# Application Control: Policy Deployment Last Updated On: 27 Jul 2026 7 minutes read Associate application groups with device groups, choose a policy mode, and manage enforcement, notifications, revocation, and access events. ## Associating Application Groups Link application allowlists or blocklists to specific device groups before deploying. ### How to associate applications with custom groups Policy deployment walkthrough. Users with similar roles often need the same set of applications. Endpoint Central MSP lets you associate multiple allowlists with a custom device group — and a single allowlist with multiple groups — so policies scale without duplication. 1. Navigate to **Application Groups** to create an Allowlist or Blocklist. To know more about the creation of application groups, refer to [this page](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html). 2. Under **Deployment**, go to **Deploy Policy** and create or select a custom group. 3. Select the application group to associate with that custom group. 4. If required, enable **[Associate Privileged Application List](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-deployment.html#configuring-privilege-management)** for privilege management. 5. Select **[Audit Mode](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-policy-deployment.html#audit-mode)** or **[Strict Mode](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-policy-deployment.html#strict-mode)** as the enforcement level. 6. While running in Strict mode, the **[unmanaged applications can be requested](https://www.manageengine.com/desktop-management-msp/help/application-control/unmanaged-application-request.html)** if the option is enabled. 7. Configure **[Custom Notifications and Alert Messages](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-policy-deployment.html#user-notification-settings)** as needed. 8. Click **Deploy** or **Deploy Immediately**. ![Associate App Group dialog showing custom group and application group selection](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-associate-group.png) *Associating an application group with a custom device group.* ## Flexibility Regulator Choose the enforcement level that matches your organization's current security posture. ### Audit Mode Audit Mode is the recommended starting point for organizations new to application control. All allowlisted and unmanaged applications run without restriction, while events are collected to help administrators understand which applications users actually need. **Note** Audit Mode logs all running applications and prevents blocklisted ones from executing, but does not provide complete protection. Use it as a discovery and baselining phase before moving to Strict Mode. ![Audit Mode configuration screen](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-audit-mode.png) *Audit Mode — all applications run, events are collected.* ### Strict Mode Strict Mode enforces a zero-trust security model. Only applications explicitly included in the allowlist can execute. Any attempt to run an unmanaged application is immediately blocked and the user is notified. ![Strict Mode configuration screen](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-strict-mode.png) *Strict Mode — only allowlisted applications can run.* ## User Notification Settings Show a custom alert to end users when an application is blocked. ### Configuring custom block notifications Administrators can configure a customized alert message to display on the user's device whenever an application is blocked by policy. The notification can be tailored as needed and applied to all blocked applications or to all applications excluding Microsoft Store apps. ![User Alert Settings configuration panel](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-alert-settings.png) *Custom notification configuration for blocked applications.* ## Revoking, Events, and Precedence Manage the policy lifecycle and resolve conflicts across overlapping policies. ### Revoking Application Policy Deployed policies can be revoked by deleting the policy or by removing the target machine from its associated custom group. Policy changes, deletions, group modifications, and updates to unmanaged applications are synchronized with agent machines during their 90-minute refresh cycles. In environments with a Distribution Server, changes are replicated there first and then pushed to agents. ![Delete Application Group](https://www.manageengine.com/products/desktop-central/help/images/ac-delete-policy.png) *Deleting a policy revokes enforcement on associated endpoints.* ### Application Access Events The **Access Events** view shows a full record of application access attempts on a managed endpoint — both successfully launched and blocked applications. Use it to monitor user activity, verify policy enforcement, and investigate unauthorized access attempts. 1. Navigate to **Systems** and select the target machine. 2. Open the **Events** tab and choose **Access Events** from the left panel. 3. Click **Update Now** in the top-right corner to refresh events from the endpoint. Each event shows the application name, user, event type (Allowed or Blocked), event time, remarks, and the associated application group. ![Access Events log showing allowed and blocked application attempts](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-access-events.webp) *Access Events — a per-machine record of application access attempts.* ### Policy Precedence When both allowlist and blocklist policies share the same filter rule and apply to the same endpoint, **Policy Precedence** determines which takes priority. Configure this under **Settings → General Settings**. **Note** If an application is blocked via the vendor rule and allowed via the product name rule, changing the precedence setting will not affect the outcome — different filter types are resolved by a fixed built-in order, not by this setting. ![Policy Precedence settings](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-policy-precedence.png) *Policy Precedence — configure conflict resolution for overlapping rules.* ## Related - [Configure application groups](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-app-groups.html) - [Unmanaged applications](https://www.manageengine.com/desktop-management-msp/help/application-control/unmanaged-applications.html) - [Privilege management policy deployment](https://www.manageengine.com/desktop-management-msp/help/endpoint-privilege-management/epm-policy-deployment.html) - [How Application Control works](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-how-it-works.html) - [Application Control FAQ](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-faq.html)