Windows App Control for Business (WDAC) is configured and assigned via Intune

Overview

Without App Control for Business (formerly Windows Defender Application Control, WDAC), every executable a user can drop onto disk — phishing-delivered payloads, malicious npm or PyPI dependencies, sideloaded utilities from a USB stick, ransomware droppers, living-off-the-land binaries that re-package legitimate Microsoft signed tools — can run with the user’s full token, against corporate data and Entra ID resources, before any Endpoint Detection and Response (EDR) signal has a chance to fire. EDR is reactive: it sees and may quarantine after malware has executed, often after data has already been staged for exfiltration or after persistence has been established. App Control disrupts this kill chain at the kernel level by establishing a Windows code-integrity policy that the kernel itself enforces before any executable starts: only files signed by trusted publishers, on a trusted file path, or specifically allow-listed by the organisation are permitted to run; unsigned or unknown executables fail to launch even if SYSTEM-level malware tries to invoke them. Microsoft delivers App Control for Business via Intune’s Endpoint Security → App Control for Business policy, which deploys a Windows Code Integrity (WDAC) policy to managed Windows endpoints. Without an enforced App Control policy assigned to the Windows fleet, ransomware and living-off-the-land binaries continue to have an unimpeded path to execution, and the entire Defender / compliance / Conditional Access pipeline downstream of execution is reduced to a detection-and-cleanup story rather than a prevention story.

Remediation

• App Control for Business policy for endpoint security in Intune
• Manage approved apps for Windows devices with App Control for Business policy and Managed Installer for Microsoft Intune
• Windows Defender Application Control (WDAC) design guide
• Audit App Control policies — testing before enforcement
• Microsoft-recommended block rules for App Control for Business
• Assign device profiles in Microsoft Intune

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Devices
Category	Devices
Product	Intune
Feature	Endpoint security
Area	Devices and endpoints
ATT&CK	T1204.002 Malicious File
Licence	INTUNE_A
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.