# Configure Application Groups Organize applications into allowlists and blocklists using rule-based groups, then apply them across your managed endpoints. **Last Updated On**: 27 Jul 2026 **15 minutes read** ## Prerequisites For macOS application groups, complete the [Mac prerequisites](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-mac-prerequisites.html) before creating a group. ## Application Groups Understand the two listing types and how Endpoint Central MSP discovers the apps available to group. ### What is an application group? Watch a full walkthrough of configuring application groups in Endpoint Central MSP: https://www.youtube-nocookie.com/embed/Axu9vkI7HxQ An **application group** is a named collection of applications that you build once and then reference in policies. Groups can be scoped by department, role, function, or any classification that fits your environment. All application control policies target groups rather than individual apps. Endpoint Central MSP's agents scan every managed endpoint and build an inventory of installed applications and their executables. That inventory is the source for everything you add to a group. ### Allowlists and Blocklists Every group is either an **allowlist** or a **blocklist**. - **Allowlist** — only the applications in this group are permitted to run. Everything else is blocked. Use allowlisting to lock down endpoints to a known-good set of software and prevent unauthorized installations or malware from executing. - **Blocklist** — the applications in this group are explicitly prevented from running. Use blocklisting to ban specific known-malicious or unauthorized programs while leaving everything else unrestricted. ## Create Application Groups Start from the Endpoint Central MSP console and build a group using filters and custom rules. ### Basic setup 1. Go to **Application Groups** in the console. 2. Click **Create Allowlist** or **Create Blocklist** depending on the type of group you need. 3. Select **Windows** or **Mac OS** to specify which platform the group applies to. 4. Enter a name for the group and, optionally, a description. ![create app group](https://www.manageengine.com/products/desktop-central/help/images/ac-create-app-group.png) Group creation form — name, platform, and initial filter options. By default, all applications discovered on agents are shown under the **All** filter. Use the filter rules below to narrow the selection, then click **Create** to save the group. ## Filters in Creating Application Groups for Windows Six rule types let you precisely control which applications are added to a Windows group. ### Available filter rules ![Animated overview of the Windows filter rule drop-down options](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-filter-windows.gif) Windows filter rules drop-down. Click the drop-down next to **All** to switch to a specific rule type. All discovered applications are evaluated against the rules you set, and those that match are added to the group. ### Trusted Vendors **Trusted Vendors** are software publishers that have digitally signed their products with a code-signing certificate, confirming the publisher's identity and the software's integrity. Trusting vendors without valid certificates exposes the network to backdoor attacks. When you pick one or more trusted vendors, all applications published by those vendors are included in the group. ![Trusted Vendors rule showing a list of verified software publishers to select](https://www.manageengine.com/products/desktop-central/help/images/ac-vendors-rule.png) Trusted Vendors filter — select publishers by verified certificate. ### Product Name Filter by **Product Name** to target specific applications from any vendor. Discovered applications are listed by product name for you to select. ![Product Name rule displaying a list of discovered application names](https://www.manageengine.com/products/desktop-central/help/images/ac-product-rule.png) Product Name filter — choose individual applications regardless of publisher. ### Verified Executables Applications consist of multiple executable files, each typically signed by the vendor. The **Verified Executables** rule surfaces those signed files so you can select exactly which executables to allow or block. Any executable whose digital signature has been tampered with will be prevented from running — this rule is especially useful for tightening control below the application level. ![Verified Executables rule listing digitally signed executable files](https://www.manageengine.com/products/desktop-central/help/images/ac-exe-rule.png) Verified Executables filter — control at the individual executable level. ### File Hash The **File Hash** rule identifies executables by their unique cryptographic hash rather than by a certificate. This means unsigned processes — those without valid digital certificates — are also surfaced for review and can be included in a group. ![File Hash rule listing executable files identified by their hash value](https://www.manageengine.com/products/desktop-central/help/images/ac-file-hash-rule.png) File Hash filter - covers unsigned executables that other rules would miss. ### Folder Path The **Folder Path** rule includes all applications under a specified directory, including items in sub-folders. It's a convenient way to group everything you've already organized into a trusted folder. Windows environment variables are supported in the path. For the full list of supported system variables, see the [supported system variables reference](https://www.manageengine.com/desktop-management-msp/help/application-control/supported-system-variables.html). ![Folder Path rule with a text field for entering the directory path](https://www.manageengine.com/products/desktop-central/help/images/ac-folder-path-rule.png) Folder Path filter — enter a path to include everything under that directory. ### StoreApps Rule The **StoreApps** rule discovers all Windows 10 and Windows 11 Store applications running on managed endpoints, letting you group modern Store apps alongside legacy desktop software. ![StoreApps rule listing Windows Store applications discovered on endpoints](https://www.manageengine.com/products/desktop-central/help/images/ac-storeapps-rule.png) StoreApps filter — include Windows 10/11 Store apps in your group. ### Custom Rule Use a **Custom Rule** when an application has not been detected in your network. Define criteria manually — vendor, product name, verified executable, or file hash — to create a rule for it. ![Animated walkthrough of creating a Custom Rule with manually entered criteria](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-custom-rule.gif) Custom Rule — define criteria for apps not yet discovered in the network. ## Filters in Creating Application Groups for Mac Five filter types let you control which applications land in a macOS group. ### Available filter rules ![Animated overview of the macOS filter rule options](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-filters-mac.gif) macOS filter rules drop-down. The rules work the same way as on Windows: all discovered applications are evaluated against the criteria you set, and matches are added to the group. Click the drop-down next to **All** to select a specific rule type. ### Vendors Publisher verification confirms that the organization distributing an app is genuine. When you select one or more **Vendors**, every application from those publishers is included in the group. ![macOS Vendors rule showing a list of verified publishers](https://www.manageengine.com/products/desktop-central/help/images/ac-vendors-rule-mac.png) Vendors filter for macOS — select verified publishers. ### Application The **Application** filter lists discovered apps by name, letting you pick specific applications from any vendor. ![macOS Application rule listing discovered applications by name](https://www.manageengine.com/products/desktop-central/help/images/ac-application-rule-mac.png) Application filter for macOS — choose individual apps by name. ### Binary On macOS, executable files are called **binaries**. This filter surfaces the binary files for discovered applications so you can allow or block at the executable level. ![Binary rule listing macOS executable (binary) files](https://www.manageengine.com/products/desktop-central/help/images/ac-binary-rule-mac.png) Binary filter — target individual macOS executables. ### File hash Identical in behavior to the Windows version: the **File Hash** rule identifies executables by their cryptographic hash, covering unsigned processes that other rules would miss. ![macOS File Hash rule listing executables identified by hash value](https://www.manageengine.com/products/desktop-central/help/images/ac-file-hash-mac.png) File Hash filter for macOS — catches unsigned processes. ### Folder Path Specify a directory path to include all applications stored in that folder. Collecting trusted apps into a single folder and using this rule is an efficient way to group them all at once. ![macOS Folder Path rule with a directory path input field](https://www.manageengine.com/products/desktop-central/help/images/ac-folder-path-mac.png) Folder Path filter for macOS — enter a path to include everything under that directory. ### Custom Rule Define a **Custom Rule** for any application not yet discovered in your network by specifying its vendor, product name, verified executable, or file hash manually. ![Animated walkthrough of creating a macOS Custom Rule](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-custom-rule-mac.gif) Custom Rule for macOS — define criteria manually for undetected apps. ## Search bar filters Beyond the rule types above, the search bar lets you filter the application list by **custom group**, **application type**, and **publisher credibility** to narrow your selection further. ![Search bar filter options showing custom group, application type, and publisher credibility fields](https://www.manageengine.com/sites/meweb/images/desktop-central/help/application-control/ac-filters.gif) Search bar filters — refine the application list before finalizing a group. ## Managing Application Groups Review a group's rules, export it for sharing, and import groups from a file. ### Application Group Summary Select any application group to open its **summary view**. The summary lists all rule details and any associated custom groups at a glance. ![Application Group Summary screen showing rule details and custom group associations](https://www.manageengine.com/products/desktop-central/help/images/ac-app-summary.png) Group summary — rule breakdown and associated custom groups. ### Importing & Exporting Application Groups Groups can be exported or imported as **.xlsx files**, making it easy to back up configurations or replicate them across environments. 1. To **export**, click the **Export** option next to the group. The file is downloaded as an .xlsx file with each filter rule in a separate sheet. 2. To **import**, open the group creation or editing view and click **Import**, then select your .xlsx file. ![Export option next to an application group in the group list](https://www.manageengine.com/products/desktop-central/help/images/ac-export-app-group.png) Export an application group as an .xlsx file. ![Import option shown during application group creation](https://www.manageengine.com/products/desktop-central/help/images/ac-import-app-group-1.png) Import an .xlsx file while creating or modifying a group. When importing, you can choose to **add the rules to the existing group** or **replace the current rules entirely**. All rules in the file are incorporated on success. Any rule not already in the database is created automatically and marked as selected. ![Import options dialog letting the user choose to add or replace existing rules](https://www.manageengine.com/products/desktop-central/help/images/ac-import-app-group-2.png) Choose whether to append or replace rules during import. ## Allow All Child Processes Grant trusted applications the ability to spawn child processes without being blocked. ### What are child processes? **Child processes** are processes launched by a running application. They can be a security risk, but many legitimate applications depend on them. This setting lets you designate specific trusted applications that are allowed to create child processes, reducing the attack surface while preserving functionality. **Note:** Child processes of an application will continue to run even if that application is otherwise blocked by a policy. ### Configuring child process permissions 1. Navigate to **Child Process** under Application Groups in the console. 2. In **Global Child Process Configuration**, select the applications that should be permitted to run child processes. 3. Click **Apply**. ![Child Process configuration screen showing the application selection list and Apply button](https://www.manageengine.com/products/desktop-central/help/images/ac-child-process.png) Global Child Process Configuration — select trusted applications and apply. ## Related - [Mac prerequisites for Application Control](https://www.manageengine.com/desktop-management-msp/help/application-control/configure-mac-prerequisites.html) - [Supported system variables (Windows)](https://www.manageengine.com/desktop-management-msp/help/application-control/supported-system-variables.html) - [Application Control FAQ](https://www.manageengine.com/desktop-management-msp/help/application-control/ac-faq.html)