The ransomware protection (Controlled Folder access) blocks write to controlled folders. The admin specifies folders to be protected, which by default includes

The ransomware protection (Controlled Folder access) blocks write to controlled folders. The admin specifies folders to be protected, which by default includes a bunch of user profile folders like "Documents". At that point no application can write to those folders unless whitelisted. The downside is that for a while after you enable it, you will need to keep granting applications write access to those folders, until eventually all apps that need write access have it. In a corporate environment, IT could pre-configure the white list to include any approved applications that need write access to those folders. Most companies claim that installing unapproved software is a fireable offence, so only the execs (who are immune to such policies) and developers are likely to notice.