Disable Enhanced Phishing Protection telemetry calls
The `TelemetryCallsEnabled` DWORD value, when set to `0`, disables telemetry calls from the Windows WTDS component associated with Enhanced Phishing Protection in Microsoft Defender SmartScreen.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WTDS\FeatureFlags\TelemetryCallsEnabled
The TelemetryCallsEnabled DWORD value, when set to 0, disables telemetry calls from the Windows WTDS component associated with Enhanced Phishing Protection in Microsoft Defender SmartScreen.
Enhanced Phishing Protection detects unsafe use of the work or school password used to sign in to Windows. Microsoft documents that the feature can report detected password-entry events and diagnostic data through Microsoft Defender. This value suppresses the transmissions governed by the internal feature flag.
Notes
Security
Disabling this telemetry can reduce centralized visibility into detected phishing activity and unsafe password use. In particular, data that would otherwise contribute to Microsoft security services or, for appropriately onboarded devices, alerts and reports in Microsoft Defender for Endpoint might no longer be available.
Public Microsoft documentation does not establish that this value disables local detection or every user warning provided by Enhanced Phishing Protection. It should therefore not be treated as equivalent to the documented Service Enabled policy, which can turn off the entire feature, including event capture, data transmission, and user notifications.
Notes
Microsoft does not document this registry value or its exact scope in the public policy reference. In particular, it is distinct from the Automatic Data Collection policy. That policy controls the additional collection of information such as displayed content, sounds, and application memory following suspicious password entry and uses different registry values under HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components.
Enhanced Phishing Protection is documented for Windows 11, version 22H2 and later. The individual event and data categories suppressed by TelemetryCallsEnabled across different Windows releases are not publicly specified and can change with Windows updates.
Microsoft documentation
Microsoft Learn: Enhanced Phishing Protection in Microsoft Defender SmartScreen
Microsoft Learn: WebThreatDefense Policy CSP