How to Completely Disable ‘SmartScreen PUA Protection’ via Group Policy in Microsoft Edge

Microsoft Defender SmartScreen in Microsoft Edge includes a specialized sub-module known as “Potentially Unwanted App” (PUA) protection. PUAs are applications that, while not strictly classified as malware (like ransomware or trojans), possess highly undesirable traits-such as adware, bundled bloatware, cryptominers, or software that aggressively alters browser settings. By default, Edge intercepts downloads that match its cloud-based PUA heuristic signatures. While excellent for general consumer security, there are specific scenarios-such as malware analysis labs, penetration testing environments, or legacy software deployments involving poorly coded but necessary proprietary installers-where this aggressive blocking mechanism actively breaks required workflows. In these heavily restricted, managed environments, administrators may require the browser to act as a strict conduit, deferring all application blocking to a dedicated Endpoint Detection and Response (EDR) agent rather than the browser.

This guide explains how to completely disable ‘SmartScreen PUA Protection’ via Group Policy in Microsoft Edge, forcing the browser to ignore potentially unwanted app signatures during file downloads.

Disable SmartScreen PUA Protection via Group Policy

To enforce a strict override that permanently disables PUA blocking globally, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge > SmartScreen settings

5. In the right-hand pane, locate the policy named Configure Microsoft Defender SmartScreen to block potentially unwanted apps.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By explicitly disabling this policy, we instruct the Edge rendering and download engine to permanently bypass the PUA URL reputation and payload hash checks, allowing all downloads regardless of their potentially unwanted status).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes require the browser to read the registry upon its next launch.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, launch Microsoft Edge and navigate to edge://settings/privacy. Scroll down to the “Security” section. You will observe that the toggle for “Block potentially unwanted apps” is completely greyed out and permanently switched to the “Off” position. A briefcase icon alongside a message stating “This setting is managed by your organization” will be displayed. The browser is now cryptographically bound to permit PUA downloads, ensuring uninterrupted workflows in specialized testing or legacy deployment environments.