Question

Your organization has deployed an App Control for Business (WDAC) base policy in enforcement mode to a group of Windows 11 workstations. The base policy trusts apps installed by the Intune Management Extension as a managed installer. The finance team now needs to run a specialized line-of-business application that was installed manually by a technician using a USB drive, so it was not tracked by the managed installer. The app is being blocked. You must allow this specific app to run without weakening the base policy or re-enabling unmanaged installations broadly. What should you do?

Accepted Answer

Create a supplemental App Control policy that authorizes the application by its file signature or hash, and deploy it to the finance devices.

Answer

Switch the base policy from enforcement mode to audit mode on the finance devices.

Answer

Add the technician's account to the managed installer configuration so future manual installs are trusted.

Answer

Disable the App Control for Business policy assignment for the finance group and rely on Defender Antivirus instead.