This week is back to Windows. This week is all about Microsoft Defender Application Guard (Application Guard). Recently Application Guard functionality was added to Microsoft 365 apps for enterprise and those configuration options recently became available in Microsoft Intune. A good trigger for a new post. Application Guard uses hardware isolation to isolate untrusted sites and untrusted Office files, by running the application in an isolated Hyper-V container. That isolation makes sure that anything that happens within the isolated Hyper-V container is isolated from the host operating system. That provides an additional security layer. This post will start with a quick introduction about Application Guard, followed with the steps to configure Application Guard by using Microsoft Intune.
Introduction to Microsoft Defender Application Guard
Application Guard itself is not something new. That functionality already existed for Microsoft Edge – even before Edge Chromium – and that functionality is now also added for Microsoft 365 apps for enterprise. Application Guard fits perfectly in the assume breach strategy, as that strategy also means that the next best thing is to contain the damage by protecting the corporate resources and data. That’s why Application Guard fits perfectly, as it can contain the damage within the isolated Hyper-V container. At this moment Application Guard can be used for the following:
- Microsoft Edge: Application Guard for Microsoft Edge helps isolating any enterprise-defined untrusted sites to make sure that users browse safely on the Internet. An IT administrator can define the trusted websites, cloud resources and internal networks. Everything that is not defined by the IT administrator is considered as untrusted. Once the user goes to an untrusted website – any location that’s not defined by the IT administrators – Application Guard will open the website in Microsoft Edge in an isolated Hyper-V container. That will make sure that when the user visits a website that is compromised or malicious, the local device is not affected. It stays contained in the isolated Hyper-V container.
Note: Application Guard is also available as an extension for Google Chrome and Mozilla Firefox. Those extensions, in combination with the Microsoft Defender Application Guard Companion app, provides the Application Guard functionality to those browsers. That makes sure that every untrusted website will open in Application Guard for Microsoft Edge.
- Microsoft 365 apps for enterprise: Application Guard for Microsoft 365 apps for enterprise helps preventing untrusted Word, PowerPoint and Excel files from accessing trusted resources. Once the user opens an untrusted file – basically any file that was opened before in the Protected View – Application Guard will make sure that the file will open in Word, PowerPoint, or Excel in an isolated Hyper-V container. That will make sure that when that file was malicious, the local device is not affected. It stays contained in the isolated Hyper-V container.
Important: Application Guard for Microsoft 365 apps for enterprise requires a Microsoft 365 E5 license or a Microsoft 365 E5 Security license.
Configuration of Microsoft Defender Application Guard with Microsoft Intune
The configuration of Application Guard can actually be performed by using different profiles. One being an Endpoint protection profile and another one being an Apps and browser isolation profile. The latest configuration options for Application Guard, are (currently) only available via an Apps and browser isolation profile. That profile type is part of the Attack surface reduction policy, in the Endpoint security node, and includes the configuration options to enable Application Guard for Microsoft Edge and to enable Application Guard for isolated Windows environments. The combination of those configuration options enables Application Guard for Microsoft Edge and any enabled application within Windows. The following eight steps walk through the required steps for configuring Application Guard.
Note: The steps below describe the steps for configuring Application Guard for the currently available technologies, being Microsoft Edge and Microsoft 365 apps for enterprise.
- Open the Microsoft Endpoint Manager admin center portal navigate to Endpoint security > Attack surface reduction to open the Endpoint security | Attack surface reduction blade
- On the Endpoint security | Attack surface reduction blade, click Create profile to open the Create a profile page
- On the Create a profile page, provide the following information and click Create to open the Create profile wizard
- Platform: Select Windows 10 and later as value
- Profile: Select Apps and browser isolation as value
- On the Basics page, provide the following information and click Next
- Name: Provide a name for the profile to distinguish it from other similar profiles
- Description: (Optional) Provide a description for the profile to further differentiate profiles
- On the Configuration settings page (as shown in Figure 1), provide the required configuration for the following settings and click Next
- Turn on Application Guard: Select Enabled for Edge AND isolated Windows environments as value, to turn on Application Guard for Microsoft Edge and Microsoft Office
- Clipboard behavior (Microsoft Edge only): Choose the clipboard behavior between the local device and the virtual Microsoft Edge browser
- Allow camera and microphone access (Microsoft Edge only): Specify if access to camera and microphone is allowed in the virtual Microsoft Edge browser
- Block external content from non-enterprise approved sites (Microsoft Edge only): Specify if content from unapproved websites from loading is blocked in the virtual Microsoft Edge browser
- Collect logs for events that occur within an Application Guard session: Specify to collect logs for events that occur within the virtual Microsoft Edge browser
- Allow user-generated browser data to be saved (Microsoft Edge only): Specify if user data that is created in the virtual Microsoft Edge browser is allowed to be saved
- Enable hardware graphics acceleration (Microsoft Edge only): Specify if the use of a virtual graphics processing unit is allowed in the virtual Microsoft Edge browser
- Allow users to download files onto the host (Microsoft Edge only): Specify if the download of files from the virtual Microsoft Edge browser to the local device is allowed
- Application Guard allow use of Root Certificate Authorities from the user’s device: Specify any required certificate thumbprints to automatically transfer the matching root certificate to the virtual environment
- Application Guard allow print to local printers: Specify if print to local printers is allowed in the virtual environment
- Application Guard allow print to network printers: Specify if print to network printers is allowed in the virtual environment
- Application Guard allow print to PDF: Specify if print to PDF is allowed in the virtual environment
- Application Guard allow print to XPS: Specify if print to XPS is allowed in the virtual environment
- Windows network isolation policy: Specify the Windows network isolation policy to define any trusted locations
Note: The last setting can be used to define which locations are automatically trusted by Application Guard. Any location that is not defined, will automatically be untrusted (see also the user experience section).
- On the Scope tags page, configure the required scope tags click Next
- On the Assignments page, configure the assignment to the required users and/or devices and click Next
- On the Review + create page, verify the configuration and click Create
User experience with Microsoft Defender Application Guard
Tip: When using a VM for testing Application Guard, make sure that the VM meets the minimal requirements. Also, make sure to configure nested virtualization and, if needed, to bypass the hardware requirements by using the documented registry keys.
The best method to look at the user experience with Application Guard, is by visiting different sites in Microsoft Edge. Below in Figure 2 is an example available. For that example, the IT administrator configured .petervanderwoude.nl as a trusted cloud resource, in the Windows network isolation policy. That configuration makes sure that every other website will automatically be untrusted and open in an isolated Hyper-V container. In Figure 2 is shown that the user navigated to bing.com and automatically got redirected to Application Guard for Microsoft Edge (as shown with number 1). That Microsoft Edge browser session is clearly running in a separate instance of Microsoft Edge (as shown with number 2). When the user would take a look in Task Manager, it would show running tasks for Microsoft Defender Application Guard and for a virtual machine.
Similar behavior is also applicable for Google Chrome and Mozilla Firefox, as long as the browser extension and the Microsoft Store app are installed. The user navigates to an untrusted website and the website will be opened in Application Guard for Microsoft Edge.
Note: From an IT administrator perspective, it also possible to check if Application Guard is enabled by verifying if the Microsoft Defender Application Guard windows features is turned on. Besides that simple check, the IT administrator can also check the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provide/Admin event log for information about the AllowAppHVSI policy and the Microsoft-Windows-WDAG-PolicyEvaluator-CSP/Operational event log for information about any policy changes.
Of course it’s also possible to look at the user experience with Application Guard by opening an untrusted file. An untrusted file is basically any file that was opened before in a Protected View. During the startup of the Office app, it will show that it will be opened in Application Guard. Once the file is opened, it will show similar Application Guard signs, as shown with Microsoft Edge. That means a notification on the top right of the screen and a small shield with the icon on the taskbar.
Note: The Office experience will not happen when the correct license is not in place. In that case a normal Office app will start with a banner regarding Application Guard that states “This feature is enabled but not all requirements are met”.
For more information about Microsoft Defender Application Guard and Microsoft Intune, refer to the following docs.
- Microsoft Defender Application Guard (Windows 10) – Windows security | Microsoft Docs
- Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs
- Application Guard for Office 365 for admins – Office 365 | Microsoft Docs
- Intune endpoint security Attack surface reduction settings | Microsoft Docs
14 thoughts on “Getting started with Microsoft Defender Application Guard”
Hi Peter. I found your page while looking for a solution to use WDAG on Win 10 PC’s that are connected to a company VPN. My isolated browser will only function when the VPN is disconnected. Do you have familiarity with this? Thanks
Do you mean that the isolated browser session is not using the VPN?
I’ve just enabled this, albeit with an Endpoint Protection profile, and found that in the isolated Edge, the IP address reported was my local WAN IP, but in the ‘normal’ Edge it reported the WAN IP of our company VPN which is always active.
Both browsers worked fine though.
Thanks for the article.
Allow users to download files onto the host doesn’t work for me. Just wondering if anyone has been able to get it to work?
In what way doesn’t that setting work for you?
Hi Peter, great article.
I ran into an issue on my test machine, everything is activated and working except the Office part.
In Intune it also reports my device to activate this feature even if it’s activated, Edge working etc. I do get the error in Word.
“This feature is enabled but not all requirements are met”.
According to your post this is a licensing issue, I would need a E5, I currently have a A5, I don’t see what license part I’m missing as they contain the same things but still not working.
Often it is indeed, but in this case I can only find docs referring to E5 variations. Nothing else.
Thank you for taking your time and answering this.
I will create a ticket with Microsoft asking them.
But would you then only activate the Edge isolation part, if i currently activate the Edge and Windows isolation then the user gets the banner in Word. Or is there any other reason for me to keep Windows isolation on also?
For the reporting part in security recommendations I can’t seem to solve this, everything is working as excepted on the test device but the security recommendations keeps reporting to turn this feature on. Have you had any similar issues?
In that cases you could first start with Edge only.
Think I found the issue on my test.
E5 contains Safe documents, that’s the part needed and it contains the A5 Safe documents part so license is covered.
But you actually need to activate Sage Documents for Office clients on the tenant.
Ah, great! Thank you for that update Jimmy. Much appreciated!
When attempting to share the root certificate thumbprint with the Application Guard browser using a custom ADMX OMA-URI the key is not created in the Registry. Can you please let me know if my settings are incorrect?
Name- Zscaler Root Certificate Thumbprint
Description- Enables sharing of thumbprint with Application Guard
Value- Thumbprint copied from root certificate
I think you’re using the wrong node. Your current OMA-URI doesn’t exist.