What is Microsoft Defender Application Guard?

Answer: Isolated browsing!

• https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview
• https://accdox.com/cjtfm

Microsoft Defender Application Guard (I’ll use MDAG for short) is a Windows security feature that uses virtualization to isolate untrusted websites and applications, minimizing the risk of malware and hacker attacks. This technology is particularly useful for organizations and users who frequently interact with online content from untrusted sources, as it creates an isolated environment for the Microsoft Edge web browser, thereby protecting the system from potential risks associated with web browsing and file downloads. In the following sections, we will examine how MDAG works, what advantages and disadvantages it offers to users and businesses, and how it can be deployed in corporate networks to enhance security.

Minimum System Requirements

To use Microsoft Defender Application Guard, your computer must meet the following requirements:

• Operating System: Windows 10 Pro, Enterprise (version 1803 or later), or Windows 11 Pro, Enterprise
• Processor: Virtualization support (Intel VT-x or AMD-V)
• RAM: At least 8 GB (16 GB recommended for better performance)
• Disk space: At least 5 GB of free space
• Hyper-V: Virtualization support enabled in BIOS/UEFI

How to enable Microsoft Defender Application Guard

For Windows 10/11 Pro and Enterprise:

1. Open “Windows Features”
   • Press Win + S, search for "Windows Features," and select "Turn Windows features on or off."
2. Enable “Microsoft Defender Application Guard”
   • Scroll down, check the box next to “Microsoft Defender Application Guard,” and click “OK.”
   • If the system prompts you to restart, restart your computer.
3. Configuring via Windows Security
   • Open Windows Security (Win + S → “Windows Security”).
   • Go to App & browser control > Isolated browsing > Turn on Microsoft Defender Application Guard.
4. Or the easiest way: enable it from the old and familiar "Control Panel":
   • Control Panel -> Programs and Features -> Turn Windows features on or off
   • Scroll down, check the box next to "Microsoft Defender Application Guard," and click "OK."
   • If the system prompts you to restart, restart your computer.

Via Group Policy (for administrators):

1. Press Win + R, type gpedit.msc, and press Enter.
2. Go to: Computer Configuration -> Administrative Templates -> Windows Components -> Microsoft Defender Application Guard
3. Enable "Turn on Microsoft Defender Application Guard" and apply the settings.

How to open Microsoft Defender Application Guard in Edge

1. Open Microsoft Edge.
2. Click the three dots (Menu) in the upper-right corner.
3. Select New Application Guard window.
4. A new window will open with an isolated environment protected by Application Guard.

Benefits of using Microsoft Defender Application Guard

• Isolates potentially dangerous websites – Web pages opened in Edge can be isolated in a protected virtual environment.
• Protection against malware and attacks – Even if malware runs in the protected browser, it will not affect the main operating system.
• Integration with Windows Defender – Works together with Windows Defender Antivirus and SmartScreen for added security.
• Automatic session reset – All data in the isolated environment is deleted upon closing.

Protection when using public networks

Microsoft Defender Application Guard provides protection even when you’re connected to a public Wi-Fi network, but there are some limitations:

How does MDAG protect you on a public network?

• It isolates web content – If you open web pages in Edge with Application Guard enabled, they will be in an isolated virtual environment. This means that even if a website contains malicious code, it won’t be able to reach your actual system or network.
• Protection against network attacks – Application Guard prevents malicious software from communicating with your system or other devices on the network.
• Automatic Session Reset – After closing the window, all session data is cleared, which prevents malicious files from being stored.

What are the limitations?

• Does not fully protect against “Man-in-the-Middle” (MitM) – If you connect to an unsecured public Wi-Fi network, a malicious actor can intercept your internet traffic, especially if you visit unencrypted HTTP sites.
• Does not protect against keyloggers and malware on the host system – If you already have malware on your device, Application Guard will not remove it.
• Does not protect other applications – Application Guard works primarily with Microsoft Edge and does not cover other browsers or software.

What should you do if you’re on a public network anyway?

1. Use a VPN – It encrypts your connection, so even if someone intercepts your traffic, it will be unreadable.
2. Use only HTTPS sites – Check that the site has “https://” in the address bar.
3. Do not enter sensitive information – Avoid logging into bank accounts or other critical services.
4. Use a mobile network if possible – Mobile networks are generally more secure than public Wi-Fi.

Drawbacks and limitations of MDAG

• Higher system requirements – Does not work on devices that do not support virtualization or have limited RAM.
• Limited functionality in the isolated environment – Some extensions, features, and plugins may not work.
• Microsoft Edge only – Application Guard works exclusively with Microsoft Edge and cannot be used with other browsers such as Chrome or Firefox.

Conclusion

Microsoft Defender Application Guard is a powerful tool for improving security, especially for users and organizations that interact with untrusted web resources. Despite some limitations, its ability to isolate threats in a protected virtual environment makes it a valuable addition to any cybersecurity strategy. If your computer meets the requirements, enabling this feature can significantly reduce the risk of attacks.

MDAG protects only your device you by isolating potentially dangerous websites and preventing system infection,  but it does not completely hide your activities from the network administrator!