Learn More About Unsigned Apps

You're seeing this because Windows showed a label such as "Unsigned App" in Camera, Microphone or Location Privacy Settings pages or when you were asked to allow an app to access your camera, microphone, or location. This article explains what that means and what to do next.

What Is an Unsigned App?

An unsigned app is an application that does not have a valid digital signature (code signed) Windows can use to verify the identity of the software publisher.

Code signing helps establish:

  • Who published the application
  • Whether the application has been modified after it was initially published
  • Whether the application comes from a trusted organization

When an app is unsigned, Windows cannot verify the publisher's identity. This does not necessarily mean the app is malicious, but it does mean Windows has limited information about this app.

Why Does Windows Treat Unsigned Apps Differently?

Privacy-sensitive resources such as camera, microphone, and location can be used to access personal information. To help you make informed decisions, Windows may show additional notifications or apply different trust treatments when an app can't be associated with a verified publisher identity.

Signed applications give Windows a clearer picture of who created an app and where it came from. That helps with:

  • Showing you who published the app
  • Letting workplaces and schools manage which apps run
  • Helping IT and security teams keep devices safe

Without a digital signature, an app may appear simply as "Unsigned App" or with limited publisher information.

What Should I Do If I See an Unsigned App?

Before granting access to privacy-sensitive resources, consider:

  1. Whether you recognize the application.
  2. How you obtained it.
  3. Whether you trust the source that provided it.
  4. Whether a newer or signed version is available.

If you're unsure, contact your organization's IT department or the software publisher before allowing access.

Examples

  • You recognize the app: If a video conferencing app that you regularly use for work asks for camera access, you may choose to allow it if you trust the source from which it was installed.
  • You do not recognize the app: If an unfamiliar application asks for microphone, camera, or location access, you should deny access until you can verify what the app is and whether it is from a trusted source.
  • The app came from your organization: If your IT department provided the application, check with them to confirm that the app is expected and that the requested access is required for its functionality.
  • A signed version becomes available: If the software publisher provides a digitally signed version of the app, consider updating to that version, as Windows can verify the publisher's identity.

Important

An unsigned app is not necessarily unsafe. However, because Windows cannot verify the identity of the publisher, you should exercise additional caution before granting access to privacy-sensitive resources such as the camera, microphone, or location.

I'm a Software Developer. How Can I Sign My Application?

You can improve the user experience and establish trust by signing your application with a code-signing certificate issued by a trusted certificate authority.

Benefits include publisher attribution in Windows, improved user trust and transparency, simplified enterprise management, and better auditability. Organizations distributing internal applications can also sign them using certificates trusted within their own enterprise.

An easier path to stable identity: WinApp CLI

If MSIX packaging fits your app, the WinApp CLI can help you create a packaged, signed identity with more predictable attribution. Point it at your existing build output, and out comes a packaged, branded, signed MSIX.

  • Stable identity, automatically. Consistent publisher identity across versions — no churn, and no re-prompts after updates.
  • Correct branding at the decision point. Your app's name, icon, and brand show up correctly at the moment users decide whether to allow or deny access.
  • Helps you avoid the "Unsigned" section. A signed, packaged identity keeps your app out of the unsigned experience.

To get started, point the tool at your existing build folder:

winapp pack <folder>

Install with winget install Microsoft.WinappCLI.

To learn more, see aka.ms/winappcli.

I'm an IT Administrator. How Do I Manage Unsigned Apps Across My Organization?

Organizations can manage how Windows handles unsigned applications through device management policies, using Configuration Service Providers (CSPs) and related policy frameworks deployed via Microsoft Intune, other MDM solutions, or Group Policy. Administrators can allow, restrict, or deny access to protected resources, and configure organization-wide privacy settings for camera, microphone, location, and other protected resources. Organizations can also add their own signature to unsigned applications they deploy by using signed catalogs, which can be delivered to end users through Intune. For more information, see Deploy catalog files to support App Control for Business.

Because unsigned apps don't provide a verified publisher identity, identity-based policy may take more setup, for example relying on alternative application identifiers, and may need periodic revalidation as those identifiers change.

Note

Some controls, such as denying access by application name, are currently available only for packaged applications. Unpackaged (Win32) apps are managed through broader allow or deny policies rather than per-app identity blocks.

For full configuration guidance, see document placeholder link.

Best Practices for Managing Unsigned Apps

  • Prefer signed applications whenever possible.
  • Establish trusted code-signing practices for internally developed software.
  • Use application identity and policy controls to explicitly allow or deny access to protected resources.
  • Regularly review applications that lack a verified publisher identity.
  • Transition critical applications to signed versions when possible.

Signed applications provide stronger identity assurances, improve transparency, and simplify long-term policy management for both users and enterprises.