Unmanaged Applications

Last Updated On: 14 Jul 2026|

6 minutes read |

Understand what unmanaged applications are, why they matter, and how to bring them under policy control.

What are unmanaged applications?

Any application that exists outside your defined allowlists and blocklists is unmanaged — and unmonitored.

The risk of over-relying on basic lists

An unmanaged application is any executable that exists on an endpoint but is not included in any allowlist or blocklist. Because no policy governs it, its behavior is unmonitored. Relying only on a basic allowlist — without accounting for every application present in your environment — leaves gaps that weaken your overall security posture.

Building comprehensive policies that cover all discovered applications, not just the frequently-used ones, is essential for effective network security and a genuine zero-tolerance posture toward unmanaged software.

The security vs. productivity trade-off

There are two fundamental strategies for handling unmanaged applications: allow them or block them. A strict Zero Trust approach favors blocking, but an overly restrictive allowlist creates operational friction — access requests pile up and newly installed applications are blocked by default until reviewed.

Tip

Balancing security and productivity is the core challenge of unmanaged application management. The goal is not to block everything indiscriminately, but to ensure nothing runs without a deliberate policy decision behind it.

Using flexibility modes to assess unmanaged apps

Start in Audit Mode to understand what's running, then move to Strict Mode once your lists are complete.

Audit Mode for discovery

In Audit Mode, both allowlisted and unmanaged applications run simultaneously while events are collected. This lets administrators observe actual application usage patterns before committing to any blocking decisions.

After analysis, each unmanaged application can be resolved by adding it to an allowlist or blocklist. Once all unmanaged applications have been addressed, the policy can be switched to Strict Mode for full enforcement.

Tip

Organizations that want a more gradual approach can remain in Audit Mode with ongoing monitoring rather than switching to Strict Mode all at once. A zero-unmanaged-application count is the ideal goal.

Resolving unmanaged applications

Unmanaged applications per policy are visible in the deployment view and can be resolved in several ways.

Viewing unmanaged applications

Unmanaged applications for each deployed policy are visible under Unmanaged Apps within the relevant group in Deploy Policy. From there, each application can be handled in one of three ways:

Add to Allowlist or Blocklist — select the application and add it directly to an existing list.
Move to Existing App Group — move the application into an application group, automatically associating it with the custom group that the policy is deployed to.
Restore — after an application has been moved to a list, this option returns it to unmanaged status from within Application Groups.

Unmanaged Applications screen showing a list of applications with options to allowlist, blocklist, or move them.

Unmanaged Apps — resolve each unmanaged application by adding it to a list or moving it to an existing group.

Restore Unmanaged Application option in the Application Groups view.

Restore — return a previously categorized application back to unmanaged status.

Note

In Strict Mode, users can request access to unmanaged applications if that option is enabled during policy deployment. Learn more.