Smart App Control Certificate Authentication

Question

I'd like to ask if the Smart App Control feature in the Windows 11 25H2 update requires Microsoft verification first? How do I do it? How do I update it automaton after expired? And how do I pay for it for automaton?

Answer 1

how to prove our Application is Safe?

Answer 2

how to prove our Application is Safe?

Answer 3

How to authentication with Microsoft of the Smart App Control?

Answer 4

1. How to make the app is signed with a certificate issued by a certificate authority (CA) in the Microsoft Trusted Root
2. Program? How to get to signed with a certificate from a CA in the Microsoft Trusted Root Program?
3. Can these steps be automatic?

Answer 5

Smart App Control itself does not require separate “certificate authentication” or a paid Microsoft verification subscription from end users.

How Smart App Control decides what can run

• Smart App Control allows an app to run if:
  • Microsoft’s app intelligence service predicts it is safe, or
  • The app is signed with a certificate issued by a certificate authority (CA) in the Microsoft Trusted Root Program.
• If the cloud service cannot make a confident prediction and the app is not signed with a valid certificate, the app is treated as untrusted and can be blocked.

What developers must do If the question is about publishing or running self‑developed apps on systems with Smart App Control enabled:

• Apps should be code‑signed with a certificate from a CA that participates in the Microsoft Trusted Root Program.
• Developers can also use Microsoft’s Trusted Signing service to obtain and use a trusted certificate for signing their binaries.
• All binaries should be signed (exe, dll, installers, scripts, uninstallers, etc.).

There is no separate “Smart App Control verification” workflow that must be completed with Microsoft beyond using a trusted code‑signing certificate.

Certificate expiration and renewal The provided context does not describe an automatic renewal or payment mechanism for certificates in relation to Smart App Control. It only states that:

• Smart App Control trusts apps that are signed with a certificate from a CA in the Microsoft Trusted Root Program.
• Developers are responsible for signing their code with such certificates.

Any processes for purchasing, renewing, or automating renewal of code‑signing certificates (including Trusted Signing) are outside the scope of the given documentation.

Smart App Control enablement requirements For completeness, Smart App Control:

• Is only enabled on clean installs of Windows 11 that include the feature.
• Starts in evaluation mode and then moves to enforcement or turns off based on how the device is used.
• Once turned off, cannot be turned back on without resetting or reinstalling Windows.

---

References:

• Smart App Control overview
• Smart App Control Frequently Asked Questions
• App & browser control in the Windows Security App
• Application Control for Windows
• Application and driver control