Supported way to run a locally built application with Smart App Control enabled

Hi @Justin Youri Larocque ,

Thank you for detailed post.

With Smart App Control already On, and with registry and policy changes excluded, publicly trusted code signing is the practical path you can control for repeated local builds. SAC can also allow unsigned files that Microsoft’s cloud intelligence considers safe, so signing is not literally the only acceptance path. However, Microsoft documents no per-app “allow anyway” exception. Microsoft’s SAC FAQ

Microsoft explicitly supports testing directly with SAC in enforcement mode so Evaluation mode is not required. That is the option consistent with keeping your current protection enabled. SAC testing guidance

Your VerifiedAndReputableDesktop event identifies an enforcement block. Requested signing level 2 means the file must satisfy the application-control policy; validated level 1 means Windows treated it as unsigned for that decision. This alone does not establish that the application is malicious, and it does not predict whether the newer build will be accepted. Event interpretation

Before purchasing signing, verify:

• Certificate trust and purpose: Obtain a Windows Authenticode code-signing certificate chaining to a CA in Microsoft’s Trusted Root Program. Self-signed or privately trusted certificates do not meet that public-trust criterion. SAC’s desktop-app guidance does not specify EV as a requirement. SAC acceptance criteria
• Algorithm compatibility: Publicly trusted RSA signing is the conservative choice. The current SAC signing page supports RSA and ECC, but related App Control documentation still lists ECC limitations. Before choosing ECC, obtain confirmation for your exact Windows version and build.
• Individual eligibility and workflow: Confirm that the provider accepts individual developers in your country, what identity verification it requires, and whether its hardware-token or cloud-signing arrangement supports your build process.
• Complete application coverage: Sign each rebuilt output and ensure DLLs, helper executables, installers, and uninstallers also satisfy SAC. Verify signatures and test all relevant code paths under enforcement. Signing only the main executable may leave another component blocked. A valid signature does not override a malicious or potentially unwanted classification.

Microsoft’s Artifact Signing is an option if you qualify. Individual Public Trust enrollment is currently limited to the US and Canada. Its Private Trust and Public Trust Test profiles are not substitutes for publicly trusted signing. Eligibility · Trust models

You can try the newer build normally with SAC still On. If it is blocked, capture the exact file identified in event 3077 and correlate any 3089 signature events using the same Activity ID.

For product feedback, you can create a request on the FeedBack Hub.

• Select report a problem
• In category, select Smart App Control
• Fill in any necessary information
• Then Submit

If you found my investigation and direction of my support helpful, I’d really appreciate it if you could follow this guide so others with similar issue can benefit as well.  Thank you.

Smart App Control is already On on my Windows 11 PC, and Evaluation mode is not available in the Windows Security interface. I want to keep protection enabled and avoid registry or policy changes. What supported option is available in this situation? Is recognized code signing the only practical path for testing my locally built application without weakening the current protection?