🎯 Purpose
✅ Enforce App Control for Business built‑in controls on Windows, so only trusted applications can run.
➡️ Replaces the retired Endpoint security Application control template (the App control ASR profile) and keeps enforcement in place, because the separate WDAC XML policy runs in audit mode.
👥 Who is affected
✅ Devices: All Windows 10 / 11 devices
🚫 Exclusions: None
☁️ What is protected
✅ Execution: Executables, scripts and installers on Windows devices
✅ Template: Endpoint security › App Control for Business
🔐 How app control is enforced
Setting | Value |
Policy creation type | Built‑in controls |
Audit mode | Disabled (enforced) |
Trust apps with good reputation | Enabled (Intelligent Security Graph) |
Trust apps from managed installer | Enabled |
➡️ Windows components, Microsoft Store apps, apps with a known good reputation and apps deployed by Intune are allowed. Unknown, untrusted executables are blocked.
ℹ️ Note: Trust apps from managed installer is required by the template and stops Intune‑deployed apps being blocked. See E8-WDAC-Managed Installer.
⚙️ What this policy does NOT enforce
🚫 Custom WDAC XML allow or deny rules
🚫 Script enforcement beyond the built‑in controls
🚫 Driver block lists
➡️ Custom rules are handled by the separate WDAC policies.
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
✅ Enforcing (not audit)
📘 Essential Eight Alignment
✅ Supports Essential Eight – Application Control
✅ Prevents execution of unapproved programs on workstations
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ Only trusted software can run on Windows devices
✅ Software IT deploys through Intune keeps working
✅ Unknown programs downloaded by users are blocked
This keeps application control enforced on the current Intune template.