[Inquiry] Repeated False Positive Blocking by CFA (Controlled Folder Access)

1. WDSI submissions focus on malware/PUA classification (false positives/negatives for threats), not on CFA (Controlled Folder Access) behavior. Submitting to WDSI and getting “No threats detected” only confirms that the file is not classified as malware; it does not directly change CFA allow/block decisions. So CFA false positives are generally not resolved via standard WDSI malware submissions alone.
2. The provided context only documents these official channels for false positives/negatives:
   • Submitting files, hashes, or diagnostic data for malware analysis via the Microsoft Security Intelligence submission site and related Defender for Endpoint workflows.
   • Reporting missed or wrongly detected items in Microsoft Defender XDR and Defender for Office 365.
   • Submitting files when Windows Defender Antivirus incorrectly flags or misses malware.
   None of the referenced documentation describes a separate, dedicated submission or escalation channel specifically for CFA false positives distinct from the normal Defender/WDIS submission paths. Based on the available information, CFA-related issues are handled through the same general submission and feedback mechanisms used for Defender false positives/negatives (file submission plus feedback), not via a special CFA-only portal.
3. From the available documentation, the actionable options for a software vendor are:
   • Continue submitting new versions as needed:
     • Use the Microsoft Security Intelligence submission site to submit each new build when it is blocked, including hashes and supporting diagnostic data (such as MpSupportFiles.cab) as described in the Defender for Endpoint false positive/negative guidance.
     • This ensures Microsoft security researchers can analyze each version and adjust protection logic where appropriate.
   • Encourage customers (especially enterprise customers) to use Defender for Endpoint controls:
     • In Defender for Endpoint environments, security admins can create custom indicators (for example, for the file or signer) with an Allow action so that the application is treated as safe on managed devices. This is the documented way to prevent recurring false positives for files, IPs, URLs, or domains that are known to be safe.
   • Use feedback channels when Defender on Windows clients misclassifies files:
     • When Windows Defender Antivirus or related protections (including unwanted software or suspicious behavior) incorrectly classify a file, users can submit that file for malware analysis via the documented “Submit a file for malware analysis” and “submit the files to Microsoft” flows.
   The context does not describe any additional developer-specific knobs (for example, special signing programs or pre-registration) that would bypass or pre-approve new versions for CFA. Beyond maintaining a reputable, consistently signed product and using the submission and feedback mechanisms, the only additional mitigation explicitly documented is for enterprise admins to configure allow rules/indicators for known-good software so that users are not repeatedly impacted while trust builds over time.

References:

• Address false positives/negatives in Microsoft Defender for Endpoint
• Address false positives or false negatives in Microsoft Defender XDR
• Troubleshoot problems with detecting and removing malware
• Protect your PC from unwanted software
• What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams