First check your Windows version: Microsoft Defender Application Guard (MDAG) is unavailable starting with Windows 11, version 24H2. The steps below apply only to supported legacy installations; they cannot add MDAG to Windows 11 24H2 or later. Microsoft has deprecated MDAG for Edge for Business and says it will no longer be updated. See Microsoft’s current lifecycle and Edge security guidance.
Check whether your PC can run Application Guard
Microsoft’s requirements for Microsoft Defender Application Guard list these hardware prerequisites:
- A 64-bit processor with at least four logical processors.
- Second Level Address Translation (SLAT) and Intel VT-x or AMD-V virtualization extensions.
- At least 8 GB of RAM and 5 GB of free disk space.
- An SSD is recommended; IOMMU support is recommended but not required.
- ARM64 devices are not supported.
The listed Windows editions are Windows 10 Enterprise or Education, version 1809 or later; Windows 10 Pro, version 1809 or later, for standalone mode only; Windows 11 Education or Enterprise; and Windows 11 Pro for standalone mode only. However, Microsoft’s lifecycle notice takes precedence: MDAG is unavailable starting with Windows 11, version 24H2. The requirements page was last updated April 15, 2025.
Microsoft does not officially support MDAG on virtual machines (VMs) or virtual desktop infrastructure (VDI). Its installation guidance describes nested virtualization for testing or automation on nonproduction machines, but cautions that the security promise may not hold in VM or VDI environments. Do not treat that testing route as production support.
Recommended Free Tools
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Choose how Application Guard should work
Standalone mode
Standalone mode lets a user open an isolated Edge session manually. Microsoft lists Windows 10 Pro and Windows 11 Pro for this mode, subject to the Windows 11 24H2 availability cutoff.
Enterprise-managed mode
In managed mode, an organization defines trust boundaries and policies. Admins can specify trusted domains that open on the host; browsing to sites outside the trusted or neutral lists can be redirected into the isolated environment. The organization’s configuration determines which sites are trusted. Microsoft documents management through Intune and other organization-wide management solutions, including Configuration Manager, Group Policy, or MDM. See Microsoft’s enablement guidance and policy and security overview.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Turn on Application Guard on a supported Windows installation
Use one of these documented routes. Save your work first: each route requires a restart to complete installation.
Windows Features
- Open Control Panel → Programs → Turn Windows features on or off.
- Select Microsoft Defender Application Guard, then select OK.
- Restart Windows when prompted.
PowerShell
- Open PowerShell as an administrator.
- Run
Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard. - Restart Windows to finish installation.
Microsoft cautions that this command can install the feature without checking whether the device meets its requirements, so confirm the prerequisites before running it.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Organization-managed deployment
If your organization manages the device, ask its administrator to deploy or configure the Application Guard profile through Intune or the organization’s management system. Managed behavior depends on the organization’s policies; enabling the Windows feature alone does not define trusted sites or the data-transfer rules.
What happens when you browse, and what can policies change?
In Microsoft’s testing example, a site on the trusted-domain list opens on the host. A site outside the trusted or neutral lists is redirected to the hardware-isolated environment. That is an example of a configured deployment, not a universal default for every MDAG installation.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Isolation does not mean every control has one fixed state. Microsoft documents policies for these areas:
- Clipboard: controls copying and pasting between the host and container. Microsoft’s testing material describes the default as blocking transfers between them.
- Printing: can be governed by policy; Microsoft’s testing material describes printing from the container as blocked by default.
- Persistence: determines whether data survives between sessions. On Windows 11 version 22H2, persistence was disabled by default; when persistence is not allowed, recycling a session removes generated data such as cookies and favorites.
- Downloads: policy controls whether files can be moved from the container to the host.
- Hardware and certificates: policies can control hardware-accelerated rendering, camera and microphone access, and root-certificate sharing.
Defaults and available controls can vary by policy and Windows release. Consult Microsoft’s Application Guard policy overview for the relevant managed configuration rather than assuming a setting is enabled or blocked.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
Why is Windows Defender Application Guard missing?
If the PC runs Windows 11, version 24H2 or later, the feature is unavailable by design; looking for it in Windows Features or trying the PowerShell command will not restore it. On an older, potentially supported release, check the Windows edition and hardware prerequisites above. For organization-managed use, confirm with the administrator whether the feature and its policies are deployed.
What to use instead on Windows 11 24H2 or later
Microsoft recommends evaluating Windows Sandbox or Azure Virtual Desktop (AVD) when container-based isolation is still required. Microsoft names these options but the cited guidance does not rank them or establish that either reproduces MDAG’s exact behavior. Choose based on your deployment needs and verify current capabilities, management requirements, and licensing in the relevant Microsoft documentation.
For Edge protection outside MDAG, Microsoft also identifies Defender SmartScreen, Enhanced security mode, website typo protection, and Data Loss Prevention. These are alternative or complementary security capabilities, not a guarantee of the same isolation boundary as Application Guard. See Microsoft’s Edge and Application Guard overview.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
