Create a Device Level Windows Application Restriction Policy

Admins can configure this policy to restrict user access to designated applications. These restrictions can be configured for both individual devices and devices groups as needed. The device must be enrolled in JumpCloud MDM.

Prerequisites

• Target Windows devices must be enrolled in Windows MDM (Mobile Device Management).
• Target devices must be running Windows 10 version 1511 (10.0.10586), or any later versions. This policy is supported on the following Windows editions:
  • Windows Pro
  • Windows Enterprise
  • Windows Education
  • Windows SE
  • IoT Enterprise
  • IoT Enterprise LTSC
• For more information on device compatibility, see Agent Compatibility, System Requirements, and Impacts.

Considerations

• This policy comes into effect immediately after it is applied to the applicable Windows devices.

Creating the Policy

To create an Application Restriction policy for Windows devices, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
   • Select the Windows tab.
   • Search and select the policy name and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

• In the Search Inbox Apps & Components section, search and select the system apps that you want to be blocked.
• In the Blocked File Extensions section, add the file extensions that you want to be blocked.
  • Enter the Publisher Name and Product Name.
  • Enter the Binary Name.
  • Select the File Extension from the dropdown. Add more file extensions using the Add button.

• In the Blocked File Path section, add the exact file path that you want to be blocked. Use the + icon to add more file paths.
  • See Microsoft's support documentation for Understanding the path rule condition in AppLocker to learn more.

• In the Blocked Microsoft Store Apps section, search and select the Microsoft Store apps that you want to be blocked.

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the Device Groups tab. Select one or more device groups where you want to apply this policy to. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Windows device that is enrolled in MDM.
• Or, select the Devices tab. Select one or more devices where you want to apply this policy.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.

Once the policy is applied, when a user attempts to launch an application that is included in the policy list, the user will be blocked from accessing that application.