How to whitelist Microsoft Photos App in Controlled Folder Access?

[hj-collab]

Hi,

How to whitelist Microsoft Photos App in Controlled Folder Access? Version number of Microsoft Photos app keeps changing with updates. It requires me to manually add new version of the photos app in CFA. I use the crop feature of Photos app which tries to override the existing image triggering CFA protections. How to keep up with this?

Thank you!

[HotCakeX]

Hi,
Photos app isn't normally blocked by Controlled Folder Access, I never had to allow Photos app in CFA to crop my pictures that are synced in my OneDrive which is entirely protected by CFA.

Are you using or have you used any 3rd party security software ? which Windows version are you on?

[hj-collab]

@HotCakeX Sorry. I did not mention that I was facing this issue a year back on a stock W11 installation. I had disabled CFA as this issue was bothering me a lot. Not sure if it's fixed with recent updates. I thought every binary / app needed to be excluded. If you are not facing the issue currently then it might have resolved by updates. I'll test this again when I can.

P.S. I have sent you an email just now unrelated to this issue. Please check.

[hj-collab]

iirc there were different version numbers in the folder name of MS Photos under %ProgramFiles%\WindowsApps

Technically we will need to whitelist the photos app after each update unless they have whitelisted their own apps?

[HotCakeX]

I'm certain my Photos folder in OneDrive was still protected by CFA a year ago too and didn't have to manually allow it.
I think the best thing is to try again and if you still have problems with it then we troubleshoot it, make sure OS and store apps are fully up to date first.

Yes, if the app gets updated its folder will have a different version number so path to exe will change but not necessary to whitelist now.
there are app execution aliases saved here too "%USERPROFILE%\AppData\Local\Microsoft\WindowsApps" , they are mostly for 3rd party apps, their path doesn't change even though their installation folder path changes.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders?view=o365-worldwide#how-does-controlled-folder-access-work