Managing Application Guard and Application Guard for Office

• Application Guard may protect data from novel malware and malicious sites that evade other filtering.
• Application Guard is a Windows 10 feature that opens untrusted Web sites and files in a hardware-isolated environment to limit damage from malware.
• Isolating some files requires a Microsoft 365 E5 Security or higher license.

Application Guard is a Windows 10 feature that safely opens untrusted Web sites and files in a hardware-isolated environment to protect corporate data and devices. For example, Edge can use Application Guard to isolate Web browsing. However, to isolate untrusted Office files, a Microsoft Office 365 E5 or Microsoft 365 E5 Security or higher license (E5) is required. Application Guard has advantages over similar or related features, such as the Windows 10 Sandbox to protect user data from attacks that use files as the vector.

Application Guard Overview

Microsoft Defender Application Guard (Application Guard) uses Hyper-V to open files in a hardware-isolated VM (sometimes called a sandbox or a container).