Starting with Windows 11 Insider Preview Build 26220.7070, the Smart App Control feature has shed its most punishing restriction: once you turn it off, you can turn it back on again without reinstalling Windows. The change, delivered via optional update KB5070300 and rolling out through the 25H2 development stream, transforms a security guardrail that many users avoided entirely into a practical, day-to-day protection layer.

What Microsoft Changed

Until now, Smart App Control was a one-way door. If you disabled it — whether to run a false-flagged installer or simply because it got in the way — you could never re-enable it unless you performed a clean install or factory reset. Microsoft’s reasoning was sound: letting untrusted code execute defeats the purpose of a pre-execution blocker, and enabling it afterward wouldn’t retroactively undo the risk. But the rigidity made SAC unusable for anyone who occasionally needed to run unsigned or custom software.

The new toggle, available first in Insider builds and headed eventually to production, appears in Windows Security under App & browser control > Smart App Control settings. The familiar three states — Off, Evaluation, and On — remain, but now you can move between them freely. If Evaluation mode decides your device isn’t a good fit, you can manually switch to On. If a trusted app gets blocked, you can flip SAC Off, install it, then turn it back On.

Microsoft is delivering this through Controlled Feature Rollout, meaning not every Insider device sees the toggle immediately. The fix is part of the Windows 11 version 25H2 development builds, and the most authoritative source is the Insider blog post for KB5070300. As MakeUseOf reported, the change “finally removes that friction” and makes the feature “more approachable.”

Why This Matters

The old design created an impossible choice: accept permanent lock-in to a strict app‑control regime, or opt out forever. Most users chose the latter. Here’s what the toggle means for different audiences:

Home users: You can now flip SAC on during Evaluation mode without fear of breaking essential apps. If a favorite tool — like the earlier-reported Asus Armory Crate on gaming handhelds — gets blocked, you can temporarily disable SAC, run the installer, and turn protection back on. This lowers the barrier so much that SAC becomes a genuine “try it and see” feature instead of a scary system-level commitment.

Power users and gamers: You no longer face the “use it or lose it” dilemma. If you rely on modding tools, unauthenticated drivers, or niche open‑source utilities, you can momentarily disable SAC for a specific task, then re‑enable it. That convenience does come with a window of risk (more on that below), but it’s far better than a perpetual off state.

IT administrators: The toggle reduces pilot friction dramatically. Instead of requiring device reimaging every time an exception is needed, IT can now test SAC with small cohorts, document which apps cause blocks, and apply the “off‑and‑back‑on” workflow where appropriate. However, the absence of a per‑app allowlist and Group Policy controls means more manual oversight is required — this is an incremental step, not an enterprise‑ready lock.

The Ballad of Smart App Control

Smart App Control debuted with Windows 11 22H2, designed as a cloud‑backed, “guilty until proven innocent” execution guard. It consults Microsoft’s app‑intelligence graph, verifies digital signatures, and uses predictive models to block untrusted or novel binaries at launch. Importantly, it only becomes available on devices that started with a clean installation of 22H2 or later, and it enters an initial Evaluation phase that silently observes app usage before eventually either enabling enforcement or turning itself off to avoid disruptions.

The one‑way disable rule was a deliberate design choice. Microsoft argued that once a potentially malicious app had run, re‑enabling SAC would be meaningless; the system’s integrity was already compromised. But that “security through irreversibility” model clashed horribly with real‑world needs. Users and administrators alike complained that a single mis‑flagged installer — be it a vendor‑supplied driver, a legacy business tool, or even a signed but reputation‑light utility — could push them out of SAC forever.

Community feedback was loud and persistent. Reddit threads documented SAC blocking Asus Armory Crate on the ROG Ally, breaking functionality for a classic gamer‑oriented peripheral manager. Other users reported conflicts with AVDManage and various enterprise tools. These anecdotes, combined with insider testing, made it clear that without a way to recover from a false‑positive block, SAC would remain a niche curiosity rather than a broadly adopted defense.

The new toggle, first hinted at in the 25H2 Insider builds and now documented in KB5070300’s release notes, is Microsoft’s direct response to that feedback. It keeps SAC’s core protection model intact — cloud reputation checks, signature validation, and ML‑driven scoring — while letting users manage the feature’s lifecycle themselves.

How to Use the New Toggle (Without Shooting Yourself in the Foot)

The freedom to switch SAC on and off carries a clear responsibility: that toggling window is a security gap. If you disable SAC to run an installer, any malware packed alongside it, or even a dropper triggered during installation, will execute unimpeded while SAC is off. Use the toggle with care.

Here’s a practical workflow to minimize risk:

  • Start in Evaluation mode. If your device supports SAC, set it to Evaluation first. It won’t block anything, but it will tell you whether enforcement is a good fit. You can always switch to On later.
  • Prepare before disabling. If SAC blocks something you trust, don’t flip the switch immediately. Create a System Restore point or make sure you have a recent backup. Download the installer to a known location, and use signtool or a certificate viewer to verify the digital signature if you’re technically inclined.
  • Disable SAC only for the minimum time needed. Open Windows Security, go to App & browser control > Smart App Control settings, and set it to Off. Immediately run the installer. As soon as the install completes — and ideally after a quick full‑scan with Microsoft Defender or an offline scanner — re‑enable SAC. The longer SAC stays off, the larger your exposure.
  • Consider a sandbox. If you frequently need to run questionable installers, use a virtual machine or a dedicated test PC. That eliminates the need to toggle SAC on your main system entirely.
  • Stay updated. Since this toggle is still rolling out via Insiders and CFR, watch for announcements about production availability and any additional controls (like Group Policy or per‑app exceptions) that may come later.

These steps are not a guarantee — nothing replaces sound security hygiene — but they help you use the toggle responsibly.

What’s Still Missing

The new toggle fixes the most glaring usability flaw, but several gaps remain:

  • No per‑app allowlist. You still cannot mark a specific installer or binary as trusted while keeping SAC enforced globally. The toggle is all‑or‑nothing. To run a false‑positive app, you must lower the shield for the entire system, even if only for a few minutes. This is less convenient — and more error‑prone — than a curated list of exceptions.
  • Limited enterprise controls. There are no dedicated Group Policy, Intune CSP, or enterprise‑grade management settings for SAC. IT teams can’t push exception lists, enforce SAC state via policy, or audit toggling events in a compliant way. For large organizations, the toggle is a helpful workaround but not a deployable solution.
  • Dependency on optional diagnostic data. SAC requires certain telemetry to function. If your organization restricts optional diagnostic data, SAC may never appear as an option. Microsoft’s FAQ explicitly lists this limitation, so check your device’s diagnostic settings (Settings > Privacy & security > Diagnostics & feedback) if the toggle is missing.
  • No built‑in block explanation. When SAC stops an app, the dialog tells you it was blocked, but it doesn’t reveal why — was it an unsigned binary, a low reputation score, or a signature chain issue? That missing context forces users to guess whether disabling SAC is safe.
  • False positives still happen. Even with the toggle, SAC’s predictive models and signature checks will occasionally block legitimate, signed software. The community examples (Asus Armory Crate, AVDManage) are not isolated incidents. Improved transparency and a user‑facing appeal mechanism would go a long way toward making SAC more trustworthy.

What Comes Next

The ability to toggle Smart App Control signals that Microsoft is willing to ease rigid security UX when community pain is loud enough. Future Insider builds may bring per‑app exceptions, clearer block dialogs, and policy hooks — but none of those are confirmed yet. For now, the change lowers the barrier for everyday users to try SAC, and it gives power users and IT teams a long‑overdue escape hatch. The next chapters will determine whether SAC becomes a true mainstay of Windows 11’s defense‑in‑depth strategy or remains an opt‑in curiosity for the security‑conscious few.