Prevent users from removing Application Guard protection on files.

Supported on: At least Windows Server 2016, Windows 10

Registry

HKCU software\policies\microsoft\office\16.0\common\security\applicationguard

Value name: disabletrustpromotion

Enabled: disabletrustpromotion = 1

Disabled: disabletrustpromotion = 0

Description

This policy setting allows you to control whether users can remove Application Guard protection and open a document with full trust in Office. If you enable this policy setting, users can continue to work with Office documents in Application Guard, however, they cannot remove protection and open a document outside Application Guard. If you disable or do not configure this policy settings, Office will by default allow users to remove protection and open a document with full trust. Note: This policy setting only applies to Microsoft 365 Apps for enterprise.