From 8f1bccb5fbadab4fe3f4ac0d673f1987ca063217 Mon Sep 17 00:00:00 2001
From: Magnus Jensen <magnus@fleetdm.com>
Date: Sat, 25 Oct 2025 19:57:22 -0300
Subject: [PATCH] add defender smartscreen windows CSP policies (#34428)

Adds 4 defender smartscreen policies, to enable notifying and one for
disabling automatic data collection.
---
 ...-collection-in-defender smartscreen-disabled.xml | 12 ++++++++++++
 ...efender-smartscreen-notify malicious-enabled.xml | 13 +++++++++++++
 ...er-smartscreen-notify-password reuse-enabled.xml | 13 +++++++++++++
 ...fender-smartscreen-notify-unsafe app-enabled.xml | 13 +++++++++++++
 4 files changed, 51 insertions(+)
 create mode 100644 docs/solutions/windows/configuration-profiles/automatic-data-collection-in-defender smartscreen-disabled.xml
 create mode 100644 docs/solutions/windows/configuration-profiles/defender-smartscreen-notify malicious-enabled.xml
 create mode 100644 docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-password reuse-enabled.xml
 create mode 100644 docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-unsafe app-enabled.xml

diff --git a/docs/solutions/windows/configuration-profiles/automatic-data-collection-in-defender smartscreen-disabled.xml b/docs/solutions/windows/configuration-profiles/automatic-data-collection-in-defender smartscreen-disabled.xml
new file mode 100644
index 0000000000..3cd713413d
--- /dev/null
+++ b/docs/solutions/windows/configuration-profiles/automatic-data-collection-in-defender smartscreen-disabled.xml	
@@ -0,0 +1,12 @@
+<Replace>
+    <!-- Disables automatic data collection for defender smartscreen -->
+    <Item>
+        <Meta>
+            <Format xmlns="syncml:metinf">int</Format>
+        </Meta>
+        <Target>
+            <LocURI>./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/AutomaticDataCollection</LocURI>
+        </Target>
+        <Data>0</Data>
+    </Item>
+</Replace>
\ No newline at end of file
diff --git a/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify malicious-enabled.xml b/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify malicious-enabled.xml
new file mode 100644
index 0000000000..04ba5e1396
--- /dev/null
+++ b/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify malicious-enabled.xml	
@@ -0,0 +1,13 @@
+<Replace>
+    <!-- Enable Defender SmartScreen to warn users if they type their work or school
+    password into a malicious scenario -->
+    <Item>
+        <Meta>
+            <Format xmlns="syncml:metinf">int</Format>
+        </Meta>
+        <Target>
+            <LocURI>./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyMalicious</LocURI>
+        </Target>
+        <Data>1</Data>
+    </Item>
+</Replace>
\ No newline at end of file
diff --git a/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-password reuse-enabled.xml b/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-password reuse-enabled.xml
new file mode 100644
index 0000000000..3e9db35895
--- /dev/null
+++ b/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-password reuse-enabled.xml	
@@ -0,0 +1,13 @@
+<Replace>
+    <!-- Enable Defender SmartScreen to warn users if reusing their work or school
+    password -->
+    <Item>
+        <Meta>
+            <Format xmlns="syncml:metinf">int</Format>
+        </Meta>
+        <Target>
+            <LocURI>./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyPasswordReuse</LocURI>
+        </Target>
+        <Data>1</Data>
+    </Item>
+</Replace>
\ No newline at end of file
diff --git a/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-unsafe app-enabled.xml b/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-unsafe app-enabled.xml
new file mode 100644
index 0000000000..06c926fadc
--- /dev/null
+++ b/docs/solutions/windows/configuration-profiles/defender-smartscreen-notify-unsafe app-enabled.xml	
@@ -0,0 +1,13 @@
+<Replace>
+    <!-- Enable Defender SmartScreen to warn users if they type their work or school password into
+    text editor apps -->
+    <Item>
+        <Meta>
+            <Format xmlns="syncml:metinf">int</Format>
+        </Meta>
+        <Target>
+            <LocURI>./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyUnsafeApp</LocURI>
+        </Target>
+        <Data>1</Data>
+    </Item>
+</Replace>
\ No newline at end of file