Configuring Device Guard

Windows Defender Device Guard is another layer of security in the so-called defense in depth strategy. It is a combination of the enterprise hardware and software security features so that it can mitigate threats coming from malicious software (malware). With that being said, Device Guard only allows the execution of trusted applications, and trusted applications are considered to be applications that are signed digitally. Thus, to verify an application's digital signature, Device Guard uses virtualization-based security. In that way, if an attacker manages to get control of your Windows 10 device, Device Guard will lock down your device. Once locked, your device will only run trusted applications that you have previously defined in your code integrity policies. No untrusted apps are permitted to run. 

...