CybersecurityPrivacy & Surveillance

Microsoft Bolsters Windows 11 with Granular App Permission Controls

Analyst 207||Source: BleepingComputer
Person sitting at desk with laptop open, showing abstract permissions settings page.
"Windows Insiders can now manage camera, microphone, and location permissions for individual desktop apps. Previously, access for traditional desktop applications was managed through a single device-wide setting," Microsoft explained.

Microsoft has begun testing a change to Windows 11 privacy controls that moves desktop applications from a single, device-wide permission model to app-by-app controls for camera, microphone and precise location. The testing build is available to Insiders who have upgraded to Windows 11 Insider Experimental Preview Build 26340.9233, and Microsoft says the aim is to make permissions easier to understand and quicker to manage for each desktop app.

Windows 11 Insider Experimental Preview Build 26340.9233

The new controls are shipping to systems on Windows 11 Insider Experimental Preview Build 26340.9233. Microsoft frames the change as an update to how "traditional desktop applications" are handled: rather than a single toggle that governs access for all such apps, the settings now surface per-app toggles so users can review and control which applications request sensitive resources.

Per-app Camera, Microphone, and Location toggles

Insiders can find and change the new settings under Settings > Privacy & security > Camera, Microphone, or Location. From those pages, users may grant or deny access using dedicated toggles for each desktop app listed. Microsoft warned users to grant access only to apps they "trust and recognize," noting that some programs that rely on shared system components, browser-hosted experiences, or similar technologies may appear under different names or as unsigned if Windows cannot verify the publisher's information.

User Transparency and Consent, and the new security model

The per-app toggles follow Microsoft's earlier announcement that it plans to introduce smartphone-style permission prompts on Windows 11 to request user consent before apps access sensitive resources such as cameras and microphones. Microsoft said this change is a response to a trend where apps were increasingly installing unwanted software, overriding settings, or modifying core Windows experiences without prior user consent.

As Windows Platform engineer Logan Iyer put it in that announcement: "Users will have transparency and consent control over how apps access their personal data and device features. They will receive clear prompts to grant or deny apps permission to access protected data and hardware. Users will also be able to revoke permissions they have previously granted."

Microsoft characterizes the mobile-style controls as part of two initiatives — "Windows Baseline Security Mode" and "User Transparency and Consent" — and said the changes will roll out in phases. The company plans to adjust the controls and the rollout speed based on feedback gathered during testing.

Accessibility change: auto-maximize windows in tablet mode

Alongside the privacy work, Microsoft is testing a separate accessibility option that automatically maximizes app windows when they open for people who work in tablet mode, use a screen reader or magnification, or otherwise prefer a full-screen workspace. That setting is being trialed as part of the same Experimental Preview effort and is intended to streamline workflows for users who benefit from larger initial window sizes.

What this means for end users, IT teams, and app developers

  • End users: Individuals gain finer control over which desktop apps can access cameras, microphones and location, and they will see dedicated toggles in familiar Settings pages. Microsoft’s explicit warning about apps showing under different names or as unsigned encourages users to be cautious when granting permissions.
  • IT and security teams: The shift from a device-wide toggle to per-app controls changes the administrative visibility and potentially the enforcement surface for privacy settings. Because Microsoft plans a phased rollout and to adjust speed based on feedback, IT teams should monitor Insider channels and testing guidance to understand how the controls will behave at scale.
  • App developers and software publishers: Developers that rely on shared components or browser-hosted experiences may find their applications listed under unexpected names or as unsigned in the new UI, a detail Microsoft highlighted. That could increase help-desk questions and require clearer publisher verification or packaging to avoid confusing users.

Microsoft’s testing marks a deliberate move to bring smartphone-style permission models to the Windows desktop and to give users clearer, revocable controls over sensitive device features. The company has tied the work to larger initiatives — Windows Baseline Security Mode and User Transparency and Consent — and says it will tune the rollout based on Insider feedback. For now, the change is visible to those on Build 26340.9233; how rapidly it reaches broader release will depend on that phased testing and the feedback Microsoft receives.

Original story

MicrosoftWindows 11Insider PreviewGranular App PermissionsPrivacy ControlsEmerging Threats Is Not Relevant HereApp Permission ManagementLocation Privacy
Related Intelligence

Continue Reading

Security analysts work amidst multiple computer screens in a monitoring room with subtle signs of disarray.

CISA Red Team Tests Expose Organizational Vulnerabilities

CISA's red team tests revealed some eye-opening vulnerabilities, with the team slipping past security operations centers undetected, gaining access to workstations, escalating privileges, and moving freely between systems. This simulated cyber attack exposed weaknesses in critical infrastructure organizations, highlighting areas for improvement in detecting and responding to threats.

Analyst 207
Government facility with industrial and security elements under daylight.

CISA Red Team Exposes Gaps in Critical Infrastructure Defenses

The CISA red team uncovered alarming gaps in critical infrastructure defenses, revealing that even with detection tools in place, the real vulnerability lies in the people, processes, and procedures supporting them. In a striking example, a recent red-team exercise showed that detection tools can be ineffective if not backed by robust supporting systems.

Analyst 207
Empty office cubicle with laptop, smartphone, and papers, surrounded by blurred coworkers' spaces and a large window.

AI Tools Operate Largely Unchecked, Heightening Security Risks

Most AI tools are flying under the radar, with a staggering 80% operating without IT oversight in enterprise ecosystems, leaving organizations vulnerable to security risks. This alarming lack of governance is even more pronounced in smaller organizations, according to Reco's latest findings.

Analyst 207
Rows of server racks and networking equipment in a shared data center with technicians in the background.

Unpatched Kaltura Flaws Expose Servers to Remote Code Execution

A pair of unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library could put servers at risk of remote code execution, allowing attackers to read sensitive files and run malicious code - and affecting not just individual customers, but also every tenant on shared hosting infrastructure. This critical security gap, tracked as CVE-2026-19913 and CVE-2026-19912, remains unpatched, leaving countless systems exposed.

Analyst 207