The protected folders include common system folders (including boot sectors), and you can add more folders. You can also enable the rules individually to customize what techniques the feature monitors. You can customize the notification with your company details and contact information. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder. In a ransomware attack, your files can get encrypted and held hostage. Why controlled folder access is importantĬontrolled folder access is especially useful in helping to protect your documents and information from ransomware. Additional actions can be performed from the Microsoft 365 Defender portal. Those apps are added to the list automatically.Īpps can also be added manually to the trusted list by using Configuration Manager or Intune. Apps that are highly prevalent throughout your organization and that have never displayed any behavior deemed malicious are considered trustworthy. Apps that are not included in the list are prevented from making any changes to files inside protected folders.Īpps are added to the list based upon their prevalence and reputation. Apps that are included in the list of trusted software work as expected. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders.Ĭontrolled folder access works with a list of trusted apps. Protected folders are specified when controlled folder access is configured. How does controlled folder access work?Ĭontrolled folder access works by only allowing trusted apps to access protected folders. However, you can view information about controlled folder access blocks in the device timeline view, while using advanced hunting, or with custom detection rules.

Controlled folder access blocks don't generate alerts in the Alerts queue.

Cannot access controlled folder access