Some resources, such as keyboard and mouse, are always available to the AppContainer and resident application. In some cases these resources are further protected by 'brokers'. These resources are blocked by default and can be granted access as necessary. Isolating the application from device resources, such as passive sensors (camera, microphone, GPS), and money pumps (3G/4G, dial phone) the AppContainer environment prevents the application from maliciously exploiting the device. The AppContainer environment creates an identifier that uses the combined identities of the user and the application, so credentials are unique to each user/application pairing and the application cannot impersonate the user. Managing identity and credentials, the AppContainer prevents the use of user credentials to gain access to resources or login to other environments. Malicious apps cannot take over the rest of the machine. Even if vulnerability in an app is exploited, the app cannot access resources beyond what is granted to the AppContainer. The more these applications can be isolated in an AppContainer, the safer the device and resources are. Some common examples include an application breaking out of its browser or sending a bad document to Internet Explorer as well as exploitation of plugins, such as flash. Most vulnerabilities in Windows start with the application. Controlling access to resources protects the process, the device, and the network. Granting access based upon least-privilege prevents applications and users from accessing resources beyond their rights. By isolating an application from unneeded resources and other applications, opportunities for malicious manipulation are minimized.

Isolation is the primary goal of an AppContainer execution environment.

Microsoft edge app container id