Distributing a firmware update utility: SmartScreen and Smart App Control requirements on Windows 11

Yuhsuke TODA 0 Reputation points
2026-09-10T05:55:54.1233333+00:00

We manufacture a device called Solamente-Z and plan to distribute a Windows desktop application that allows customers to update its firmware using their own PCs.

The application has been used on our older company PCs. However, we have not yet verified whether customers running current Windows 11 configurations will encounter Microsoft Defender SmartScreen warnings or Smart App Control blocks.

This is a pre-distribution inquiry, not a report of a confirmed malware detection. Our users are limited to owners of the device, so the application may have relatively few downloads.

We would appreciate guidance on these three points:

What code-signing and distribution methods does Microsoft recommend for this type of firmware update utility? Please distinguish the requirements for SmartScreen from those for Smart App Control.

What pre-release tests or review processes are available to check compatibility with both protections? In particular, is the Microsoft Security Intelligence file submission portal appropriate for this preventive inquiry, or only for reviewing specific detections?

For a legitimate application with a small user base, what supported options are available to minimize reputation-based warnings? We would like customers to install and run the utility without disabling Windows security features.

We understand that code signing alone may not eliminate SmartScreen warnings. Please point us to current official guidance and, if this question requires a different support channel, the appropriate contact.

Thank you.

Windows for home | Windows 11 | Security and privacy
0 comments

3 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-10T05:56:24.3166667+00:00

    For this scenario, Microsoft’s current guidance is:

    1. Preferred distribution and signing
      • Microsoft Store (MSIX) is the most reliable way to avoid SmartScreen warnings entirely.
      • If distributing a Store MSI/EXE installer, the installer must be Authenticode-signed before submission.
      • For distribution outside the Microsoft Store, recommended signing options are Azure Artifact Signing or an OV certificate from a CA in the Trusted Root Program. Microsoft’s guidance notes that reputation still builds over time for these options, so initial SmartScreen warnings can still occur.
      • EV certificates no longer provide an instant SmartScreen bypass.
      • Unsigned or self-signed public installers are not recommended for public distribution.
    2. SmartScreen vs. Smart App Control
      • SmartScreen is reputation-based for downloaded apps and installers. It uses signals such as download traffic, download history, past antivirus results, and URL reputation. A legitimate but low-volume utility can still be treated as unknown and show a warning until reputation develops.
      • Smart App Control is separate. On Windows 11, it blocks malware, potentially unwanted apps, and unknown unsigned code by default. If Microsoft’s app intelligence cannot make a prediction, Smart App Control can still allow the app if it is signed with a certificate issued by a CA within the Trusted Root Program.
      • On Windows 11 devices, Smart App Control may supersede SmartScreen Application Reputation. Its signature checks apply to all executable files, not only files downloaded from the internet.
    3. How to minimize warnings for a small user base Supported options in current guidance are:
      • Publish through the Microsoft Store where feasible.
      • Sign every release.
      • Do not modify signed files after signing, because that can break the signature.
      • Use a consistent signing identity, because changing certificates affects publisher trust signals.
      • Do not sign software that exhibits malicious or potentially unwanted app behavior, because the certificate can develop negative reputation.
      • For new or low-download apps, Microsoft explicitly recommends communicating with early adopters that they may see a SmartScreen prompt initially and should verify the publisher and source before proceeding.
    4. Pre-release testing and review
      • For Smart App Control, Microsoft recommends testing the app’s signature before distribution and testing all code paths and features, including install, uninstall, and integrations that load binaries. Testing can be done with audit policies to generate logs without blocking, or by testing directly in enforcement mode.
      • For SmartScreen, the available review path in the provided guidance is for a specific warning or block already shown. If a warning or block is believed to be incorrect, a file can be submitted for review and Microsoft Defender SmartScreen should be selected from the product menu.
      • The developer FAQ also states that Microsoft does not accept requests for a “known list” or false-positive prevention program for developers. It advises submitting the file in question as a software developer and waiting for a final determination if there is a detection dispute.
    5. Whether the file submission portal fits this preventive inquiry Based on the documented guidance, the submission portal is intended for cases where:
      • a warning or block was incorrectly shown, or
      • an undetected file is believed to be malware.
      It is not described as a preventive pre-approval or reputation-seeding channel for a legitimate new utility before distribution.
    6. Practical conclusion for a firmware updater For a legitimate firmware update utility with a limited audience, the supported path to reduce friction without asking customers to disable protections is:
      • Prefer Microsoft Store distribution if feasible.
      • Otherwise, distribute a consistently signed installer using a certificate chaining to a Trusted Root Program CA.
      • Test the signed binaries against Smart App Control before release.
      • Expect that SmartScreen reputation may still need time to build for a low-download app, even when properly signed.
      • If a specific file is later warned on or blocked incorrectly, use the file submission process for review.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Yuhsuke TODA 0 Reputation points
    2026-09-10T06:06:01.67+00:00

    Thank you for the AI-generated summary. Could a Microsoft staff member or a community expert review this guidance for our specific scenario, particularly whether any pre-distribution review is available for a low-volume firmware update utility?

    If this requires a paid support request, please advise which support product and category we should select.

    Was this answer helpful?

    0 comments
  3. Vikki-T 10,185 Reputation points Microsoft External Staff Moderator
    2026-09-10T10:25:45.6866667+00:00

    Hi Yuhsuke TODA,

    Thank you for clarifying what you need.

    Please also note that this is a user-to-user support forum. Contributors and moderators cannot review or approve your application, access Microsoft’s reputation systems, or confirm which paid support category should be selected for your organization.

    For case-specific guidance, I recommend contacting Windows Developer Support. On that page, select Contact us and review the paid technical support options. Since your utility is a Windows application used to update device firmware, you can describe both the application and hardware aspects of the request. The support intake team can then confirm whether App Platforms or Devices & Tools is the appropriate category, or redirect the case if necessary. Please note that paid technical support may require a Microsoft support contract.

    You may also refer to Microsoft’s official guidance for testing an application with Smart App Control: Test your app’s signature with Smart App Control

    When contacting support, it would be helpful to include the intended package format, such as EXE, MSI, or MSIX, the signing method being used, and how the application will be distributed. Avoid posting the installer, certificate details, or other confidential development information publicly on the forum. Thank you so much for your understanding.   

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.