Configure the App Blocking Library Item

This Library Item is available for Mac computers, Windows computers, and Android devices

The App Blocking Library Item lets you block applications from running on macOS, Windows, and Android devices. When a user attempts to open a blocked application, it will be prevented from launching. On macOS, the app closes and displays a block message. On Windows, blocking is powered by AppLocker. With Android work profile enrollment, App Blocking applies to the personal profile only. It blocks installation there, and Android uninstalls a blocked app that is already installed. The managed work profile is handled separately. Deploy and update work apps through managed Google Play, not through App Blocking. To block apps on iOS or iPadOS devices, use an Apple Restrictions Library Item instead.

As of January 8, 2025, App Blocking is configured using the App Blocking Library Item. This replaces the previous Application Blocking Parameter for macOS. Blueprints that already include the Parameter can still be edited, but the Parameter cannot be added to Blueprints that do not already have it.

Create an App Blocking Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.

Navigate to Library

Navigate to the Library and select Add Library Item.

Select App Blocking

Search for and select App Blocking.

Name the Library Item

Give the Library Item a Name.

Select Platforms

Under Install on, select one or more platforms (Apple, Windows, Android).

Assign the Library Item

Under Assignment Maps, select Assign.

Iru Endpoint web application showing App Blocking Library Item Install on and Blueprint assignment

In the Library Item, blocking is split into Apple only settings, Windows only settings, and Android only settings sections, so you configure each platform in its own area.

Platform-Specific Configuration

Mac
Windows
Android

Mac Settings

On macOS, App Blocking evaluates running applications against the rules you configure. When a launch matches a block rule, the app stops immediately and the user sees the Message from the Library Item.Under Block apps, expand Apple only settings, then Mac only settings.

Add a block rule

Select a block method, choose how the value is matched, and enter the value. Select Add block rule to add another rule.

Select match type

Choose one of these match types:

Contains: Matches values that contain the string.
Exact: Matches the exact string.
Regex: Matches a Swift regular expression.

Iru Endpoint web application showing App Blocking Apple only settings with Mac only settings expanded, block rules, and notification fields

Customize the block message

Edit Message, Button title, and Button URL. Button title and Button URL control the More Info button. The default button title is Learn More.

Save configuration

Select Save.

Blocking an Application from a Device Record (Mac)

You can add an app to an existing or new App Blocking Library Item from the Apps tab of a Mac device record. Iru prefills the app identifiers and values for you to review before saving the rule.

Open device record

Open the record for a Mac with the app installed.

Navigate to Apps tab

Select the Apps tab and locate the app.

Block the application

Select the ellipsis for the app, then select Block Application.

Select Library Item

Under Add rule to the following Library Item(s), select an existing App Blocking Library Item, or type a name and select the option to create a new one.

Review app details

Review the prefilled Process identifier, Full path to application, By Bundle ID, and By Developer ID values. Clear any identifier you do not want the rule to use, or adjust its value or match type.

Save the rule

Select Save.

Example: Find a macOS App Bundle ID

To find the bundle ID of a macOS app, you can use the codesign command in Terminal, replacing /path/to/yourapp.app with the path to your desired application:

codesign -dr - /path/to/yourapp.app

The output of this command will include information about the app, including the Team ID, Bundle ID, and Code Requirement which can be helpful when creating a Privacy Library Item. The Bundle ID will usually be at the end of the output, after the word identifier. In the example output below, the Bundle ID for Keynote is com.apple.iWork.Keynote.

identifier=com.apple.iWork.Keynote

User Experience

On Mac, users attempting to open a blocked app will see the configured block message.
If you set a Button title and Button URL, users can select that button for more information. The default title is Learn More. See User Experience with Application Blocking.

Windows Settings

On Windows, App Blocking uses AppLocker to enforce your rules. When an executable matches a block rule, it cannot start; behavior follows AppLocker for the rule types you configure.Under Windows only settings, you can configure application blocks using AppLocker.

Block all unsigned apps: Prevents all unsigned apps from running. Select Add exception to allow an app.
Configure apps to block: Choose the applications to block.
- Rule name: A friendly name for the rule.
- Block: Choose the file types to block, such as EXEs, scripts, MSIs, Store apps, or All types.
- when: Choose the block method, such as publisher, path, or SHA256 file hash.
- Select Add block rule to add another condition, or Add app to add another app.

For detailed information about AppLocker, refer to Microsoft’s AppLocker documentation.

Gather File Details for Block Rules

When you add rules under Configure apps to block, the Publisher, Path, and SHA256 file hash block methods need values that match what AppLocker expects. The most reliable approach is to run the PowerShell cmdlet on a reference computer where the application is already installed, using the full path to the executable you intend to block.Open PowerShell and run:

get-applocker-file-information.ps1

Get-AppLockerFileInformation -Path "C:\Full\Path\To\application.exe" | Format-List

Replace the path in quotes with the full path to the file you want to inspect.The command returns the Path (often expressed with environment variables such as %PROGRAMFILES%), Publisher, Hash (SHA256), and AppX (True or False for Microsoft Store style packages).For example, to inspect a fictional app installed at C:\Program Files\FooDev\Foo\Application\foo.exe:

get-applocker-file-information-foo.ps1

Get-AppLockerFileInformation -Path "C:\Program Files\FooDev\Foo\Application\foo.exe" | Format-List

Example output:

applocker-file-information-foo.txt

Path : %PROGRAMFILES%\FOODEV\FOO\APPLICATION\FOO.EXE
Publisher : O=FOO DEV, L=MIAMI, S=FLORIDA, C=US\FOO\FOO.EXE,1.2.3.4
Hash : SHA256 0x637694332FEA4D87154635D02D7EE525F734D2B20AA1DB686B357A2511C2D4CE
AppX : False

Block Applications Using the Publisher Block Method

To build a Publisher rule in the App Blocking Library Item, copy the Publisher value from the cmdlet output, then trim it so AppLocker matches the certificate’s subject and location fields only (everything before the first backslash).

Run Get-AppLockerFileInformation with the full path to the executable, piped to Format-List, as in Gather File Details for Block Rules.
Locate the Publisher line in the output. Copy the string from the start through the character before the first backslash (\).
In Iru Endpoint, open your App Blocking Library Item.
Expand Windows only settings and enable Configure apps to block.
Add or edit a rule, set Block method to Publisher, and paste the trimmed value into Publisher.

For the sample Publisher value above:

O=FOO DEV, L=MIAMI, S=FLORIDA, C=US\FOO\FOO.EXE,1.2.3.4

use only the portion before the first backslash:

O=FOO DEV, L=MIAMI, S=FLORIDA, C=US

Enter that trimmed string in the rule’s Publisher field (for example, a rule that blocks All types when Publisher matches that value).

A Publisher rule blocks every application that presents the same publisher information, not only the executable you inspected. For example, blocking one product from publisher Foo Dev can also block another product from the same publisher, such as a companion sync client, if it shares that publisher string.

User Experience

On Windows, blocked apps will fail to launch, following AppLocker behavior.

Android Settings

Under Android only settings, add apps to block their installation in the personal profile. If an app is already installed there, Android uninstalls it.

Blocked app name: An optional display name.
Package name: The app’s package name. Select Add app to add another app.

Android Enterprise allows certain personal usage controls on company-owned devices with a work profile, including blocking listed apps in the personal profile while most policies stay scoped to the work profile (personal usage policies). The App Blocking Library Item uses that pattern: it targets the personal profile, not the work profile. Work apps are installed, updated, and removed through managed Google Play.

To find an Android app’s package name (for example, com.android.chrome for Google Chrome):

Search the web for [app name] package name
Use the Google Play URL for the app (the package name is the id query parameter)
Check app details on the device record Apps tab in Iru Endpoint
Run adb shell pm list packages on a connected Android device

User Experience

On Android, blocked apps are removed from the personal profile when installed there; the work profile is unchanged by App Blocking.

Considerations

Cross-platform: The App Blocking Library Item works across macOS, Windows, and Android. Choose which platforms to target under Install on.
Import from Parameter: On macOS, you can import settings from the legacy Application Blocking Parameter in a Blueprint into the App Blocking Library Item.
Multiple Library Items: You can assign more than one App Blocking Library Item to the same Blueprint; all block rules are combined.
Assignment maps: You can add multiple App Blocking Library Items to an Assignment Map; all App Blocking rules are combined when evaluated.
Parameter vs Library Item: When both exist in a Blueprint, Iru Endpoint uses the Library Item settings.
Activity: Blocked actions are logged in both the device and Blueprint activity streams.

Best Practices

Test blocking rules

Test application blocking rules on a small group of devices before deploying to your entire fleet.

Document blocked applications

Maintain documentation of which applications are blocked and why for audit and troubleshooting purposes.

Communicate with users

Inform users about application blocking policies to set proper expectations.

Monitor blocking activity

Regularly review blocking activity logs to ensure policies are working as intended.

Troubleshooting

Application still launches after blocking

Possible causes:

Block configuration not yet deployed to device
Application not in the blocked applications list
Device not enrolled or agent not installed Solutions:
Verify the App Blocking Library Item is assigned to the device’s Blueprint
Check that the application is correctly identified in the blocked list
Ensure device is properly enrolled and agent is running

Block dialog not appearing on macOS

Possible causes:

No custom message configured
Agent not installed or not running
Application not properly identified Solutions:
Configure a custom message in the App Blocking Library Item
Verify Iru Agent is installed and running on the device
Check application identification in the blocked applications list

Windows AppLocker not working

Possible causes:

AppLocker service not running
Group Policy not applied
Device not domain-joined (for some features)
Publisher, Path, or SHA256 file hash values do not match what AppLocker expects for the executable Solutions:
Check that AppLocker service is running
Verify Group Policy is applied correctly
Ensure device meets AppLocker requirements
For each block rule, confirm the Publisher, Path, or SHA256 file hash you configured matches the executable and what AppLocker expects; use Gather File Details for Block Rules to validate values

Android app not uninstalling

Possible causes:

App not in personal profile
Device not properly enrolled
Package name incorrect Solutions:
Verify the app is installed in the personal profile
Check device enrollment status
Confirm the package name is correct

Security Considerations

Regular Review

Regularly review blocked applications to ensure they remain appropriate for your security policies.

Exception Management

Establish a process for managing exceptions to blocking rules when business needs require it.

Audit Logging

Monitor blocking activity logs to detect potential security issues or policy violations.

User Education

Educate users about application blocking policies and approved alternatives.

Configure the Apple Restrictions Library Item

Set up the Apple Restrictions Library Item in Iru Endpoint to limit apps, iCloud, Siri, Apple Intelligence, and other features on managed Apple devices.

Library Overview

Overview of the Iru Endpoint Library for managing apps, profiles, scripts, and configurations. Curate Library Items and assign them to device Blueprints.

Configure the Privacy Library Item

Enforce app access with PPPC on Mac computers, and recommend app and Safari website permissions on Mac computers, iPhone devices, and iPad devices.

Application Blocking User Experience

See what users experience when application blocking is active on their device. Understand alert dialogs, blocked app behavior, and enforcement messages.

Getting Started

Devices

Agent

Blueprints

Enrollment

Library

Deployment Guides

Settings

Integrations

Endpoint Detection & Response

Vulnerability Management

API

Configure the App Blocking Library Item

Create an App Blocking Library Item

Platform-Specific Configuration

Mac Settings

Blocking an Application from a Device Record (Mac)

Example: Find a macOS App Bundle ID

User Experience

Windows Settings

Gather File Details for Block Rules

Block Applications Using the Publisher Block Method

User Experience

Android Settings

User Experience

Considerations

Best Practices

Troubleshooting

Security Considerations

Regular Review

Exception Management

Audit Logging

User Education

Configure the Apple Restrictions Library Item

Library Overview

Configure the Privacy Library Item

Application Blocking User Experience

​Create an App Blocking Library Item

​Platform-Specific Configuration

​Mac Settings

​Blocking an Application from a Device Record (Mac)

​Example: Find a macOS App Bundle ID

​User Experience

​Windows Settings

​Gather File Details for Block Rules

​Block Applications Using the Publisher Block Method

​User Experience

​Android Settings

​User Experience

​Considerations

​Best Practices

​Troubleshooting

​Security Considerations

Regular Review

Exception Management

Audit Logging

User Education

​Related Articles

Configure the Apple Restrictions Library Item

Library Overview

Configure the Privacy Library Item

Application Blocking User Experience

Create an App Blocking Library Item

Platform-Specific Configuration

Mac Settings

Blocking an Application from a Device Record (Mac)

Example: Find a macOS App Bundle ID

User Experience

Windows Settings

Gather File Details for Block Rules

Block Applications Using the Publisher Block Method

User Experience

Android Settings

User Experience

Considerations

Best Practices

Troubleshooting

Security Considerations

Related Articles