Microsoft Aims for Windows 11 to be “Secure by Default” with Only Properly Signed Apps and Drivers Allowed

Microsoft Introduces Enhanced Security Measures for Windows 11

In a significant move towards bolstering security, Microsoft recently unveiled a per-app permission system for Windows 11, akin to the permission models utilized by Android. This initiative aims to establish a “secure by default”environment for the operating system. The forthcoming updates are expected to restrict the execution of applications and drivers to those that are properly signed. While this feature is still in the experimental phase, many anticipate a transition to this model in the near future, with the option for users to deactivate any new security enhancements.

For years, the Windows platform has been tasked with balancing flexibility and security. While its adaptability has always been a notable advantage, it has simultaneously exposed the OS to various security threats, particularly malware. In a blog post dated February 9, 2026, Microsoft acknowledged the growing concern that this balance has shifted unfavorably.

Logan Iyer, a Windows Platform Engineer, highlighted that users are increasingly encountering issues where applications bypass system protocols, introduce unwanted software, or alter core Windows functionalities without explicit permission.

Microsoft emphasized its commitment to an open platform while enhancing security measures.“Windows must both remain an open platform and be secure by default, ”stated the company in its Windows Experience Blog. Users desire robust protections without compromising compatibility, and the call for improved security resonates throughout both Microsoft’s development teams and their ecosystem partners.

The enhancements in Windows 11 are designed to ensure user control over applications and AI tools, providing transparency regarding their actions. Users will have the ability to reverse changes made by these applications and will grant access only to selected features.

This commitment underscores a “consent-first”approach, mandating that users of Windows 11 authorize AI interventions before granting them automation capabilities or access to sensitive information.

Interestingly, while earlier statements highlighted the potential risks posed by AI, including the phenomenon of ‘hallucination’ and vulnerabilities to malware, Microsoft is optimistic that the new security framework will foster user trust—a key objective for the company.

Invoking agent from Ask Copilot in Taskbar. Credit: Microsoft

Microsoft assures users that a commitment to app compatibility remains strong, promising developers comprehensive tools and resources necessary to comply with this significant security update.

Implementing Windows Baseline Security Mode

One of the most notable advancements in Microsoft’s security strategy is the emergence of Windows Baseline Security Mode. This groundbreaking framework will ensure that only signed applications, services, and drivers are allowed to operate on user systems by default, with runtime integrity safeguards enabled.

At present, Windows permits various unsigned software to function, contingent upon user approvals or by disabling specific safeguards, a practice commonly adopted by many users. Although this flexibility is beneficial, it remains a principal factor contributing to the prevalence of malware targeting the world’s most widely used desktop OS.

The introduction of Baseline Security Mode aims to address these issues fundamentally.

As reported in the Windows Experience blog, the new system will verify the integrity and signatures of software during execution. Should an application or driver fail to meet trust criteria, it won’t operate unless explicitly permitted by the user.

This constitutes a pivotal shift in comparison to current practices, which employ a mix of optional protections—including:

Smart App Control
Windows Defender Application Control (WDAC)
Hypervisor-Protected Code Integrity (HVCI)
Reputation-based blocking

App and browser control in Windows Security

Many of these protections remain disabled by default or are limited to specific hardware configurations, often only becoming active following a clean install. The integration of Baseline Security Mode aims to make these protective measures a fundamental part of the user experience.

Nevertheless, Microsoft maintains that Windows will not become a closed system. Users relying on legacy software or niche utilities will have the option to override these safeguards and enable their operation. IT administrators and advanced users can define exemptions for trusted applications.

Moreover, developers will not be left in the dark; applications will be capable of recognizing if Baseline Security Mode is enabled and whether any permissions have been granted, thus allowing software vendors to adjust their products accordingly.

If executed properly, most users may not even notice these changes, while harmful software is effectively mitigated.

A New Approach to Permission Management

Alongside the stricter execution guidelines, Microsoft is revamping the permissions framework within Windows, an initiative termed User Transparency and Consent. This paradigm shift draws inspiration from the permission models of mobile operating systems.

For the first time, Windows is adopting a uniform system-wide permission model, where applications will generate “clear and actionable”prompts when seeking access to sensitive resources such as files, the camera, or the microphone, or when attempting to install additional software.

This approach echoes practices established by iOS and Android for years.

Android phone asking permission to access the gallery

Just as mobile applications require permission to access the camera or read storage data, Windows will now enforce similar protocols. The new model ensures that these permission prompts are reversible, allowing users to review and modify permissions from a centralized hub later on.

This is a crucial development, as the traditional permissions framework in Windows has been fragmented across the Control Panel, Windows Settings, and app-specific configurations, often leaving users unaware of what permissions they have granted. The proposed changes will improve transparency in which applications can access sensitive information and allow users to withdraw access if necessary.

Integrating Baseline Security Mode for AI Features

While Microsoft is slated to reduce the prominence of Copilot within Windows, the development of AI capabilities continues. As Microsoft extends permissions to include a broader range of AI applications, especially third-party apps, stringent measures are needed to ensure these tools do not access sensitive files, monitor user activity, or install unauthorized components without explicit permission. The collaboration between Windows Baseline Security Mode and User Transparency and Consent aims to elevate security standards in preparation for the coming era of agentic AI.

Copilot on a Surface Laptop — Source: Microsoft

If developers adapt their applications to prioritize transparency, this will alleviate some of the pressure on Microsoft, ultimately building greater trust in Windows. This would encourage more users among the billion-strong Windows community to integrate AI into their daily workflows and tasks.

Collectively, both the Baseline Security Mode and User Transparency and Consent constitute one of the most significant structural overhauls of Windows security seen in recent years.

However, these changes will be introduced incrementally. Microsoft plans to test these features with partners and developers before rolling them out universally.

The Implications for Users, Developers, and Enterprises

While the new systems—Baseline Security Mode and User Transparency and Consent—represent major technical upgrades, Microsoft is proceeding cautiously. It is not transitioning to a restrictive environment overnight.

The rollout will occur in stages, beginning with enhanced transparency for users and IT administrators regarding app behavior, permissions, and access requests.

For developers, Microsoft reassures that existing compliant applications will continue functioning, with ample time and resources provided for adaptation to the new security model. The company is also developing new tools, APIs, and documentation to facilitate this transition.

Recognizing that the Windows ecosystem is still heavily reliant on legacy applications and specialized business tools that often cannot be rapidly modified, a gradual implementation approach aligns more closely with practical needs.

Enterprises could potentially realize significant resource savings from the introduction of Baseline Security Mode and the enhanced consent system, as IT administrators gain improved visibility into application operation, permissions usage, and potential risks on employee devices.

Endorsements for this initiative from prominent security vendors and software companies—such as 1Password, Adobe, CrowdStrike, OpenAI, and Raycast—demonstrate a broad consensus on the value of transforming Windows into a secure platform by default, alongside clearer consent frameworks.

Importantly, Windows will not forsake its identity as an open platform; users will retain the ability to install virtually any software, with developers still free to distribute beyond the Microsoft Store. Power users will continue to have the option to override restrictions as needed. However, these actions will now be carried out with heightened awareness and deliberation.

By enhancing user control and diminishing the risk of malware, Microsoft is working to align Windows with the security protocols seen in modern mobile platforms, all while preserving the operational flexibility that has been pivotal to its success.

If executed effectively, this could signal the conclusion of the traditional malware era.

Source&Images