Configure Application Groups
Organize applications into allowlists and blocklists using rule-based groups, then apply them across your managed endpoints.
Application Groups
Understand the two listing types and how Endpoint Central discovers the apps available to group.
What is an application group?
An application group is a named collection of applications that you build once and then reference in policies. Groups can be scoped by department, role, function, or any classification that fits your environment. All application control policies target groups rather than individual apps.
Endpoint Central's agents scan every managed endpoint and build an inventory of installed applications and their executables. That inventory is the source for everything you add to a group.
Allowlists and Blocklists
Every group is either an allowlist or a blocklist.
- Allowlist — only the applications in this group are permitted to run. Everything else is blocked. Use allowlisting to lock down endpoints to a known-good set of software and prevent unauthorized installations or malware from executing.
- Blocklist — the applications in this group are explicitly prevented from running. Use blocklisting to ban specific known-malicious or unauthorized programs while leaving everything else unrestricted.
Create Application Groups
Start from the Endpoint Central console and build a group using filters and custom rules.
Basic setup
- Go to Application Groups in the console.
- Click Create Allowlist or Create Blocklist depending on the type of group you need.
- Select Windows or Mac OS to specify which platform the group applies to.
- Enter a name for the group and, optionally, a description.
By default, all applications discovered on agents are shown under the All filter. Use the filter rules below to narrow the selection, then click Create to save the group.
Filters in Creating Application Groups for Windows
Six rule types let you precisely control which applications are added to a Windows group.
Available filter rules
Click the drop-down next to All to switch to a specific rule type. All discovered applications are evaluated against the rules you set, and those that match are added to the group.
Trusted Vendors
Trusted Vendors are software publishers that have digitally signed their products with a code-signing certificate, confirming the publisher's identity and the software's integrity. Trusting vendors without valid certificates exposes the network to backdoor attacks.
When you pick one or more trusted vendors, all applications published by those vendors are included in the group.
Product Name
Filter by Product Name to target specific applications from any vendor. Discovered applications are listed by product name for you to select.
Verified Executables
Applications consist of multiple executable files, each typically signed by the vendor. The Verified Executables rule surfaces those signed files so you can select exactly which executables to allow or block.
Any executable whose digital signature has been tampered with will be prevented from running — this rule is especially useful for tightening control below the application level.
File Hash
The File Hash rule identifies executables by their unique cryptographic hash rather than by a certificate. This means unsigned processes — those without valid digital certificates — are also surfaced for review and can be included in a group.
Folder Path
The Folder Path rule includes all applications under a specified directory, including items in sub-folders. It's a convenient way to group everything you've already organized into a trusted folder.
Windows environment variables are supported in the path. For the full list of supported system variables, see the supported system variables reference.
StoreApps Rule
The StoreApps rule discovers all Windows 10 and Windows 11 Store applications running on managed endpoints, letting you group modern Store apps alongside legacy desktop software.
Custom Rule
Use a Custom Rule when an application has not been detected in your network. Define criteria manually — vendor, product name, verified executable, or file hash — to create a rule for it.
Filters in Creating Application Groups for Mac
Five filter types let you control which applications land in a macOS group.
Available filter rules
The rules work the same way as on Windows: all discovered applications are evaluated against the criteria you set, and matches are added to the group. Click the drop-down next to All to select a specific rule type.
Vendors
Publisher verification confirms that the organization distributing an app is genuine. When you select one or more Vendors, every application from those publishers is included in the group.
Application
The Application filter lists discovered apps by name, letting you pick specific applications from any vendor.
Binary
On macOS, executable files are called binaries. This filter surfaces the binary files for discovered applications so you can allow or block at the executable level.
File hash
Identical in behavior to the Windows version: the File Hash rule identifies executables by their cryptographic hash, covering unsigned processes that other rules would miss.
Folder Path
Specify a directory path to include all applications stored in that folder. Collecting trusted apps into a single folder and using this rule is an efficient way to group them all at once.
Custom Rule
Define a Custom Rule for any application not yet discovered in your network by specifying its vendor, product name, verified executable, or file hash manually.
Search bar filters
Beyond the rule types above, the search bar lets you filter the application list by custom group, application type, and publisher credibility to narrow your selection further.
Managing Application Groups
Review a group's rules, export it for sharing, and import groups from a file.
Application Group Summary
Select any application group to open its summary view. The summary lists all rule details and any associated custom groups at a glance.
Importing & Exporting Application Groups
Groups can be exported or imported as .xlsx files, making it easy to back up configurations or replicate them across environments.
- To export, click the Export option next to the group. The file is downloaded as an .xlsx file with each filter rule in a separate sheet.
- To import, open the group creation or editing view and click Import, then select your .xlsx file.
When importing, you can choose to add the rules to the existing group or replace the current rules entirely. All rules in the file are incorporated on success. Any rule not already in the database is created automatically and marked as selected.
Allow All Child Processes
Grant trusted applications the ability to spawn child processes without being blocked.
What are child processes?
Child processes are processes launched by a running application. They can be a security risk, but many legitimate applications depend on them. This setting lets you designate specific trusted applications that are allowed to create child processes, reducing the attack surface while preserving functionality.
Configuring child process permissions
- Navigate to Child Process under Application Groups in the console.
- In Global Child Process Configuration, select the applications that should be permitted to run child processes.
- Click Apply.
