How to Configure Microsoft Defender SmartScreen Using Microsoft Intune
Configure Microsoft Defender SmartScreen through Intune Settings Catalog to protect devices against phishing, malware, and malicious downloads, with override prevention settings.
- Difficulty
- Intermediate
- Time required
- 15 minutes
- Steps
- 6
- Platform
- Intune
- Last tested
- July 14, 2026
Table of contents
Quick Answer
Go to the stepsCreate a Settings Catalog profile. Enable AllowSmartScreen, EnableSmartScreenInShell, EnableAppInstallControl, and all three PreventOverride settings. Add Edge SmartScreen. Assign to devices.
- Create a Settings Catalog profile for Windows 10 and later.
- Enable all six SmartScreen MDM settings with override prevention.
- Add Edge SmartScreen settings.
- Assign to device groups.
- Verify via registry and edge://policy.
Intune > Devices > Manage devices > Configuration > Create > Settings catalogExpected result: SmartScreen blocks dangerous content. Users can't bypass warnings when override prevention is on.
Key takeaways
- Configure SmartScreen through Intune Settings Catalog with all six MDM settings enabled and override prevention on for both Shell and Edge.
Before you start
- Access
- Access to the Intune admin center at intune.microsoft.com with Intune Administrator role.
- Required roles
- Intune Administrator
- Required licenses
- Microsoft Intune Plan 1
- Environment
- Windows 10 (1703+) or Windows 11 enrolled in Intune. Pro or Enterprise editions.
- Vendor
- Microsoft
- Tested environment
- Verified against Microsoft Learn SmartScreen documentation, July 2026.
- Last tested
- Administrator permissions required
Warning: Shell and Edge SmartScreen are separate
Windows Shell SmartScreen doesn't protect Edge browsing, and vice versa. You need separate settings for each.
Note: Test with a pilot group first
Override prevention blocks users from proceeding past SmartScreen warnings. May affect legitimate unsigned apps. Test before broad deployment.
1Create a Settings Catalog profile
Create a Settings Catalog profile for SmartScreen settings.
Intune > Devices > Manage devices > Configuration > Create > Settings catalogIn Intune at intune.microsoft.com, go to Devices > Manage devices > Configuration > Create > New policy. Platform: Windows 10 and later. Profile type: Settings catalog. Name it Defender SmartScreen Protection.
Expected result: Settings Catalog interface opens with search bar.
Note
Settings Catalog provides all six SmartScreen MDM settings. Endpoint Security profiles have fewer options.
2Configure Windows Shell SmartScreen
Enable SmartScreen for File Explorer and app installations.
Click Add settings. Search SmartScreen. Enable AllowSmartScreen (master switch). Search Configure Windows Defender SmartScreen under File Explorer; set to Enabled with Warn and prevent bypass. Enable EnableAppInstallControl for app installation checks.
Expected result: Shell SmartScreen settings configured in the summary.
Note
Warn and prevent bypass is the strictest option. Start with Warn during pilot if concerned about blocking legitimate unsigned apps.
3Add Edge SmartScreen settings
Enable SmartScreen for Edge browsing with override prevention.
Click Add settings. Search SmartScreen under Microsoft Edge. Enable Configure Microsoft Defender SmartScreen, Prevent bypassing SmartScreen prompts for sites, and Prevent bypassing SmartScreen warnings about downloads. Optionally enable blocking potentially unwanted apps.
Expected result: Edge SmartScreen settings appear alongside Shell settings.
Note
Edge SmartScreen uses the Browser CSP, separate from Shell. Don't configure the same Edge settings in both Settings Catalog and Administrative Templates to avoid conflicts.
4Assign and deploy
Target the profile to devices and deploy.
Click Next past Scope tags. On Assignments, add a pilot device group. Review + create: verify all settings, then click Create.
Expected result: Profile shows Deploying or Succeeded within 15 to 30 minutes.
Note
Start with 10 to 20 pilot devices. Monitor for false positives before expanding.
5Verify SmartScreen on target devices
Confirm SmartScreen is applied and functioning.
Check registry: Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\System -Name EnableSmartScreen (value 1 or 2). Check Edge at edge://policy, search SmartScreen. Test by downloading an unsigned file; SmartScreen should warn and block with override prevention.
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableSmartScreen"Expected result: Registry shows SmartScreen enabled. edge://policy confirms settings. Warnings appear and can't be bypassed.
Note
Don't use EICAR to test SmartScreen. EICAR tests antivirus signatures, not SmartScreen reputation. Use Microsoft's SmartScreen demo pages or an unsigned test executable.
6Monitor and handle false positives
Track compliance and resolve blocked legitimate apps.
Intune > Configuration profiles > [profile] > Device statusIn Intune, review Device status (Succeeded, Error, Conflict, Not applicable). For blocked legitimate apps: sign with code-signing certificate, deploy via Intune as managed apps, or submit for review at Microsoft's portal.
For Edge issues check edge://policy. For MDM delivery errors check Event Viewer > DeviceManagement-Enterprise-Diagnostics-Provider.
Expected result: All devices Succeeded. False positives handled.
Note
Devices showing Not applicable are likely Windows Home or pre-1703. Verify edition and version.
How to Confirm SmartScreen Is Active
Confirm configuration
Verify Windows Shell SmartScreen at HKLM\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen. Verify Edge at edge://policy where SmartScreenEnabled shows true.
With override prevention, users see warnings but can't bypass them.
Normal result: SmartScreen blocks and warns. Override prevention active. Intune shows Succeeded.
Abnormal result: SmartScreen missing or bypassable. Check profile assignment, sync, and conflicts.
Warn only
Users can proceed past warnings
Less restrictive. Good for rollout.
Prevent bypass
Users can't proceed
Most secure. Blocks flagged content.
Shell + Edge
Complete SmartScreen coverage
Full protection.
Troubleshooting
SmartScreen warnings don't appear
Warning
Cause: Policy not synced or conflicting profile.
Check Device status in Intune. Force sync from Settings > Accounts > Access work or school > Info > Sync. Verify Windows 10 1703+ Pro/Enterprise.
Users can bypass SmartScreen warnings
Warning
Cause: PreventOverride settings missing or conflicting policy.
Verify all three PreventOverride settings are Enabled. Check edge://policy for Edge. Look for conflicting profiles.
Legitimate app blocked
Note
Cause: App unsigned or low reputation.
Sign with code-signing certificate. Deploy via Intune as managed app. Or submit for review at Microsoft's Defender Security Intelligence portal.
Edge SmartScreen not working but Shell is
Warning
Cause: Edge and Shell use separate CSPs.
Verify Edge settings are in the profile. Configure Microsoft Defender SmartScreen under Microsoft Edge must be Enabled. Check edge://policy.
Devices show Not applicable
Note
Cause: Windows Home or pre-1703.
SmartScreen MDM needs Windows 10/11 Pro or Enterprise, version 1703+. Home edition doesn't support these settings.
Frequently asked questions
Settings Catalog vs Endpoint Security for SmartScreen?
Settings Catalog provides all six SmartScreen MDM settings. Endpoint Security profiles offer fewer options. Use Settings Catalog for complete control.
Does SmartScreen protect Google Chrome?
Not natively. Microsoft offers the Defender Browser Protection extension for Chrome, which provides SmartScreen-like reputation checks. Install separately or deploy via Intune.
What Windows versions support SmartScreen MDM?
Windows 10 1703+ and all Windows 11. Pro or Enterprise edition required. Home edition shows Not applicable.
Warn vs Warn and prevent bypass?
Warn lets users click through. Prevent bypass blocks access entirely. Start with Warn during pilot to find false positives, then switch to prevent bypass.
How to handle false positives?
Sign apps with a code-signing certificate. Deploy via Intune as managed apps. Or submit for review at Microsoft's Defender Security Intelligence portal.
Conclusion
SmartScreen protects against phishing, malware, and unrecognized applications across Windows Shell and Edge. Both need independent configuration.
The most secure option enables Warn and prevent bypass, blocking users from proceeding past warnings.
Configure SmartScreen through Intune Settings Catalog with all six MDM settings enabled and override prevention on for both Shell and Edge.
Intune > Devices > Manage devices > Configuration > Create > Settings catalog > SmartScreenSources2
