How to Completely Disable ‘SmartScreen’ (Microsoft Defender SmartScreen) for Microsoft Store Apps via Group Policy in Windows 11

SmartScreen (Microsoft Defender SmartScreen) for Microsoft Store Apps is a specialized security feature that checks URLs accessed by Universal Windows Platform (UWP) and Store applications against a cloud-based list of reported malicious websites. While beneficial for general consumer safety, SmartScreen for Store Apps represents a significant operational security (OPSEC) and compliance risk in strict enterprise, military, or zero-trust deployment environments. If active, every URL requested by a Store app triggers telemetry transmission to Microsoft’s servers. In air-gapped networks, environments handling highly classified data, or systems utilizing a dedicated, hardware-level Secure Web Gateway (SWG) for traffic inspection, allowing Windows 11 to independently phone home for URL reputation checks violates data sovereignty and introduces unnecessary latency/DNS queries.

This guide explains how to completely disable ‘SmartScreen for Microsoft Store Apps’ via Group Policy in Windows 11, enforcing a strict zero-trust model where the OS is cryptographically prevented from utilizing Microsoft’s cloud reputation service for UWP traffic.

Disable SmartScreen for Store Apps via Group Policy

To enforce a strict block that permanently neutralizes this specific SmartScreen telemetry globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer

5. In the right-hand pane, locate the policy named Configure Windows Defender SmartScreen. (Note: Although located under Explorer, this specific policy node dictates the overarching behavior for app-based SmartScreen).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled (Note: We enable the policy to assert a specific restrictive state).
8. In the Options pane below, click the drop-down menu and select Off. (By explicitly configuring this policy to “Off”, we instruct the Windows kernel and networking stack to completely sever the telemetry connection to the SmartScreen reputation cloud for all local and Store applications).
9. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting Windows Defender and network telemetry require the system to restart or the policy to be forced.

Open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, open the Windows Security app and navigate to App & browser control > Reputation-based protection settings. The toggle for “SmartScreen for Microsoft Store apps” will be locked in the “Off” position, and a message stating “This setting is managed by your administrator” will be displayed. Furthermore, monitoring outbound DNS traffic via Wireshark or your firewall will confirm that Microsoft Store apps no longer generate `smartscreen.microsoft.com` queries prior to establishing connections. The workstation is now cryptographically bound to a strict, non-reporting networking state.