how to block installation of specific apps in intune managed device

Question

Hello,

We have cloud pc (w365)that managed with Intune ,How we can block installation of particular apps in windows 10/11 device.

Thanks
Richa

Answer 1

Hello @Richa kumari !

You can have a look at Applocker

AppLocker can help you:

    Define rules based on file attributes that persist across app updates, such as the publisher name (derived from the digital signature), product name, file name, and file version. You can also create rules based on the file path and hash.
    Assign a rule to a security group or an individual user.
    Create exceptions to rules. For example, you can create a rule that allows all users to run all Windows binaries, except the Registry Editor (regedit.exe).
    Use audit-only mode to deploy the policy and understand its impact before enforcing it.
    Create rules on a staging server, test them, then export them to your production environment and import them into a Group Policy Object.
    Simplify creating and managing AppLocker rules by using Windows PowerShell.

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 2

I would also like to see a built-in Intune solution to this question without the use of Applocker, which I have found to have inconsistent results with Appdata executables. Something like the Jamf's "Restricted Apps" feature for Macs: easy to use and understand with consistent results.

Answer 3

Hello @Richa kumari !

In that case you have the option to lock down apps only from the Store via Device Restrictions

https://learn.microsoft.com/en-us/mem/intune/apps/store-apps-microsoft

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards