How to apply policy in such away where the user can download and execute any folder but not change anything in the system

Question

We’ve deployed six laptops using Microsoft Intune Autopilot, following the steps provided by our vendor (Acloud). The initial goal was to ensure users could operate the devices without the ability to make system-level changes — such as modifying account types, installing unauthorized software, or adding new users.

However, after applying the current policies, we've encountered a significant issue: users are now unable to execute any downloaded applications, even legitimate ones. The devices allow downloads, but block execution, which severely limits usability.

We asked Acloud whether there's a policy that would allow users to download and run applications without giving them elevated privileges. Their response was that no such policy exists.

Instead, their suggestion was to create a local administrator account that users could temporarily log into whenever they need to install or run software — then log back out and return to their standard user account. While this technically works, it defeats the core purpose of enforcing least privilege and creates a security risk, as users would still have full administrative rights during those sessions.

Ideally, we're looking for a policy configuration that:

• Keeps users as standard users (non-admin)
• Allows them to download and run trusted applications
• Prevents system-level changes, such as account management or settings modifications

Based on our understanding, this should be achievable with a properly scoped AppLocker or Endpoint Security policy in Intune. We’d appreciate confirmation or guidance on how to implement this securely and effectively.

Answer 1

The recommended approach here is install the apps as managed through the company portal. On enterprise devices, you should not allow users to download and install anything that can potentially cause issues. If you do want the users to install something or carry out tasks with elevated permissions then you have two options. LAPS and EPM.