Microsoft Defender Application Guard (MDAG) is being discontinued. If you relied on it to run untrusted applications in a virtualized environment, it’s a good time to switch to other options. Fortunately, there are plenty of MDAG alternatives, including Microsoft’s own tools and third-party options.
Best Microsoft Defender Application Guard alternatives
Test these Microsoft Defender Application Guard alternatives to determine whether they meet your needs.
- Windows Sandbox
- Microsoft Defender SmartScreen
- Azure Virtual Desktop (AVD)
- Sandboxie-Plus
- Kasm Workspaces
- Other noteworthy MDAG alternative tools.
1] Windows Sandbox
Windows Sandbox is a built-in Windows feature, and it is best used when you want to run a suspicious file. It uses hardware virtualization to create a tiny, lightweight version of Windows inside your actual computer. Also, every time you open it, you will get a 100% clean Windows with no access to your personal files, photos, or passwords.
To use it, open Windows Search, search for Turn Windows features on or off, and launch it. A small window will open up, just select Windows Sandbox from the available Windows features and reboot your computer.
2] Microsoft Defender SmartScreen
SmartScreen is another built-in feature, and it offers background protection while browsing or downloading. It works on a reputation-based system. Whenever you visit a site or download a file, SmartScreen checks it against a massive, real-time database of “known good” and “known bad” items. If it detects suspicious activity, it will display a red warning before allowing you to access the site.
You don’t need to enable this feature manually, as it is already built into your Edge browser. If you already use Edge as your default browser, you should be fine.
3] Azure Virtual Desktop (AVD)
You can also use AVD, which stands for Azure Virtual Desktop. While MDAG was a feature built into your local PC, AVD is a cloud-based solution. AVD is a secure virtual machine hosted in a data center and accessible remotely. To use AVD, you will need to connect to the virtual machine in Azure using Remote Desktop.
However, the downside of AVD is that it is not only expensive but also requires technical skills. Most regular users are better off with options like Windows Sandbox.
4] Sandboxie-Plus
Sandboxie-Plus is an open-source, evolved version of the original Sandboxie. It is the perfect solution for anyone who wants to run apps on Windows without letting them touch actual files or the registry. Sandboxie-Plus sits between your apps and your hard drive.
Whenever you run a program, Sandboxie prevents it from modifying your computer’s files; instead, it stores them in a temporary folder. When you close the app, all files in the temporary folder are deleted. It is best suited for people who want to test software or browse the internet securely.
5] Kasm Workspaces
Kasm is another powerful tool that uses Docker containers. Instead of running an app on your Windows computer, you stream the app from a server, either your own server or Kasm’s cloud.
Every session with Kasm happens in a fresh container, and when you log out, the container gets destroyed. It requires no installation. It also lets you access browsers and launch full Linux desktops, VS Code, and more. However, it is not a free solution.
6] Other noteworthy MDAG alternative tools
Other tools you can use:
- Enhanced Security Mode in Microsoft Edge
- Office Protected View
- Virtualization-Based Security (VBS) & Hyper-V Isolation
- VMware Workstation or VirtualBox isolation
- Microsoft Defender for Endpoint ASR Rules
- Sophos Endpoint
- FrontFace Lockdown Tool
- Windows Defender Application Control.
So those were a couple of both free and premium solutions to help you run isolated apps. Among them, Windows Sandbox stands as an ideal solution. Or if you want greater control, Sandboxie-Plus is a great choice as well.
Can MDAG alternatives be used on all editions of Windows, including Home?
Not every Microsoft Defender Application Guard replacement works on all Windows editions, so compatibility should be checked first. Windows Sandbox requires Windows Pro, Enterprise, or Education and hardware virtualization, so it isn’t available on Windows Home. Cloud-based options such as Azure Virtual Desktop and Kasm Workspaces don’t depend heavily on your Windows edition because the isolated environment runs remotely, but they may require a subscription or server setup.
Which MDAG alternative provides the highest level of security isolation for risky files or unknown apps?
For the highest level of security, remote or container-based solutions such as Azure Virtual Desktop or Kasm Workspaces keep risky apps off your PC entirely. For local use, Windows Sandbox provides strong, disposable VM-based isolation, while Sandboxie-Plus offers lighter containment. SmartScreen only blocks suspicious files and isn’t true sandboxing.
