Windows security features licensing and edition requirements

This article lists the security features that are available in Windows.

Select one of the two tabs to learn about licensing requirements to use the security features, or to learn about the Windows edition requirements that support them:

Feature name Windows Pro[1] Windows Enterprise E3 Windows Enterprise E5 Windows Education A3 Windows Education A5
Access Control (ACL/SACL) ✅ ✅ ✅ ✅ ✅
Account Lockout Policy ✅ ✅ ✅ ✅ ✅
Active Directory domain join, Microsoft Entra join, and Microsoft Entra hybrid join with single sign-on (SSO) ✅ ✅ ✅ ✅ ✅
Administrator protection ✅ ✅ ✅ ✅ ✅
Agentic security ✅ ✅ ✅ ✅ ✅
Always On VPN (device tunnel) ❌ ✅ ✅ ✅ ✅
App containers ✅ ✅ ✅ ✅ ✅
App Control for Business ✅ ✅ ✅ ✅ ✅
App Control for Business with Managed Installer ✅ ✅ ✅ ✅ ✅
App Signing ✅ ✅ ✅ ✅ ✅
AppLocker ❌ ✅ ✅ ✅ ✅
Assigned Access (kiosk mode) ✅ ✅ ✅ ✅ ✅
Attack surface reduction (ASR) ✅ ✅ ✅ ✅ ✅
BitLocker ✅ ✅ ✅ ✅ ✅
BitLocker advanced management ❌ ✅ ✅ ✅ ✅
BitLocker hardware-accelerated ✅ ✅ ✅ ✅ ✅
Bluetooth pairing and connection protection ✅ ✅ ✅ ✅ ✅
Common Criteria certifications ✅ ✅ ✅ ✅ ✅
Controlled folder access ✅ ✅ ✅ ✅ ✅
Credential Guard ❌ ✅ ✅ ✅ ✅
Device health attestation service ✅ ✅ ✅ ✅ ✅
Direct Access ❌ ✅ ✅ ✅ ✅
Domain Name System (DNS) security ✅ ✅ ✅ ✅ ✅
DNS - Zero Trust DNS ❌ ✅ ✅ ✅ ✅
Email Encryption (S/MIME) ✅ ✅ ✅ ✅ ✅
Encrypted hard drive ✅ ✅ ✅ ✅ ✅
Enhanced phishing protection with SmartScreen ✅ ✅ ✅ ✅ ✅
Exploit protection ✅ ✅ ✅ ✅ ✅
Federal Information Processing Standard (FIPS) 140 validation ✅ ✅ ✅ ✅ ✅
Federated sign-in ❌ ❌ ❌ ✅ ✅
FIDO2 security key ✅ ✅ ✅ ✅ ✅
Hardware-enforced stack protection ✅ ✅ ✅ ✅ ✅
Hypervisor-protected Code Integrity (HVCI) ✅ ✅ ✅ ✅ ✅
Kernel Direct Memory Access (DMA) protection ✅ ✅ ✅ ✅ ✅
Local Security Authority (LSA) Protection ✅ ✅ ✅ ✅ ✅
Measured boot ✅ ✅ ✅ ✅ ✅
Microsoft Defender Antivirus ✅ ✅ ✅ ✅ ✅
Microsoft Defender for Endpoint ❌ ❌ ✅ ❌ ✅
Microsoft Defender SmartScreen ✅ ✅ ✅ ✅ ✅
Microsoft Pluton ✅ ✅ ✅ ✅ ✅
Microsoft Security Development Lifecycle (SDL) ✅ ✅ ✅ ✅ ✅
Microsoft vulnerable driver blocklist ✅ ✅ ✅ ✅ ✅
Microsoft Windows Insider Preview bounty program ✅ ✅ ✅ ✅ ✅
Modern device management through (MDM) ✅ ✅ ✅ ✅ ✅
OneFuzz service ✅ ✅ ✅ ✅ ✅
Passkeys ✅ ✅ ✅ ✅ ✅
Passkey manager integration with Hello ✅ ✅ ✅ ✅ ✅
Personal Data Encryption ❌ ✅ ✅ ✅ ✅
Post-quantum cryptography ✅ ✅ ✅ ✅ ✅
Privacy Resource Usage ✅ ✅ ✅ ✅ ✅
Privacy Transparency and Controls ✅ ✅ ✅ ✅ ✅
Remote Credential Guard ✅ ✅ ✅ ✅ ✅
Remote wipe ✅ ✅ ✅ ✅ ✅
Secure Boot and Trusted Boot ✅ ✅ ✅ ✅ ✅
Secured-core configuration lock ✅ ✅ ✅ ✅ ✅
Secured-core PC firmware protection ✅ ✅ ✅ ✅ ✅
Security baselines ✅ ✅ ✅ ✅ ✅
Server Message Block (SMB) file service ✅ ✅ ✅ ✅ ✅
Server Message Block Direct (SMB Direct) ✅ ✅ ✅ ✅ ✅
Smart App Control ✅ ✅ ✅ ✅ ✅
Smart Cards for Windows Service ✅ ✅ ✅ ✅ ✅
Software Bill of Materials (SBOM) ✅ ✅ ✅ ✅ ✅
Sysmon functionality ✅ ✅ ✅ ✅ ✅
System Guard ✅ ✅ ✅ ✅ ✅
Tamper protection settings for MDE ✅ ✅ ✅ ✅ ✅
Transport Layer Security (TLS) ✅ ✅ ✅ ✅ ✅
Trusted Platform Module (TPM) ✅ ✅ ✅ ✅ ✅
Universal Print ❌ ✅ ✅ ✅ ✅
User Account Control (UAC) ✅ ✅ ✅ ✅ ✅
Virtual private network (VPN) ✅ ✅ ✅ ✅ ✅
Virtualization-based security (VBS) ✅ ✅ ✅ ✅ ✅
Web sign-in ✅ ✅ ✅ ✅ ✅
Wi-Fi 7 for Enterprises ✅ ✅ ✅ ✅ ✅
WiFi Security ✅ ✅ ✅ ✅ ✅
Windows application software development kit (SDK) ✅ ✅ ✅ ✅ ✅
Windows Autopatch ✅ ✅ ✅ ✅ ✅
Windows Autopilot ✅ ✅ ✅ ✅ ✅
Windows Firewall ✅ ✅ ✅ ✅ ✅
Windows Hello for Business ✅ ✅ ✅ ✅ ✅
Windows Hello for Business Enhanced Security Sign-in (ESS) ✅ ✅ ✅ ✅ ✅
Windows Hotpatch ✅ ✅ ✅ ✅ ✅
Windows LAPS ✅ ✅ ✅ ✅ ✅
Windows passwordless experience ✅ ✅ ✅ ✅ ✅
Windows presence sensing ✅ ✅ ✅ ✅ ✅
Windows protected print ✅ ✅ ✅ ✅ ✅
Windows Sandbox ✅ ✅ ✅ ✅ ✅
Windows security policy settings and auditing ✅ ✅ ✅ ✅ ✅

1 Also applies to Windows Pro Education

For more information about Windows licensing, see Windows Commercial Licensing overview.

  • Last updated on