STIGQter: STIG Summary: Microsoft Edge Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

The list of domains for which Microsoft Defender SmartScreen will not trigger warnings must be allowlisted if used.

DISA Rule

SV-235722r960852_rule

Vulnerability Number

V-235722

Group Title

SRG-APP-000073

Rule Version

EDGE-00-000004

Severity

CAT III

CCI(s)

• CCI-000870 - Check media containing diagnostic and test programs for malicious code before the media are used in the system.

Weight

10

Fix Recommendation

The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure the list of domains for which Microsoft Defender SmartScreen will not trigger warnings" may be set to "allow" for allowlisted domains.

Check Contents

If this machine is on SIPRNet, this is Not Applicable.

This requirement for "SmartScreenAllowListDomains" is not required; this is optional.

The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings" may be set to "allow" for allowlisted domains.

Use the Windows Registry Editor to navigate to the following key:
HKLM\SOFTWARE\Policies\Microsoft\Edge

SmartScreenAllowListDomains may be set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\1 = mydomain.com
HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\2 = myagency.mil

If configured, the list of domains for which Microsoft Defender SmartScreen will not trigger warnings may be allowlisted.

Vulnerability Number

V-235722

Documentable

False

Rule Version

EDGE-00-000004

Severity Override Guidance

If this machine is on SIPRNet, this is Not Applicable.

This requirement for "SmartScreenAllowListDomains" is not required; this is optional.

The policy value for "Computer Configuration/Administrative Templates/Microsoft Edge/SmartScreen settings/Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings" may be set to "allow" for allowlisted domains.

Use the Windows Registry Editor to navigate to the following key:
HKLM\SOFTWARE\Policies\Microsoft\Edge

SmartScreenAllowListDomains may be set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\1 = mydomain.com
HKLM\SOFTWARE\Policies\Microsoft\Edge\SmartScreenAllowListDomains\2 = myagency.mil

If configured, the list of domains for which Microsoft Defender SmartScreen will not trigger warnings may be allowlisted.

Check Content Reference

M

Target Key

5280