How to enable Control Flow Guard (CFG) in C# UWP Application

Hi @Raja Shanmugam ,

The <ControlFlowGuard> property in the .csproj file is designed specifically for C++ native projects, not C#.

When you build a C# UWP app using .NET Native (<UseDotNetNativeToolChain>true</UseDotNetNativeToolChain>), it uses a completely different compilation pipeline that does not read or support this MSBuild property. Therefore, adding it will have no effect.

Also, make sure you are running dumpbin on the final native binaries (found inside the generated .appx/.msix package or the ilc output folder), not the intermediate managed .dll files.

If the final native binaries still lack CFG and you have strict security requirements, I recommend opening a support ticket, as there are no documented ways to force this flag in the closed .NET Native toolchain.
If you found my response helpful or informative, I would greatly appreciate it if you could follow this guide provide feedback. Thank you. 

Control Flow Guard is enabled at the native code level by the C++ compiler and linker. The documented way to enable CFG is to:

• Compile with /guard:cf.
• Link with /GUARD:CF and /DYNAMICBASE.

In Visual Studio C++ projects this is done via Configuration Properties → C/C++ → Code Generation → Control Flow Guard = Yes (/guard:cf) and ensuring the linker is passed /GUARD:CF.

For managed/UWP C# projects built with .NET Native (<UseDotNetNativeToolChain>true</UseDotNetNativeToolChain>), the native code generation and linking pipeline is different and isn’t covered in the provided documentation. The context only specifies how to enable CFG for C++/native builds and how to verify CFG in binaries using dumpbin /headers /loadconfig (look for Guard, CF Instrumented, and FID table present). It does not describe a supported mechanism to control CFG for .NET Native–produced UWP assemblies via project properties such as <ControlFlowGuard>Guard</ControlFlowGuard>.

From the available information, only this is guaranteed:

• CFG is controlled by /guard:cf at compile time and /GUARD:CF at link time.
• CFG-enabled binaries can be verified with dumpbin /headers /loadconfig.
• The documentation does not state that the UWP C#/.NET Native toolchain honors <ControlFlowGuard> or exposes a project-level switch for CFG.

Therefore, CFG enablement for a C# UWP app built with .NET Native cannot be confirmed or configured based on the provided documentation; only native C++ configuration is described.

References:

• /guard (Enable Control Flow Guard)
• /GUARD (Enable Guard Checks)
• Control Flow Guard for platform security