Microsoft has announced a major shift in Windows security philosophy with the introduction of Windows Baseline Security Mode and User Transparency and Consent features, bringing smartphone-like permission controls to Windows 11.

A New Security Paradigm

Windows 11, which powers over a billion devices, is evolving to address growing concerns about apps overriding user settings, installing additional software, or altering core Windows experiences without proper consent. The new security model aims to balance openness with security-by-default protection.

Windows Baseline Security Mode

This new mode introduces runtime integrity safeguards that will be enabled by default. Key features include:

- Only properly signed apps, services, and drivers can run by default
- Protection against unauthorized system tampering
- User and IT administrator override capabilities for specific apps
- Developer visibility into protection status and granted exceptions

User Transparency and Consent

Following the smartphone model, Windows will now:

- Prompt users when apps try to access sensitive resources (files, camera, microphone)
- Notify when apps attempt to install additional software
- Provide clear, actionable prompts for permission management
- Allow users to review and revoke previously granted permissions
- Require higher transparency standards from apps and AI agents

Guiding Principles

Microsoft's approach is built on three core principles:

  1. System-enforced transparency: Users can see which apps have access to sensitive resources and revoke access as needed
  1. User-centric consent: Clear prompts for granting or denying app permissions, with the ability to change decisions later
  1. Thoughtful rollout: Phased implementation with developer tools and APIs to ensure smooth adoption without breaking existing well-behaved apps

Industry Support

The announcement has received endorsements from major technology companies:

- 1Password (Jacob DePriest, CISO): Praised the focus on transparency and security-by-default approach
- Adobe (Michael Draper, VP): Affirmed alignment with trust and ecosystem security
- CrowdStrike (Alex Ionescu, CTO): Welcomed the resilient runtime model for Windows applications
- OpenAI (Ari Weinstein): Emphasized importance of visibility and control as AI agents become more capable
- Raycast (Thomas Paul Mann, CEO): Expressed excitement about user transparency, especially for AI agents

What's Next

Microsoft plans a phased rollout developed in partnership with developers, enterprises, and ecosystem partners. The company is opening feedback channels for the broader community to help refine the implementation.

This represents a fundamental evolution in Windows security, bringing the platform in line with modern security expectations while maintaining its commitment to openness and compatibility.

Source: Windows Blog