Restrict software installation for standard users using Microsoft Intune

MChand91 0

I want to restrict software installation on windows 10/11 client devices those are joined to the Azure Active Directory. I want allow users to install application via company portal only.Also I need to restrict software installation that are using user context. Thank you

1 answer

Konstantinos Passadis 17,376 Reputation points MVP

2023-05-06T09:34:08.2466667+00:00

Hello

Welcome to Microsoft QnA!

You can start by creating a Configuration Profile to the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com) for Windows 10 and above

Choose Templates - Endpoint Protection

Save and Assign the Configuratin Profile to a Group of Users . Test it and then Appy to a larger group

Give time before it can take effect !!!

Kindly mark the answer as Accepted and Upvote in case it helped or post your feedback to help !

Regards
Please sign in to rate this answer.
MChand91 0 Reputation points

2023-05-06T10:07:12.57+00:00

Hi, I did that but that is not fulfilled my requirement. As an example by doing this user can install MS Teams. I want to reatrict that kind of installations

Konstantinos Passadis 17,376 Reputation points MVP

2023-05-06T10:36:54.85+00:00

To restrict installations of specific apps such as Microsoft Teams on Windows 10/11 client devices joined to Azure AD, you can use the Intune App Protection Policies.

First, create an App Protection Policy in the Azure portal by navigating to Intune App Protection > App protection policies and click on the "+ Create policy" button. Under "Policy settings", select "Windows" as the platform and "Windows Information Protection (WIP)" as the policy type. Under "Protected apps", click on the "+ Add apps" button and select the apps that you want to restrict. In this case, you can select Microsoft Teams. Under "Data protection settings", configure the required settings such as "WIP protection level" and "Allow user to override app restrictions" according to your requirements. Assign the policy to the relevant Azure AD user or group.

Kindly mark the answer as Accepted and Upvote in case it helped or post your feedback to help !

Regards

Alex Saujon 0 Reputation points

2023-09-14T19:11:18.4866667+00:00

This replies are outdated (already!). App Store no longer exists as an option in the Endpoint Protection template. In Azure, App Protection Policy is no longer an option. Within Intune, App Protection Policies do not cover Win10/11.

What can I do to prevent users from installing apps on their own such as Chrome or MS Teams?

Konstantinos Passadis 17,376 Reputation points MVP

2023-09-15T17:55:43.7233333+00:00

Hello @Alex Saujon !

I would recommend to disable Local Administrator

Intune now provides via Defender, the Endpoint Privilege Management option in case you need Admin Access on occasions

Thats the whole deal , to have Managed Devices does not offer the layer of security when Local Admin is enabled , at least in my opinion !

Thank you for your message , you could also start a new thread and take it from there !

Regards

JasonO 21 Reputation points

2024-05-13T13:54:56.82+00:00

The instructions say to use the EndPoint Protection template but the screen shot shows using the Device Restriction template. The latter is the correct template to use in this case.
Sign in to comment

Share via

Restrict software installation for standard users using Microsoft Intune

1 answer