Application allow-listing has a reputation problem. Everyone agrees that only letting approved software run is one of the strongest controls you can deploy, and almost everyone has a story about a project that blocked half the business and got switched off. App Control for Business, managed from Intune, makes allow-listing realistic for small and mid-sized businesses because it can trust the apps you already deploy through Intune automatically. You stop maintaining a giant list by hand.
This guide explains what App Control for Business is, how the managed installer and built-in controls work, and the audit-first rollout I use so nothing important breaks.
What App Control for Business is
App Control for Business is the Windows feature previously known as Windows Defender Application Control (WDAC). It decides which executables, scripts, installers and drivers are allowed to run on a device. Anything not trusted by policy is blocked, even if the user is an administrator.
That is a different model from antivirus. Antivirus tries to recognize bad software. Allow-listing only runs software you have decided to trust, so new malware, renamed tools and unapproved apps simply do not start. It is also one of the controls that cyber insurers and frameworks such as the Essential Eight and CIS keep asking about.
App Control for Business is supported on Windows Pro, Enterprise and Education, so Business Premium tenants on Windows Pro can use it. AppLocker, the older allow-listing feature, is a separate technology with different licensing, and App Control is the one Microsoft is investing in.
The two ideas that make it manageable
Managed installer
A managed installer is a trusted software distribution tool. When you set the Intune Management Extension as a managed installer, Windows tags every file that Intune installs as coming from a trusted source. An App Control policy that trusts managed installers then allows those files to run, without you creating a rule for each app.
In practice, this means your allow-list becomes: Windows itself, Store apps, and whatever you deploy through Intune. If a user downloads a random tool from the internet, it is not tagged, so it does not run.
One important catch: files installed before you turned on the managed installer are not tagged. Those apps need to be found in audit mode and either redeployed through Intune or allowed with a supplemental policy.
Built-in controls
Intune offers a simple way to create the base policy without writing XML. The built-in controls give you three switches:
Built-in control
What it trusts
My default
Enable trust of Windows components and store apps
Windows itself and Microsoft Store apps. Set to Enabled to enforce, or Audit only to log.
Audit only first, then Enabled
Trust apps with a good reputation
Apps the Microsoft Intelligent Security Graph rates as reputable.
On for most small businesses
Trust apps from managed installers
Anything Intune deployed after the managed installer was set.
On
The reputation option is a trade-off. It reduces the number of exceptions dramatically, which is why I use it for most small businesses. Highly regulated environments may prefer to leave it off and rely only on managed installers and explicit rules.
The rollout, step by step
Turn on the managed installer first. In the Intune admin center, go to Endpoint security > App Control for Business, open the Managed installer tab and add the Intune Management Extension as a managed installer. Do this weeks before enforcement so new deployments are tagged.
Move app installs to Intune. Every app you want to keep should be deployed through Intune, ideally as a Win32 app. Reinstalling key apps through Intune after the managed installer is on gets them tagged.
Create the base policy in audit mode. On the App Control for Business tab, select Create Policy, choose Built-in controls, set Windows components and store apps to Audit only, and turn on the managed installer and reputation options. Assign it to all Windows devices. App Control policies apply per device.
Collect audit data for two to four weeks. Look at code integrity audit events (event ID 3076 on the device) or, with Defender for Endpoint Plan 2, query App Control events in advanced hunting across the fleet.
Sort what you find. For each audited file: redeploy it through Intune, allow it with a supplemental policy, or remove it because nobody should be running it.
Add supplemental policies. A supplemental policy adds rules to your base policy, for example trusting a vendor’s signing certificate. It must be XML and reference the base policy’s ID. Keep supplemental policies small and named by purpose.
Enforce in rings. Change the setting to Enabled for IT first, then a pilot department, then everyone. Blocks show as event ID 3077.
Where allow-listing projects usually break
Apps installed by hand years ago. They are not tagged. Audit mode finds them. Redeploy through Intune.
Self-updating apps that download new binaries outside Intune. Reputable signed apps are usually covered by the reputation option. Otherwise trust the publisher certificate in a supplemental policy.
Developer and IT tools. Scripts, portable tools and SDKs. Give these users a separate supplemental policy rather than weakening the base for everyone.
Line-of-business apps from small vendors that are unsigned. Ask the vendor to sign, or use a hash rule and accept you must update it with each version.
Old Application Control profiles. If you still have legacy application control settings under attack surface reduction or device configuration, retire them. Microsoft has flagged them for deprecation, and mixing approaches makes troubleshooting miserable.
A pre-enforcement checklist
Managed installer has been on for at least two weeks.
All business apps deploy through Intune.
Base policy has run in audit mode across all devices.
Every audited file is resolved: redeployed, allowed, or removed.
Supplemental policies exist for IT and developer groups.
Help desk knows how to read event 3077 and request an exception.
An owner reviews exceptions monthly.
Allow-listing works best on top of a solid baseline. Our endpoint security baseline service covers App Control alongside ASR rules and Defender, and our Intune managed service handles the app packaging that makes managed installer trust work. If you are not sure where your app deployment stands today, an Intune health check is the place to start.
Does App Control for Business work on Windows Pro?
Yes. Microsoft lists App Control for Business, including managed installer support, as available on Windows Pro, Enterprise and Education. That makes it usable for Business Premium tenants.
What happens to apps installed before the managed installer was turned on?
They are not tagged as trusted. Run your policy in audit mode to find them, then reinstall them through Intune or allow them with a supplemental policy before you enforce.
Is App Control for Business the same as AppLocker?
No. They are separate Windows features. App Control for Business is the newer, stronger option and the one Intune’s built-in policy uses. AppLocker is used behind the scenes only to define the managed installer.
Want to know how much unapproved software is running on your devices right now? Book a free Microsoft 365 security assessment and we will show you where allow-listing would close the biggest gaps.
Application allow-listing has a reputation problem. Everyone agrees that only letting approved software run is one of the strongest controls you can deploy, and almost everyone has a story about a project that blocked half the business and got switched off. App Control for Business, managed from Intune, makes allow-listing realistic for small and mid-sized businesses because it can trust the apps you already deploy through Intune automatically. You stop maintaining a giant list by hand.
This guide explains what App Control for Business is, how the managed installer and built-in controls work, and the audit-first rollout I use so nothing important breaks.
What App Control for Business is
App Control for Business is the Windows feature previously known as Windows Defender Application Control (WDAC). It decides which executables, scripts, installers and drivers are allowed to run on a device. Anything not trusted by policy is blocked, even if the user is an administrator.
That is a different model from antivirus. Antivirus tries to recognize bad software. Allow-listing only runs software you have decided to trust, so new malware, renamed tools and unapproved apps simply do not start. It is also one of the controls that cyber insurers and frameworks such as the Essential Eight and CIS keep asking about.
App Control for Business is supported on Windows Pro, Enterprise and Education, so Business Premium tenants on Windows Pro can use it. AppLocker, the older allow-listing feature, is a separate technology with different licensing, and App Control is the one Microsoft is investing in.
The two ideas that make it manageable
Managed installer
A managed installer is a trusted software distribution tool. When you set the Intune Management Extension as a managed installer, Windows tags every file that Intune installs as coming from a trusted source. An App Control policy that trusts managed installers then allows those files to run, without you creating a rule for each app.
In practice, this means your allow-list becomes: Windows itself, Store apps, and whatever you deploy through Intune. If a user downloads a random tool from the internet, it is not tagged, so it does not run.
One important catch: files installed before you turned on the managed installer are not tagged. Those apps need to be found in audit mode and either redeployed through Intune or allowed with a supplemental policy.
Built-in controls
Intune offers a simple way to create the base policy without writing XML. The built-in controls give you three switches:
The reputation option is a trade-off. It reduces the number of exceptions dramatically, which is why I use it for most small businesses. Highly regulated environments may prefer to leave it off and rely only on managed installers and explicit rules.
The rollout, step by step
Endpoint security > App Control for Business, open the Managed installer tab and add the Intune Management Extension as a managed installer. Do this weeks before enforcement so new deployments are tagged.Where allow-listing projects usually break
A pre-enforcement checklist
Allow-listing works best on top of a solid baseline. Our endpoint security baseline service covers App Control alongside ASR rules and Defender, and our Intune managed service handles the app packaging that makes managed installer trust work. If you are not sure where your app deployment stands today, an Intune health check is the place to start.
Microsoft’s Intune guide is here: Manage approved apps with App Control for Business and managed installers.
Frequently asked questions
Does App Control for Business work on Windows Pro?
Yes. Microsoft lists App Control for Business, including managed installer support, as available on Windows Pro, Enterprise and Education. That makes it usable for Business Premium tenants.
What happens to apps installed before the managed installer was turned on?
They are not tagged as trusted. Run your policy in audit mode to find them, then reinstall them through Intune or allow them with a supplemental policy before you enforce.
Is App Control for Business the same as AppLocker?
No. They are separate Windows features. App Control for Business is the newer, stronger option and the one Intune’s built-in policy uses. AppLocker is used behind the scenes only to define the managed installer.
Want to know how much unapproved software is running on your devices right now? Book a free Microsoft 365 security assessment and we will show you where allow-listing would close the biggest gaps.