Traditional signature-based antivirus solutions are increasingly ineffective against modern fileless malware, zero-day exploits, and advanced persistent threats (APTs). To secure enterprise endpoints, organizations must shift from a reactive “default-allow” posture to a strict “default-deny” Zero Trust model. Windows Defender Application Control (WDAC) is Microsoft’s premier endpoint security framework, enforcing hardware-backed Code Integrity policies that mathematically block any unauthorized binary or script from executing. However, managing strict allowlists in highly dynamic corporate environments is notoriously difficult. To solve this, Microsoft Intune allows administrators to deploy WDAC utilizing the “Managed Installer” capability, automatically trusting any software deployed by an authorized enterprise management system.
The Mechanics of a WDAC Managed Installer
A WDAC Managed Installer policy relies on a specialized rule within the Code Integrity XML configuration. When a process designated as a Managed Installer (such as the Microsoft Intune Management Extension or Microsoft Configuration Manager) writes a new executable file to the disk, the Windows kernel utilizes the NTFS Extended Attributes (EA) to tag that file with a cryptographic marker.
When the user subsequently attempts to launch that application, the WDAC enforcement engine in the Windows kernel inspects the binary. Even if the application’s publisher certificate is not explicitly listed in the global WDAC allowlist, the kernel will permit execution exclusively because it detects the trusted Managed Installer EA tag. This completely eliminates the administrative burden of manually cataloging hashes and publisher certificates for every legitimate line-of-business application in the organization.
Generating the WDAC XML Policy
Before deploying via Intune, security engineers must generate a foundational WDAC policy using the ConfigCI PowerShell module on a reference Windows 11 workstation. This policy must explicitly enable the Managed Installer rule option (Rule Option 14).
Open an elevated PowerShell prompt and generate a baseline policy that trusts the core Windows operating system components:
New-CIPolicy -Level PcaCertificate -FilePath C:\WDAC\Baseline.xml -UserPEs
Set-RuleOption -FilePath C:\WDAC\Baseline.xml -Option 3 # Enable Audit Mode initially
Set-RuleOption -FilePath C:\WDAC\Baseline.xml -Option 14 # Enable Managed InstallerConvert the human-readable XML configuration into the binary format (.bin or .cip) required by the Windows kernel for enforcement:
ConvertFrom-CIPolicy -XmlFilePath C:\WDAC\Baseline.xml -BinaryFilePath C:\WDAC\ManagedInstallerPolicy.binDeploying the Policy via Microsoft Intune
With the binary policy created, you must distribute it to the enterprise fleet utilizing Microsoft Intune Mobile Device Management (MDM). Modern Intune environments support direct deployment of WDAC custom policies via OMA-URI.
- Navigate to the Microsoft Intune admin center.
- Go to Devices > Configuration profiles > Create profile.
- Select Windows 10 and later as the platform, and Templates > Custom as the profile type.
- Define the OMA-URI setting to target the ApplicationControl CSP. The strict path requires the unique GUID of your generated policy.
- Name: WDAC Managed Installer Enforcement
- OMA-URI:
./Vendor/MSFT/ApplicationControl/Policies/<Insert-Policy-GUID-Here>/Policy - Data type: Base64 (file)
- Upload your
ManagedInstallerPolicy.binfile.
Enabling Intune as the Authorized Agent
Deploying the WDAC policy alone is insufficient; you must explicitly instruct Windows to recognize the Intune client agent as the authorized Managed Installer. This requires deploying a specialized AppLocker configuration, as WDAC borrows AppLocker’s file-tagging infrastructure to apply the NTFS Extended Attributes.
Within the Intune admin center, you do not need to create a custom AppLocker XML manually. Microsoft provides a built-in toggle.
- Navigate to Endpoint security > Application control.
- Create a new policy using the Managed Installer profile.
- Assign this profile to the same device groups receiving your WDAC OMA-URI deployment.
Upon policy synchronization, the Windows 11 client will activate the Application Identity service (AppIDSvc) and configure the Intune Management Extension (AgentExecutor.exe) as a trusted installer. From that moment forward, any MSI or Win32 application pushed remotely via Intune will be cryptographically tagged, allowing seamless execution while fundamentally blocking all unapproved user downloads, script executions, and unauthorized portable applications.