---
title: Set up App and API Protection for .NET on Windows
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > App and API Protection > Enabling App and API
  Protection > Enabling AAP for .NET > Set up App and API Protection for .NET on
  Windows
---

# Set up App and API Protection for .NET on Windows

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ().
{% /alert %}

{% /callout %}

{% alert level="info" %}
You can enable App and API Protection for .NET services with the following setup options:

1. If your .NET service already has APM tracing set up and running, then skip to service configuration.
1. If your .NET service doesn't have APM tracing set up, you can easily enable App and API Protection with Datadog's [Automatic Installation](https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/single-step-apm/windows.md).
1. Otherwise, continue reading the manual setup instructions below.

{% /alert %}

## Overview{% #overview %}

App and API Protection leverages the [Datadog .NET library](https://github.com/DataDog/dd-trace-dotnet/) to monitor and secure your .NET service. The library integrates seamlessly with your existing application without requiring code changes.

For detailed compatibility information, including supported .NET versions, frameworks, and deployment environments, see [.NET Compatibility Requirements](https://docs.datadoghq.com/security/application_security/setup/dotnet/compatibility.md).

This guide explains how to set up App and API Protection (AAP) for .NET applications. The setup involves:

1. Installing the Datadog Agent.
1. Enabling App and API Protection monitoring.
1. Running your .NET application with the Datadog Agent.
1. Verifying the setup.

## Prerequisites{% #prerequisites %}

- Windows operating system
- .NET application
- Administrator privileges for some configuration steps
- Your Datadog API key
- Datadog .NET tracing library (see version requirements [here](https://docs.datadoghq.com/security/application_security/setup/dotnet/compatibility.md))

## 1. Installing the Datadog Agent

Install the Datadog Agent by following the [setup instructions for Windows hosts](https://docs.datadoghq.com/agent.md?tab=Windows).

## 2. Enabling App and API Protection monitoring
If your .NET service already has APM tracing set up and running, you can automatically enable App and API Protection through Remote ConfigurationIf not, enable App and API Protection with the manual configuration instructions.navigation-menu{background:#f8f9fa;border:1px solid #e9ecef;border-radius:8px;padding:20px;margin:20px 0}.nav-container h3{margin-top:0;margin-bottom:15px;color:#333;font-size:1.1em}.nav-list{list-style:none;padding:0;margin:0}.nav-list li{margin-bottom:8px}.nav-list a{color:#06c;text-decoration:none;font-weight:500}.nav-list a:hover{text-decoration:underline;color:#049}
### Automatically enabling App and API Protection through Remote Configuration{% #automatically-enabling-app-and-api-protection-through-remote-configuration %}

You can enable services with remote configuration on your [services dashboard](https://app.datadoghq.com/security/configuration/asm/setup?services=recommended). Check the box for the service you want to enable App and API Protection for under Activate on your APM services.

### Manually enabling App and API Protection monitoring{% #manually-enabling-app-and-api-protection-monitoring %}

**Download the latest [Datadog .NET Tracer MSI Installer](https://github.com/DataDog/dd-trace-dotnet/releases)** that supports your operating system and architecture and install it with *Administrator privileges*.

{% collapsible-section %}
#### APM Tracing Enabled

To enable AAP alongside with APM, add the following Environment Variables:

```
DD_APPSEC_ENABLED=true
```

{% /collapsible-section %}

{% collapsible-section %}
#### APM Tracing Disabled

To disable APM tracing while keeping App and API Protection enabled, add the following Environment Variables:

```
DD_APPSEC_ENABLED=true
DD_APM_TRACING_ENABLED=false
```

{% /collapsible-section %}

## 3. Run your application

Start your .NET application with the previous settings.

{% tab title="IIS" %}
Restart IIS

```cmd
net stop /y was
net start w3svc
# Also, start any other services that were stopped when WAS was shut down.
```

{% /tab %}

{% tab title="Standalone apps *(.NET Framework)*" %}

{% alert level="danger" %}
**Note:** The .NET runtime tries to load the .NET library into *any* .NET process that is started with these environment variables set. You should limit instrumentation to only the applications that need to be instrumented. **Don't set these environment variables globally as this causes *all* .NET processes on the host to be instrumented.**
{% /alert %}

Set the following required environment variables for automatic instrumentation to attach to your application and relaunch it:

```
COR_ENABLE_PROFILING=1
```

{% /tab %}

{% tab title="Standalone apps *(.NET Core)*" %}

{% alert level="danger" %}
**Note:** The .NET runtime tries to load the .NET library into *any* .NET process that is started with these environment variables set. You should limit instrumentation to only the applications that need to be instrumented. **Don't set these environment variables globally as this causes *all* .NET processes on the host to be instrumented.**
{% /alert %}

Set the following required environment variables for automatic instrumentation to attach to your application and relaunch it:

```
CORECLR_ENABLE_PROFILING=1
```

{% /tab %}

## 4. Verify setup

To verify that App and API Protection is working correctly:

1. Send some traffic to your application
1. Check the [Application Signals Explorer](https://app.datadoghq.com/security/appsec) in Datadog
1. Look for security signals and vulnerabilities

## Troubleshooting{% #troubleshooting %}

For a more detailed, see [the Datadog Tracer installation guide for .NET Framework](https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/dd_libraries/dotnet-framework.md?tab=windows) or [the Datadog Tracer installation guide for .NET Core](https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/dd_libraries/dotnet-core.md?tab=windows).

If you encounter issues while setting up App and API Protection for your .NET application, see the [.NET App and API Protection troubleshooting guide](https://docs.datadoghq.com/security/application_security/setup/dotnet/troubleshooting.md).

## Further Reading{% #further-reading %}

- [How App and API Protection Works](https://docs.datadoghq.com/security/application_security/how-it-works.md)
- [OOTB App and API Protection Rules](https://docs.datadoghq.com/security/default_rules.md?category=cat-application-security)
- [Troubleshooting App and API Protection](https://docs.datadoghq.com/security/application_security/troubleshooting.md)