Microsoft Defender Application Guard

This deprecation does not impact the existing installations of Microsoft Defender Application Guard (MDAG). Organizations can continue to use Application Guard on current versions of Windows, but we recommend that security admins evaluate their security requirements going forward. This feature might be removed in a future Windows release, but it will continue to be maintained for existing installations on Windows.
Deprecation considerations

Deprecation includes the following elements of Application Guard.

• If your organization requires container-based isolation, we recommend Windows Sandbox or Azure Virtual Directory (AVD).
• Because Application Guard is deprecated there won't be a migration to Edge Manifest V3. The corresponding extensions and associated Windows Store app won't be available after May 2024.This affects the following browsers: Application Guard Extension - Chrome and Application Guard Extension - Firefox. We recommend using AppLocker policies to prevent untrusted websites from loading in Chrome and Firefox.

Click to expand...

Microsoft Defender Application Guard for Office, including the Windows.Security.Isolation APIs, is being deprecated and no longer being updated.012 It is a security feature that works with Word, Excel, and PowerPoint for Microsoft 365 Apps, specifically catering to Windows 10 and Windows 11 Enterprise editions. The deprecation does not impact existing installations of Microsoft Defender Application Guard (MDAG). Microsoft recommends transitioning to Microsoft Defender for Endpoint attack surface reduction rules, Protected View, and Windows Defender Application Control as an alternative.3 The announcement came two years after Microsoft rolled out Application Guard for Office to all Microsoft 365 customers with eligible licenses and four years after its introduction as part of a limited preview in November 2019.

Click to expand...

Microsoft Edge and Microsoft Defender Application Guard

Microsoft Edge support for Microsoft Defender Application Guard

learn.microsoft.com

oldschool said:

I suppose you can use it with Edge and Office for the time being. You'll need the Edge extension until ManifestV3 is rolled out and then you need to wait for the MV3 extension versions to be rolled out in MS Store. I'd suggest using MS Defender Attack Surface Reduction rules for Office applications. You may enable them via group policy or via powershell.

Microsoft Edge and Microsoft Defender Application Guard

Microsoft Edge support for Microsoft Defender Application Guard

learn.microsoft.com

https://www.bleepingcomputer.com/news/microsoft/microsoft-deprecates-defender-application-guard-for-some-edge-users/

Click to expand...

very_452001 said:

What do you mean for the time being, its going to be phased out/obsolete soon you mean?

Click to expand...

andrew129260 said:

yes.....read the link they provided

Click to expand...

very_452001 said:

Just to clarify this only works in the Pro version of Windows?

Click to expand...

very_452001 said:

Okay how do I enable MS Defender Attack Surface Reduction in Powershell?

Click to expand...

Attack surface reduction rules reference - Microsoft Defender for Endpoint

Lists details about Microsoft Defender for Endpoint attack surface reduction rules on a per-rule basis.

learn.microsoft.com

Defender Module

Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

learn.microsoft.com

oldschool said:

Application Guard is only available in Windows Pro.

See references in the first link, as well as the other links below:
What does Windows Defender lack, what can’t it do?

Attack surface reduction rules reference - Microsoft Defender for Endpoint

Lists details about Microsoft Defender for Endpoint attack surface reduction rules on a per-rule basis.

learn.microsoft.com

Defender Module

Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

learn.microsoft.com

Click to expand...

very_452001 said:

Is MS Defender Attack Surface Reduction the same as MS Defender Application Guard?

Click to expand...

oldschool said:

No, it's an MS Defender advanced feature which includes rules pertaining to Office that provide extra security.

Click to expand...

very_452001 said:

can you kindly show me how do I enable this advanced feature please?

Click to expand...

oldschool said:

Please read the referenced links above. They provide the instructions.

Click to expand...

Install from Control Panel​

1. Open the Control Panel, select Programs, and then select Turn Windows features on or off.
   
   
2. Select the check box next to Microsoft Defender Application Guard and then select OK to install Application Guard and its underlying dependencies.

andrew129260 said:

Install from Control Panel​

1. Open the Control Panel, select Programs, and then select Turn Windows features on or off.
   
   
2. Select the check box next to Microsoft Defender Application Guard and then select OK to install Application Guard and its underlying dependencies.

Click to expand...

very_452001 said:

do you know how I can enable the MS Defender Attack Surface Reduction feature instead? I'm in MS Defender and cannot see that option even though I'm using Windows Pro.

Click to expand...

• Download ConfigureDefender
• Unzip the folder
• Read the readme. file.*
• Run ConfigureDefender.exe
• Become familiar with the GUI*
• Select your chosen Defender predefined settings, i.e. default, high or max.
• Depending on your choice of predefined setting, you may also enable or disable individual Exploit Guard settings you prefer

oldschool said:

You may use the Group Policy editor in Windows Pro. If you are unfamiliar with GP and have no wish to learn how to use it to enable Defender's advanced features, then do the following:

• Download ConfigureDefender
• Unzip the folder
• Read the readme. file.*
• Run ConfigureDefender.exe
• Become familiar with the GUI*
• Select your chosen Defender predefined settings, i.e. default, high or max.
• Depending on your choice of predefined setting, you may also enable or disable individual Exploit Guard settings you prefer

NB: If you select Max setting, make sure to unhide Windows Security Center!

*Make sure to follow these instructions.

Click to expand...

very_452001 said:

Do you have a link to provide a good starting point to learn Group Policy?

Click to expand...

very_452001 said:

Hi,

How do I just enable this without enabling/installing other features or does Microsoft Defender Application Guard depends/requires other features to be turned on and what are these other features?

Is it just for MS Edge browser or can it be used on any browser and if so how to us it on other browsers?

Is it just for MS apps?

Can it be used for MS Office installed on the machine? Like how does it work with MS office, for example you open up word and how does it protect the user using MS word?

Click to expand...

NormanF said:

Its been deprecated and removed from 24H2. You should install SRP and SmartScreen Block with Hybrid Hardening Light Configurator.

Click to expand...

very_452001 said:

Hi yes how do I do this please?

Click to expand...

NormanF said:

Download the exe and run it:

https://github.com/AndyFul/Hard_Configurator/blob/master/WindowsHybridHardening/WHHLight_Package_1004.exe

You can enable SWH and SmartScreen Block.

If you need to install legitimate software, you can turn them off.

Click to expand...