Skip to content
MitoMito Docs

MT.1179: Ensure App Control for Business is enabled.
ID MT.1179
Severity High
Suite Mito
Product Intune
Feature Endpoint security
Security area Devices and endpoints
Resource type Tenant
User impact of fixing High
Effort to fix High
Framework controls nist-800-53-r5:CM-7(5) Least Functionality | Authorized Software — Allow-by-exception
MITRE ATT&CK T1204.002
Reads from Microsoft Graph
Licence needed INTUNE_A

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Ensure at least one Intune App Control for Business (formerly Windows Defender Application Control / WDAC) policy is configured.

App Control for Business restricts which applications and drivers are allowed to run on Windows devices using code integrity policies. This is one of the most effective defenses against malware, ransomware, and unauthorized software because it blocks untrusted executables from running at all — even if they bypass antivirus detection.

Key settings this test evaluates:

  • Build Options: Whether the policy uses built-in controls (built_in_controls_selected) or a custom uploaded policy (upload_policy_selected)
  • Policy XML: For uploaded policies, whether an XML code-integrity payload is actually present (not empty)
  • Audit Mode: Whether the policy is in audit mode (logging only) or enforce mode (blocking)
  • Managed Installer: Whether apps deployed via Intune/SCCM are automatically trusted
  • Intelligent Security Graph (ISG) Reputation: Whether apps with good reputation scores are trusted

The test passes if at least one App Control for Business policy is enforcing (audit mode disabled) AND has either built-in controls selected or an uploaded XML policy with a non-empty payload. Audit-only policies and upload-mode policies with no XML payload are reported but do not satisfy the pass criterion, because they do not block untrusted executables.

Remediation action

Section titled “Remediation action”
  1. Navigate to Microsoft Intune admin center.
  2. Go to Endpoint security > Application control.
  3. Click + Create policy.
  4. Set Platform to Windows 10 and later and Profile to App Control for Business.
  5. Enter a policy name (e.g., “App Control - Audit Mode”).
  6. Configure the following settings:
    • App Control for Business: Select Built-in controls
    • Audit mode: Enabled (start in audit mode to identify blocked apps)
    • Trust apps from managed installer: Enabled (trusts Intune-deployed apps)
    • Trust apps with good reputation: Disabled (optional — ISG adds convenience but reduces strictness)
  7. Assign the policy to a test device group first.
  8. Monitor blocked/audited apps in Microsoft Defender for Endpoint > Reports > Application control.
  9. After validating that legitimate apps are not being blocked, transition to Enforce mode.
Section titled “Related links”

Mito check. Author: OfirGavish. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.