How to Allow Users, Install only Whitelisted Applications on Windows 10

Question

Hello,

I have Windows 10 users joined to Azure AD and I have given all of them Admin rights. This means they can install any software they like. But I want to create a Whitelist of software that allows them to install only those software. So how can I create such a policy in Azure AD which restricts, out of the Whitelisted applications. If it is not possible in Azure then kindly suggest me a solution please.

Thanks,

SY

Answer 1

@Mr. Sajid Thanks for reaching out. As I understand from your problem statement you want to find a way which allows you to control the Application installations on windows 10 environment.

Currently Azure AD does not have this capability to provide that dedicated endpoint solution. In your particular scenario you will need to use Microsoft Endpoint manager (Known as Intune).
You will need to enroll your devices (Windows 10) to Intune and then apply policies to control the behaviors.

For whitelisting Application on windows 10, you can deploy App locker configuration files from Intune service which allows you to control/block the execution of any software on windows 10.

You can read more here : https://www.vansurksum.com/2020/02/24/a-guide-to-implementing-applocker-on-your-modern-workplace/

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

If you are using MDE you should consider Application Control instead. This is a more modern and dynamic solution to AppLocker: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mde-p1-setup-configuration?view=o365-worldwide#application-control

Terminology reference: https://insights.dice.com/2020/07/17/whitelist-blacklist-the-new-debate-over-security-terminology/