How to Add a Folder to Controlled Folder Access Without Disabling Apps on Windows 11

Controlled Folder Access in Windows 11 blocks unauthorized apps from changing files in protected folders. When enabled, legitimate apps like backup tools or document editors can be blocked, causing errors or data loss. This happens because the feature does not automatically trust every app you run. You can add specific folders to the protected list and authorize apps without turning off the entire security feature. This article shows you how to add folders and whitelist apps through Windows Security and the Microsoft Defender portal.

What Controlled Folder Access Does and Why Apps Get Blocked

Controlled Folder Access is a ransomware protection feature in Windows 11. It monitors apps that try to modify files inside designated folders. Only apps that Microsoft deems safe or that you explicitly allow can write to those folders. When a new or unrecognized app attempts to change a file, Windows blocks the action and logs the event in Windows Security.

The block happens because the app lacks a digital signature that Microsoft Defender trusts. This is by design — it prevents ransomware from encrypting your documents. However, it also blocks legitimate software such as backup clients, file sync tools, and custom scripts. You do not need to disable Controlled Folder Access entirely. Instead, you can add the folder that your app needs to access to the protected list, and then whitelist the app itself.

Prerequisites for Adding Folders and Apps

Before you start, confirm the following:

• You are signed in with an administrator account. Controlled Folder Access settings require admin rights.
• Windows Security is running and up to date. Open Windows Security and check for updates under Virus & threat protection > Protection updates.
• You know the exact folder path you want to protect. For example, D:\Projects or C:\Users\YourName\Documents\Backup.
• You know the executable file name of the app that is being blocked. This is often something like MyApp.exe located in Program Files or a custom folder.

Steps to Add a Folder to Controlled Folder Access

Follow these steps to add a folder to the protected list without disabling the feature.

1. Open Windows Security
   Click the Start button, type Windows Security, and press Enter. Alternatively, go to Settings > Privacy & security > Windows Security and click Open Windows Security.
2. Go to Virus & threat protection
   In the left sidebar, click Virus & threat protection. Under the Ransomware protection section, click Manage ransomware protection.
3. Turn on Controlled folder access if not already on
   If the toggle is Off, click it to turn it On. A User Account Control prompt may appear — click Yes to confirm.
4. Click Protected folders
   Under the Controlled folder access heading, click Protected folders. This opens a list of all currently protected folders, including default system folders like Documents, Pictures, and Videos.
5. Add your folder
   Click Add a protected folder. In the file picker dialog, navigate to the folder you want to protect. Select it and click Select Folder. The folder now appears in the protected list.

Repeat these steps for each folder you need to protect. You can add up to 50 folders per user account.

Steps to Allow an App Through Controlled Folder Access

If an app is blocked after you add a folder, whitelist the app so it can write to protected folders.

1. Open Windows Security and go to Manage ransomware protection
   Follow steps 1 and 2 from the previous section to reach the Controlled folder access settings page.
2. Click Allow an app through Controlled folder access
   Under the Controlled folder access heading, click Allow an app through Controlled folder access. This opens the allowed apps list.
3. Click Add an allowed app
   Click the Add an allowed app button. You have two options: Recently blocked apps shows apps that Windows Defender blocked in the last 30 days. Browse all apps lets you manually select an executable file.
4. Select the blocked app from the list or browse for it
   If the app appears under Recently blocked apps, click it and then click Add. If not, click Browse all apps, navigate to the app’s executable file (for example, C:\Program Files\MyApp\MyApp.exe), select it, and click Open. The app is now added to the allowed list.
5. Confirm the app appears in the allowed list
   Back on the allowed apps page, you should see the app listed. Close Windows Security and test the app by saving a file to the protected folder. The app should now work without errors.

If the app still fails to save, restart the app or restart Windows 11 to apply the change fully.

Common Issues When Adding Folders or Apps

“Controlled folder access does not protect this folder” error appears

This error occurs when you try to add a folder that is already protected by default, such as a subfolder inside Documents. Windows 11 does not allow duplicate entries. To confirm, check the protected folders list. If the parent folder is already there, you do not need to add the subfolder separately. The protection applies to all subfolders automatically.

Allowed app is still blocked after adding it to the list

This can happen if the app uses a different executable file than the one you whitelisted. For example, a backup app may run a helper process called BackupHelper.exe instead of the main app. Check the Windows Security event log: open Event Viewer > Windows Logs > Security and look for Event ID 1123 or 1124. These events list the exact executable that was blocked. Add that executable to the allowed list.

Cannot find the “Allow an app through Controlled folder access” option

This option is only visible when Controlled folder access is turned on. If the toggle is off, the option does not appear. Turn on Controlled folder access first, then the link becomes available.

User Account Control prompt appears every time I add a folder

This is normal behavior. Adding protected folders is a security-sensitive operation that requires admin approval. You cannot bypass the UAC prompt for this setting. Accept the prompt to proceed.

Controlled Folder Access vs Disabling the Feature: Key Differences

Item	Add Folder and Allow App	Disable Controlled Folder Access
Security level	Ransomware protection remains active for all other folders	No protection — all folders are vulnerable to ransomware
App compatibility	Only whitelisted apps can modify protected folders	All apps can modify any folder
Management effort	Requires adding each folder and app individually	No management required
User control	Granular control over which apps and folders are protected	No control — all apps are trusted
Recommended for	Business users who need both security and app functionality	Only as a temporary workaround for testing

Conclusion

You can now add folders to Controlled Folder Access and whitelist apps without disabling the ransomware protection feature in Windows 11. Use the Windows Security interface to manage both protected folders and allowed apps. If an app is blocked after adding it, check Event Viewer for the exact executable name and add it to the allowed list. For advanced environments, consider using Microsoft Defender for Endpoint to deploy Controlled Folder Access policies across multiple devices via Group Policy or Intune. This keeps your data safe while letting approved apps work as expected.