Application Allowlisting with App Control for Business: Keep Approved Apps Running and Block the Rest

On Tuesday morning your IT team publishes an update to the loan origination desktop client in Microsoft Intune, and by lunch it's running on every processor's laptop. That afternoon, an email attachment tries to start a remote access tool nobody approved. With Microsoft App Control for Business enforcing a policy that trusts Intune's managed installer, the update runs and the remote access tool is blocked. One arrived through a source your policy trusts, and the other matches no rule in it.

That is application allowlisting, also called application whitelisting: a Windows device runs the code your policy approves and stops the rest. In Microsoft's words, application control "changes Windows from a place where all code runs unless your AV solution confidently predicts it's bad, to one where code runs only if your policy says so." The policy also covers scripts, Microsoft installer (MSI) packages, batch files, and interactive PowerShell sessions, which run in Constrained Language Mode.

Allowlisting used to mean a help desk ticket and a hand-written rule for every new application. Intune changes that. Once the Intune Management Extension is set up as a managed installer, the apps your team deploys through Intune are tagged and trusted automatically, so your staff keep getting their software the way they do today. Windows Pro carries the license entitlement, and Microsoft 365 Business Premium includes Intune Plan 1 to deploy it.

ABT, a Tier-1 Microsoft Cloud Solution Provider serving 750+ financial institutions, wrote this guide for IT teams at community banks, credit unions, and mortgage companies planning their first allowlisting policy.

What application allowlisting changes on a Windows device

Application allowlisting changes the question Windows asks before code runs, from whether antivirus flags it to whether your policy approves it. Here's the difference on a single laptop.

Microsoft calls application control "not a replacement for antivirus." The two answer different questions: antivirus asks whether a file looks malicious, and your App Control policy asks whether you approved it. Our guide to remote monitoring and management (RMM) phishing shows why that second question matters when an attacker sends legitimate remote access software.

App Control for Business or AppLocker

Windows includes two application control technologies: App Control for Business, the feature earlier guidance calls Windows Defender Application Control (WDAC), and AppLocker. Intune can deploy both.

Microsoft recommends App Control as the general choice for customers able to implement it. AppLocker still fits two cases: a mixed estate that needs the same rules on older Windows versions, and shared computers that need different rules for different users. AppLocker can also sit alongside App Control to fine-tune restrictions per user. Microsoft introduced the ApplicationControl CSP to replace the AppLocker CSP, so build new policies in the App Control for Business node.

What Microsoft 365 Business Premium already includes

Microsoft lists App Control's license entitlement as coming with Windows Pro, Pro Education/SE, Enterprise E3 and E5, and Education A3 and A5. Microsoft 365 Business Premium, which Microsoft listed in October 2026 at $22.00 per user per month, paid yearly, includes Intune Plan 1 to deploy the policy and Microsoft Defender for Business to keep antivirus running beside it. Licensed through ABT, Business Premium carries the same Microsoft price, with M365 Guardian Foundation included at no additional charge.

Microsoft's Intune prerequisites for App Control:

If you looked at Intune Endpoint Privilege Management and stopped at the add-on price, App Control is a different case: its entitlement comes with Windows itself. Windows 10 reached end of support on October 14, 2025, and Microsoft says functionality on it can vary, so plan your policy around Windows 11. Our comparison of E3, E5, and Business Premium covers when to move up from Business Premium.

How the Intune App Control policy works

In the Intune admin center, go to Endpoint security > App Control for Business, open the App Control for Business tab, and select Create Policy. Built-in controls configure a policy without any XML, and Enter xml data takes a custom policy you've authored. App Control applies only to the device scope, so assign policies to device groups.

Built-in controls give you three settings:

• Enable trust of Windows components and store apps. Set to Enabled, the default, devices run Windows components, store apps, and whatever else the policy trusts, and block everything else. Set to Audit only, the policy logs every file it would have blocked and lets it run.
• Trust apps with a good reputation. Lets devices run apps Microsoft's Intelligent Security Graph rates as reputable.
• Trust apps from managed installers. Lets devices run the apps you deploy through Intune once the managed installer is set up.

Microsoft notes that Intune's built-in App Control support "has no option to add explicit allow or deny rules" and that in most cases customers will need a custom policy. Supplemental policies add allow rules without rebuilding everything. Deny rules go in a base policy of their own, deployed beside it, like the Microsoft recommended block rules covered below. Key terms:

Use the reputation option with care, and only on devices with regular internet access. Microsoft says the Intelligent Security Graph "is not the recommended way to allow apps that are business critical"; authorize those with explicit allow rules or a managed installer. Reputation is checked only for files your policy hasn't explicitly allowed or denied and a managed installer didn't install, and a reputation decision can change over time. An explicit deny rule always takes precedence over reputation, so a deny rule for a remote access tool outside your approved list blocks that tool whatever its reputation.

Let Intune-deployed apps run with a managed installer

The managed installer makes application allowlisting workable for a small IT team. You trust the channel your applications arrive through, and your team writes rules for the exceptions.

Microsoft notes the managed installer has no effect on devices unless you also use App Control policies that reference it. You can turn it on weeks before you enforce anything and let normal deployments build up tagged apps.

Microsoft also calls the managed installer a heuristic. It "doesn't provide the same security guarantees as explicit allow or deny rules", it works best where users operate as standard users, and users with administrator rights, or malware running as an administrator, may be able to get around the policy's intent. Pair allowlisting with standard user accounts. Our guide to Endpoint Privilege Management covers moving staff off local admin rights, and Windows Local Administrator Password Solution (LAPS) keeps the local administrator password unique on every managed device.

Start in audit mode

Set Enable trust of Windows components and store apps to Audit only, assign the policy to a pilot group, and let your staff work normally. The policy only logs: Windows records every file it would have stopped.

Those records land in the Applications and Services Logs\Microsoft\Windows\CodeIntegrity\Operational event log, with scripts and MSI files in the AppLocker MSI and Script log. Two event IDs matter most, per Microsoft's event ID reference:

• Event 3076 is the main audit-mode event: the file would have been blocked if the policy were enforced.
• Event 3077 is the main enforcement event: the file didn't pass your policy and was blocked.

Read the 3076 events as a to-do list. Each one is an application your institution relies on, which needs a rule, or something that shouldn't be there.

Microsoft's audit guidance shows how to turn those events into a policy to merge with your base policy or deploy as a supplemental one. The generator creates rules only for files still on disk, so run it on a pilot device that has the applications installed. Start with the managed installer limits above.

Close the known bypasses

An allowlist is only as tight as the trusted tools it leaves open. Some legitimate Windows and developer programs can run other code by design. Three additions harden any policy:

• Microsoft's recommended block rules. Unless your use cases require them, Microsoft recommends blocking applications an attacker can use to circumvent allow policies, including msbuild.exe, cscript.exe, dotnet.exe, and mshta.exe. Microsoft provides the list as a policy you can deploy as its own base policy beside your others on Windows 10 version 1903 and later, or merge into an existing one.
• The vulnerable driver blocklist. Since the Windows 11 2022 update, Microsoft's vulnerable driver blocklist is enabled by default for all devices, updated quarterly and through monthly Windows updates. Confirm it's still on in the Windows Security app. Microsoft also publishes a fuller version to add to your App Control policy, and recommends validating it in audit mode first.
• Deny rules for old versions. When a vendor fixes a vulnerability or a bypass in a new release, Microsoft recommends adding deny rules for the older, less secure versions.

A rollout plan for banks, credit unions, and lenders

Here's a rollout sequence, adapted from Microsoft's documentation, for an institution with a small IT team and most of its devices already in Intune.

Plan a support path before step 5. When a teller's scanner driver or a processor's new plugin is blocked, the help desk needs to know where to look (event 3077 on that device) and who can add a rule the same day.

What CISA, CIS, and the FFIEC handbook say

The Cybersecurity and Infrastructure Security Agency (CISA) #StopRansomware Guide tells organizations to "Use application allowlisting and/or endpoint detection and response (EDR) solutions on all assets to ensure that only authorized software is executable and all unauthorized software is blocked." For Windows, it says to "enable Windows Defender Application Control (WDAC), AppLocker, or both on all systems that support these features." The Center for Internet Security (CIS) Control 2 asks institutions to manage software "so that only authorized software is installed and can execute".

Bank and credit union examiners work from the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook.

The handbook is guidance examiners use, and it lists allowlisting among several malware controls. App Control gives you evidence for that line. We recommend keeping three records:

• Each version of your base and supplemental policies, with the reason for every rule you added.
• The audit period for each group and what its 3076 events showed before you enforced.
• A quarterly review of the approved list alongside your software inventory.

Licensing, and how ABT helps

If your devices run Windows Pro and you hold Microsoft 365 Business Premium, the licensing pieces are already in place: the App Control entitlement on the devices, plus Intune Plan 1 and Microsoft Defender for Business. Institutions on Microsoft 365 E3 or E5 have the same entitlement through Windows Enterprise.

ABT sells Microsoft 365 licensing at Microsoft's price, on its own line. When your licensing runs through ABT, M365 Guardian Foundation, the hardened tenant baseline, is included at no additional charge. Guardian covers Intune compliance policies, BitLocker encryption, operating system security baselines, and Conditional Access gates, the device foundation an allowlisting policy builds on. Our guides to risk-based device compliance with Intune, BitLocker encryption, and Windows Autopilot cover the rest of that foundation.

Frequently Asked Questions

Justin Kirsch

Co-Founder & CEO, Access Business Technologies

Justin Kirsch has been building and managing Microsoft environments for financial institutions since 1999. He is Co-Founder and CEO of Access Business Technologies, a Tier-1 Microsoft Cloud Solution Provider primarily dedicated to financial services and serving 750+ financial institutions. He helps banks, credit unions, and mortgage companies license Microsoft 365 at Microsoft's price and harden their Microsoft 365 tenants, Intune device compliance included, through M365 Guardian.