--- title: Controlled Folder Access Policy Creation description: This guide will provide background information on creating a controlled folder access allowance that will only allow trusted apps to access the specified folder. --- [Skip to content](https://knowledge.sittadel.com/controlled-folder-access-policy-creation#main-content) [![Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent copy](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png?width=55&height=55&name=Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png)](https://sittadel.com/) - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) Open main navigation Close main navigation - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) - [Get Sittadel](https://sittadel.com/start/) [Get Sittadel](https://sittadel.com/start/) Find answers to your security questions. - There are no suggestions because the search field is empty. 1. [Sittadel Knowledge Base](https://knowledge.sittadel.com/?hsLang=en) 2. [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en) 3. [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune) # Controlled Folder Access Policy Creation ## This guide will provide background information on creating a controlled folder access allowance that will only allow trusted apps to access the specified folder. ### **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Jan-19-2024-04-04-16-2156-PM.png?width=125&height=133&name=image-png-Jan-19-2024-04-04-16-2156-PM.png)Role Requirements** Procedure Scope: **Administrators** Required Group Membership: **Admin.Security** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Jan-19-2024-04-29-09-3760-PM.png?width=670&height=5&name=image-png-Jan-19-2024-04-29-09-3760-PM.png)** **Creating a Device Controlled Folder Access Rule** 1. Navigate to the [Attack Surface Reduction – Intune](https://intune.microsoft.com/#view/Microsoft_Intune_Workflows/SecurityManagementMenu/~/asr) portal, locate and select **Create Policy.** A pop-out will be generated where you will specify the **Operating System Platform** scope as **Windows** and the **Profile Type** as **Attack Surface Reduction Rules.** Select **Create** to proceed. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-05-11-6614-PM.png?width=670&height=359&name=image-png-Nov-03-2024-07-05-11-6614-PM.png) 2. You will supply basic identification information such as the **Name** and **Description** for the policy. Select **Next** to proceed. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-05-59-7905-PM.png?width=670&height=359&name=image-png-Nov-03-2024-07-05-59-7905-PM.png) 3. All the configuration items related to the **Attack Surface Reduction Rules** profile type will be listed. Select the **Enabled Controlled Folder Access** drop down and set it to **Enabled,** then select the **Add** button below the **Controlled Folder Access Protected Folders.** A text box will be generated where you can specify the necessary folder path. Select **Next** to continue. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-06-24-7322-PM.png?width=670&height=360&name=image-png-Nov-03-2024-07-06-24-7322-PM.png) 4. Scope tag selection can be utilized if desired, it is mainly leveraged with RBAC. Select **Next** to continue. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-09-18-3917-PM.png?width=670&height=360&name=image-png-Nov-03-2024-07-09-18-3917-PM.png) 5. You will be able to configure **Group Assignments** or **Exclusion** for the policy, this section will outline the selected groups that will be in scope to have the profile deployed. Select **Next** to proceed to revisions. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-15-15-9502-PM.png?width=670&height=359&name=image-png-Nov-03-2024-07-15-15-9502-PM.png) 6. The review page will allow you to see all configured settings for the policy, if you detect a discrepancy at this stage make note of the section and select **Back** to go to the previous sections to make the necessary alterations before finalization. If everything checks out, select **Save** to publish the device control rule. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-15-33-9810-PM.png?width=670&height=359&name=image-png-Nov-03-2024-07-15-33-9810-PM.png) 7. Upon successful creation the rule will show up in the list of all attack surface reduction policies managed through Intune. ![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Nov-03-2024-07-15-50-5041-PM.png?width=670&height=360&name=image-png-Nov-03-2024-07-15-50-5041-PM.png) ### Need Assistance? Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? [Inquire](https://sittadel.com/start/) about arranging a consultation to explore optimizing your Azure environment for painless management. - [UserOps](https://knowledge.sittadel.com/userops?hsLang=en#main-content) - [Access & Permissions](https://knowledge.sittadel.com/userops?hsLang=en#access-permissions) - [Account](https://knowledge.sittadel.com/userops?hsLang=en#account) - [Devices](https://knowledge.sittadel.com/userops?hsLang=en#devices) - [Document Sharing](https://knowledge.sittadel.com/userops?hsLang=en#document-sharing) - [Email](https://knowledge.sittadel.com/userops?hsLang=en#email) - [Requests](https://knowledge.sittadel.com/userops?hsLang=en#requests) - [Troubleshoot](https://knowledge.sittadel.com/userops?hsLang=en#troubleshoot) - [TechOps](https://knowledge.sittadel.com/techops?hsLang=en#main-content) - [Tenant Foundations](https://knowledge.sittadel.com/techops?hsLang=en#tenant-foundations) - [Collaboration Security](https://knowledge.sittadel.com/techops?hsLang=en#collaboration-security) - [Email Security](https://knowledge.sittadel.com/techops?hsLang=en#email-security) - [Device Security](https://knowledge.sittadel.com/techops?hsLang=en#device-security) - [Identity Security](https://knowledge.sittadel.com/techops?hsLang=en#identity-security) - [SecOps](https://knowledge.sittadel.com/secops?hsLang=en#main-content) - [Email SOC](https://knowledge.sittadel.com/secops?hsLang=en#email-soc) - [Identity SOC](https://knowledge.sittadel.com/secops?hsLang=en#identity-soc) - [Tenant SOC](https://knowledge.sittadel.com/secops?hsLang=en#tenant-soc) - [Device SOC](https://knowledge.sittadel.com/secops?hsLang=en#device-soc) - [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en) - [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en#main-content) - [Overview](https://knowledge.sittadel.com/deploy-mde?hsLang=en#overview) - [Intune Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#intune-deployment) - [Hands-On Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#hands-on-deployment) - [Azure Arc Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#azure-arc-deployment) - [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment) - [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment) - [GPO Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#gpo-deployment) - [Deploy Services](https://knowledge.sittadel.com/deploy-services?hsLang=en#main-content) - [Cloud Enclave](https://knowledge.sittadel.com/deploy-services?hsLang=en#cloud-enclave) - [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en#main-content) - [Entra ID](https://knowledge.sittadel.com/azure-portals?hsLang=en#entra-id) - [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune) - [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender) - [Purview](https://knowledge.sittadel.com/azure-portals?hsLang=en#purview) - [SharePoint Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#sharepoint-admin-center) - [Teams Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#teams-admin-center) - [Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#admin-center) - [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center) [![](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel_LogoH_Color_BlackText.png?width=186&height=55&name=Sittadel_LogoH_Color_BlackText.png)](https://Sittadel.com) Security for Humans. Copyright © 2026, Sittadel