Turn on SmartScreen with Intune and stop users clicking past it

Microsoft Defender SmartScreen checks websites and downloaded files against Microsoft's reputation data and warns the user before they open something known to be bad. By default, most users can click Run anyway or Continue to the unsafe site. This guide uses one Intune settings catalog policy to turn SmartScreen on in Windows and Microsoft Edge and remove those bypass buttons.

Before you start

You need at least the Policy and Profile Manager role in Intune.
The devices must be enrolled in Intune and running Windows 10 version 1703 or later, or Windows 11.
Create a small pilot group in Entra ID with a few test devices or users. You'll assign the policy there first.

Blocking the bypass means users cannot open a file or site that SmartScreen flags, even if it is genuine. Some in-house or niche apps have little reputation and may be blocked. Always test on a pilot group, and agree how users report a false positive before rolling out to everyone.

What the policy will set

These are Microsoft's recommended MDM settings for SmartScreen. All are set to 1 (enabled):

CSP setting	What it does
`SmartScreen/EnableSmartScreenInShell`	Turns on SmartScreen in Windows
`SmartScreen/PreventOverrideForFilesInShell`	Stops users ignoring warnings about malicious downloaded files
`Browser/AllowSmartScreen`	Turns on SmartScreen in Microsoft Edge
`Browser/PreventSmartScreenPromptOverride`	Stops users continuing to a site SmartScreen has flagged
`Browser/PreventSmartScreenPromptOverrideForFiles`	Stops users downloading a file SmartScreen has flagged

Step 1: Create the policy

Go to intune.microsoft.com and sign in.
Select Devices > Manage devices > Configuration.
Select Create > New policy. A panel opens on the right.
For Platform, choose Windows 10 and later.
For Profile type, choose Settings catalog, then select Create.
On the Basics tab, enter a Name such as WIN - SmartScreen - Enforce and a short Description, for example Turns on SmartScreen in Windows and Edge and blocks bypass. Select Next.

Step 2: Add the SmartScreen settings

On the Configuration settings tab, select Add settings. The settings picker opens on the right.
In the search box, type SmartScreen and select Search. You'll see several categories in the results.
Select the Smart Screen category (the Windows one). Tick Enable Smart Screen In Shell and Prevent Override For Files In Shell.
Back in the results, select the Browser category and tick Allow Smart Screen, Prevent Smart Screen Prompt Override and Prevent Smart Screen Prompt Override For Files.
Close the picker with the X at the top right. The settings now show on the page with default values.
Set each one to the enabled value (shown as Enabled, Allowed or Block depending on how the setting is worded). Hover over the i icon or select Learn more to open the CSP page and check you are matching the table above.
Select Next.

Display names in the picker can be worded a little differently from the CSP names, and Microsoft sometimes moves categories. If you can't find a setting, search for the CSP name instead, such as PreventOverrideForFilesInShell, and use Learn more to confirm it is the right one.

Step 3: Assign it to a pilot group

On Scope tags, leave the default unless you use scope tags. Select Next.
On Assignments, under Included groups, select Add groups and choose your pilot group. Select Next.
On Review + create, check the settings and select Create. The policy appears in the Configuration list.
On a pilot device, open Company Portal, go to Settings and select Sync so it picks up the policy straight away. Otherwise devices pick it up at their next check-in.

Check it worked

In Intune, go to Devices > Manage devices > Configuration and select your policy.
Look at the device status summary. Pilot devices should move to Succeeded. Select View report to see each device.
In the Configuration settings section of the policy, check the per-setting counts. Any Conflict means another policy (often a security baseline or an Edge profile) sets the same thing differently. Select the count to see which devices.
If nothing applies, go to Devices > Monitor > Assignment failures, select the policy, then the device, to see the failed setting and the error code.
On a pilot device, open Windows Security > App & browser control > Reputation-based protection settings. The SmartScreen switches should be on and greyed out, with a note that some settings are managed by your organisation.
In Edge on the pilot device, type edge://policy in the address bar. You should see the SmartScreen policies listed with a status of OK.

Roll out

Leave the pilot running for a week or so. If no genuine business sites or apps are blocked, add your wider device or user groups under Assignments. If something genuine is blocked, report it to Microsoft as a false positive rather than turning the bypass back on for everyone.

Sources

← All tutorials