Comprehensive Guide to Application Control Strategies
A structured approach to implementing a strict allowlist policy — from discovery and grouping through full zero-trust enforcement.
Foundation
Organize endpoints and applications before creating policies
Group devices before creating targeted, manageable application policies.
Create computer groups based on enterprise requirements
Group devices by application usage or privilege requirements to support effective application control. After grouping endpoints, push policies tailored to each group with a single click.
Use the Custom Groups feature in Endpoint Central to build endpoint groups that reflect your organization — by team, role, location, or any other dimension that maps to real policy differences.
Group applications by department or function
Application Groups let you cluster applications by similarity, business function, or department. This lets you map applications to the users who need them — and prevents employees from accessing software that's irrelevant to their role.
Policies are configured at the group level, so administrators manage one allowlist for an entire department rather than individual entries for hundreds of executables. This approach also reduces the risk of unauthorized application usage caused by gaps in coverage.
Learn more about Application Groups.
Visibility
Audit before enforcing
Review application usage before enforcing restrictions.
Run in Audit Mode to review application usage
Review actual application usage before enforcing a policy. Audit Mode lets all allowlisted and unmanaged applications run while collecting events — giving administrators the data they need to make informed decisions about what to allow or block.
Learn about Audit Mode.
Enforcement
Enforce Strict Mode and manage user requests
Minimize attack surface while keeping productivity intact.
Switch to Strict Mode for zero-trust enforcement
Once the allowlist is built with all necessary applications, switch to Strict Mode to enforce a zero-trust security model. Only allowlisted applications can run — no unmanaged applications are permitted, minimizing the attack surface significantly.
Learn about Strict Mode.
Developer tools can start unsigned or frequently changing executables. Review the actual executable and parent process before defining an exception. A File Hash rule matches an exact executable revision; a Folder Path rule covers the matching directory content, so choose a trusted, appropriately controlled location rather than a broad user-writable tree. For ad-hoc needs, review Request Access or time-bound Application Allowlisting JIT. Check the required scope and the effective rules before granting access.
Let users request access to business-critical applications
Business needs change — a support technician may occasionally need a video-conferencing tool that isn't in the allowlist. Strict Mode blocks unmanaged applications. The Request Access feature provides a controlled access process. Users submit a request with a justification. Administrators can approve, deny, or permanently add the application to a group.
Learn about Request Access.