Policy

Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user’s device

Microsoft Windows

Back to Microsoft Defender Application GuardBack to main
Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user’s device
Jump to overview

Policy overview

Key metadata and intent for this policy.

Computer
Category
Windows Components > Microsoft Defender Application Guard
Supported on
Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode

Supported OS tags: Windows10

This policy setting allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container. If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. Multiple certificates can be specified by using a comma to separate the thumbprints for each certificate you want to transfer. If you disable or don’t configure this setting, certificates are not shared with the Microsoft Defender Application Guard container. Example: b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924

Internal name
AppHVSI_CertificateThumbprints
Policy ID
4f1afd3d46fb
Elements
1

Registry values

How enabled and disabled states update the registry.

No explicit registry values are set for enabled or disabled states.

Policy elements

Inputs and configuration options exposed by this policy.

ScopeElementTypeRegistry mappingConstraints & behaviorCopy
Computer
Thumbprints of the certificates to share
ID AppHVSICertificateThumbprints_TextBox
text
Path
SOFTWARE\Policies\Microsoft\AppHVSI
Value name
CertificateThumbprints
Type
REG_SZ
None
Thumbprints of the certificates to share
Computer · Type text
Registry mapping
Path
SOFTWARE\Policies\Microsoft\AppHVSI
Value name
CertificateThumbprints
Type
REG_SZ
DetailsNone