{
  "verifiableProfileCount": 0,
  "enforcedProfileCount": 0,
  "opaqueProfileCount": 1
}

Application Control Profile

What this checks

Whether an Intune device configuration profile enforces Windows Defender Application Control (WDAC) or an equivalent allow-listing mechanism. The check distinguishes three states:

• Pass — an `EndpointProtectionConfiguration` profile with `enforcementMode: enforced` exists.
• Not assessable — a profile exists but uses a custom OMA-URI (policy content is opaque) or is in audit-only mode; enforcement cannot be confirmed via API alone.
• Fail — no application control profile was found.

Remediation for Fail

• In Intune > Devices > Configuration profiles, create a new profile: Platform = Windows 10 and later, Profile type = Endpoint protection.
• Under Windows Defender Application Control, set Application control code integrity policies to Enforce.
• Apply the profile to a pilot device group first. WDAC in enforce mode will block unsigned or unlisted executables — test thoroughly before broad deployment.
• Build your WDAC policy using the WDAC Wizard (available from Microsoft) to generate a base policy that allows Windows, Microsoft-signed apps, and your line-of-business applications.

Remediation for Not Assessable

• If you are using a custom OMA-URI profile to deploy WDAC, switch to the built-in Endpoint protection profile type so Intune can surface the enforcement mode via the standard Graph API property.
• If the profile is in audit mode, review the WDAC event log (`Microsoft-Windows-CodeIntegrity/Operational`) to identify all blocked items before switching to enforce mode.
• Once you have validated the allow-list in audit mode, update the profile's enforcement setting to Enforced.