is enabled in your BIOS/UEFI settings. You can also check the status using the command: Get-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard.

Summary

Microsoft Defender Application Guard adds a layer of security by isolating your browsing activity in a virtualized container. While it is a powerful tool for enterprise-managed environments, remember that it is currently being deprecated. You can install or remove it through the Windows Security app or PowerShell. For advanced configurations, please refer to the official Microsoft documentation.

Is Microsoft Defender Application Guard being deprecated?

Yes, Microsoft has deprecated the Application Guard feature. It is no longer receiving new feature updates and is slated for removal in future Windows versions, specifically starting from Windows 11, version 24H2. Users are encouraged to transition to Microsoft Edge for Business or other modern security isolation technologies.

Does Application Guard work in IE mode?

Yes, Application Guard can be configured to work with Internet Explorer mode in Microsoft Edge. This allows organizations to isolate legacy web applications that require IE mode while maintaining a secure container environment, protecting the host system from potential threats found on older, less secure websites.

Can I download files from the container to the host?

By default, files downloaded inside the Application Guard container are isolated. You can configure policies to allow or block file downloads to the host device. This is typically managed via Group Policy or Intune deployment to ensure that malicious files do not escape the container environment.