Microsoft Defender SmartScreen blocking the installer

Question

Microsoft Defender SmartScreen blocking the installer

Prabjyot Kaur 20

We have an installer using Azure Key Vault OV Code Signing certificates but still on installing the application we are getting this warning "Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk." .Will using Azure Key Vault EV Code Signing certificates can help us in getting rid of this warning "Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk."

Any insight is really appreciated!

Somil Jain 660 Reputation points

2026-05-09T03:09:46.6866667+00:00
Hi Prabjyot Kaur,

Yes, using an EV (Extended Validation) code signing certificate can significantly help reduce or avoid the Microsoft Defender SmartScreen “unrecognized app” warning compared to a standard OV certificate.

A few important points:

• SmartScreen reputation is separate from code-signing validity. Even if your installer is properly signed with an OV certificate from Azure Key Vault, SmartScreen may still warn users if:

the application is new

download volume is low

reputation has not yet been established

the signing certificate is newly issued

• OV certificates:

verify publisher identity

provide trusted signing

BUT still rely heavily on reputation building over time

This means SmartScreen may continue showing: “Microsoft Defender SmartScreen prevented an unrecognized app from starting”

until sufficient reputation is accumulated.

• EV certificates: Historically, EV code signing certificates received immediate SmartScreen reputation benefits, greatly reducing these warnings.

However, modern SmartScreen behavior is now more reputation-based overall, so EV is not an absolute guarantee, but it still generally helps substantially compared to OV.

For Azure Key Vault specifically:

Azure Trusted Signing / Key Vault-backed signing supports secure signing workflows

but SmartScreen reputation still depends on:

certificate reputation

file reputation download prevalence telemetry signals ```Additional things that help reduce SmartScreen warnings: Keep using the same publisher identity consistently Changing publisher names/certificates resets reputation signals. Sign both: installer embedded binaries/MSI/EXE Timestamp the signature properly Using RFC3161 timestamping is important. Increase trusted distribution Files downloaded from: reputable domains signed HTTPS sites known enterprise channels build reputation faster. Submit files to Microsoft Defender You can submit signed files for analysis/reputation review through Microsoft security submission portals. So in short: Yes, EV certificates generally help more than OV certificates with SmartScreen reputation. But SmartScreen reputation is still telemetry/reputation driven, not purely certificate driven. Even EV-signed applications can occasionally trigger warnings if they are very new or low prevalence. If my answer is useful for you, please hit Accept Answer to support me. Thank you so much.

1 answer

Your answer

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more