> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure the App Blocking Library Item
> Block specific applications from running on managed macOS, Windows, and Android devices by configuring App Blocking Library Item lists and enforcement rules.
This Library Item is available for Mac computers, Windows devices, and Android devices
The **App Blocking** Library Item lets you block applications from running on **macOS**, **Windows**, and **Android** devices. When a user attempts to open a blocked application, it will be prevented from launching. On macOS, the app will immediately close and display a block message. On Windows, blocking is powered by **AppLocker**. With **Android work profile** enrollment, App Blocking applies to the **personal profile** only: Android removes blocked package names from that profile if they are installed. The managed **work profile** is handled separately—deploy and update work apps through **managed Google Play**, not through App Blocking.
To block apps on **iOS** or **iPadOS** devices, use a [Restrictions Library Item](/en/endpoint/library/library-items-profiles/configure-the-restrictions-library-item) instead.
As of January 8, 2025, App Blocking is configured using the **App Blocking** Library Item. This replaces the previous Application Blocking Parameter for **macOS**. Blueprints that already include the Parameter can still be edited, but the Parameter cannot be added to Blueprints that do not already have it.
## Create an App Blocking Library Item
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.
Navigate to the **Library** and select **Add Library Item**.
Search for and select **App Blocking**.
Give the Library Item a **Name**.
Under **Install on**, select one or more platforms (**Apple**, **Windows**, **Android**).
Assign the Library Item to one or more **Blueprints**.
In the Library Item, blocking is split into **Apple only settings**, **Windows only settings**, and **Android only settings** sections, so you configure each platform in its own area.
## Platform-Specific Configuration
### Mac Settings
On **macOS**, App Blocking evaluates running applications against the identifiers you configure. When a launch matches a block rule, the app stops immediately and the user sees the block message (and optional **Learn More** link) from the Library Item.
Expand **Apple only settings**, then open the nested **Mac only settings** section to configure process identifiers, match types, and optional block notifications.
Configure the processes, paths, developer IDs or bundle IDs you'd like to block.
Select the desired **Match type**:
* **Contains:** Matches that contain the string.
* **Exact:** Matches the exact string provided.
* **Regex:** Matches based on regular expression using [Swift regex](https://developer.apple.com/documentation/swift/regex) syntax.
Regex is a very powerful tool that should be used with caution. Ensure that you test the implementation before broadly deploying it.
Optionally, customize the message, button title, and button URL users will be presented with when an application is blocked.
Click **Save**.
### Blocking an Application from Device Record (macOS)
Adding an item to the block list can also be performed from an individual **macOS** device record. These updates can either be added to an existing App Blocking Library Item or you can create a new one.
Log in to Iru Endpoint and open a **device record** with the application you wish to block installed.
Click the **Apps** **tab** and locate the **application** in question.
Click the **More (...)** button to the right of the application and click "**Block Application**".
Select the **Add rule** **to the following Library Item(s)** drop-down and select a Library Item or type to create new one.
Select the desired **Blueprint** that should receive the Blocking Rule, and **customize the identifiers** as needed.
Click **Create**.
### Example: Find a macOS App Bundle ID
To find the bundle ID of a macOS app, you can use the **codesign** command in Terminal, replacing `/path/to/yourapp.app` with the path to your desired application:
```bash theme={null}
codesign -dr - /path/to/yourapp.app
```
The output of this command will include information about the app, including the Team ID, Bundle ID, and Code Requirement which can be helpful when creating [PPPC Profiles](/en/endpoint/library/library-items-profiles/configure-the-privacy-preferences-policy-control-pppc-library-item). The Bundle ID will usually be at the end of the output, after the word **identifier**. In the example output below, the Bundle ID for Keynote is **com.apple.iWork.Keynote**.
```text theme={null}
identifier=com.apple.iWork.Keynote
```
### User Experience
* On Mac, users attempting to open a blocked app will see the configured block message.
* If you configure a **Learn More** button, users can click it to be directed to your specified URL. You can read more about this in our [User Experience with Application Blocking](/en/endpoint/library/library-items-profiles/application-blocking-user-experience) article.
### Windows Settings
On **Windows**, App Blocking uses **AppLocker** to enforce your rules. When an executable matches a block rule, it cannot start; behavior follows AppLocker for the rule types you configure.
Under **Windows only settings**, you can configure application blocks using AppLocker.
* **Block all unsigned apps**
Prevents all unsigned applications from running. You can add exceptions if necessary.
* **Configure apps to block**
Add specific apps to block by name, file path, or publisher.
* **App name**: Friendly name for reference.
* **Block**: Choose which file types to block:
* EXEs
* Scripts
* MSIs
* Store apps
* All types
* **Block method**: Define how Iru Endpoint should evaluate the rule (publisher, path, or SHA256 file hash).
For detailed information about AppLocker, refer to Microsoft's [AppLocker documentation](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview).
### Gather File Details for Block Rules
When you add rules under **Configure apps to block**, the **Publisher**, **Path**, and **SHA256 file hash** block methods need values that match what AppLocker expects. The most reliable approach is to run the PowerShell cmdlet on a reference computer where the application is already installed, using the full path to the executable you intend to block.
Open PowerShell and run:
```powershell get-applocker-file-information.ps1 theme={null}
Get-AppLockerFileInformation -Path "C:\Full\Path\To\application.exe" | Format-List
```
Replace the path in quotes with the full path to the file you want to inspect.
The command returns the **Path** (often expressed with environment variables such as `%PROGRAMFILES%`), **Publisher**, **Hash** (SHA256), and **AppX** (`True` or `False` for Microsoft Store style packages).
For example, to inspect a fictional app installed at `C:\Program Files\FooDev\Foo\Application\foo.exe`:
```powershell get-applocker-file-information-foo.ps1 theme={null}
Get-AppLockerFileInformation -Path "C:\Program Files\FooDev\Foo\Application\foo.exe" | Format-List
```
Example output:
```text applocker-file-information-foo.txt lines theme={null}
Path : %PROGRAMFILES%\FOODEV\FOO\APPLICATION\FOO.EXE
Publisher : O=FOO DEV, L=MIAMI, S=FLORIDA, C=US\FOO\FOO.EXE,1.2.3.4
Hash : SHA256 0x637694332FEA4D87154635D02D7EE525F734D2B20AA1DB686B357A2511C2D4CE
AppX : False
```
### Block Applications Using the Publisher Block Method
To build a **Publisher** rule in the App Blocking Library Item, copy the **Publisher** value from the cmdlet output, then trim it so AppLocker matches the certificate’s subject and location fields only (everything before the first backslash).
1. Run `Get-AppLockerFileInformation` with the full path to the executable, piped to `Format-List`, as in [Gather File Details for Block Rules](#gather-file-details-for-block-rules).
2. Locate the **Publisher** line in the output. Copy the string from the start through the character **before** the first backslash (`\`).
3. In Iru Endpoint, open your App Blocking Library Item.
4. Expand **Windows only settings** and enable **Configure apps to block**.
5. Add or edit a rule, set **Block method** to **Publisher**, and paste the trimmed value into **Publisher**.
For the sample **Publisher** value above:
```text theme={null}
O=FOO DEV, L=MIAMI, S=FLORIDA, C=US\FOO\FOO.EXE,1.2.3.4
```
use only the portion before the first backslash:
```text theme={null}
O=FOO DEV, L=MIAMI, S=FLORIDA, C=US
```
Enter that trimmed string in the rule’s **Publisher** field (for example, a rule that blocks **All types** when **Publisher** matches that value).
A **Publisher** rule blocks every application that presents the same publisher information, not only the executable you inspected. For example, blocking one product from publisher **Foo Dev** can also block another product from the same publisher, such as a companion sync client, if it shares that publisher string.
### User Experience
* On Windows, blocked apps will fail to launch, following AppLocker behavior.
### Android Settings
Under **Android only settings**, you can block applications by package name.
* **Blocked app name**: Optional display name for reference.
* **Package Name**: The required unique identifier of the Android app.
If the app is already installed in the **personal profile**, Android removes it when the policy applies.
Android Enterprise allows certain **personal usage** controls on [company-owned devices with a work profile](https://developers.google.com/android/management/provision-device#company-owned_devices_for_work_and_personal_use)—including blocking listed apps in the **personal profile** while most policies stay scoped to the **work profile** ([personal usage policies](https://developers.google.com/android/management/policies/work-profile#personal_usage_policies)). The App Blocking Library Item uses that pattern: it targets the personal profile, not the work profile. Work apps are installed, updated, and removed through **managed Google Play**.
To find an Android app's package name (for example, `com.android.chrome` for Google Chrome):
* Search the web for `[app name] package name`
* Use the Google Play Store URL for the app (the package name is the `id` query parameter)
* Check app details on the device record **Apps** tab in Iru Endpoint
* Run `adb shell pm list packages` on a connected Android device
### User Experience
* On Android, blocked apps are removed from the **personal profile** when installed there; the **work profile** is unchanged by App Blocking.
## Considerations
* **Cross-platform:** The App Blocking Library Item works across macOS, Windows, and Android. Choose which platforms to target under **Install on**.
* **Import from Parameter:** On **macOS**, you can import settings from the legacy Application Blocking Parameter in a Blueprint into the App Blocking Library Item.
* **Multiple Library Items:** You can assign more than one App Blocking Library Item to the same Blueprint; all block rules are combined.
* **Assignment maps:** You can add multiple App Blocking Library Items to an Assignment Map; all App Blocking rules are combined when evaluated.
* **Parameter vs Library Item:** When both exist in a Blueprint, Iru Endpoint uses the Library Item settings.
* **Activity:** Blocked actions are logged in both the device and Blueprint activity streams.
## Best Practices
Test application blocking rules on a small group of devices before deploying to your entire fleet.
Maintain documentation of which applications are blocked and why for audit and troubleshooting purposes.
Inform users about application blocking policies to set proper expectations.
Regularly review blocking activity logs to ensure policies are working as intended.
## Troubleshooting
**Possible causes:**
* Block configuration not yet deployed to device
* Application not in the blocked applications list
* Device not enrolled or agent not installed
**Solutions:**
* Verify the App Blocking Library Item is assigned to the device's Blueprint
* Check that the application is correctly identified in the blocked list
* Ensure device is properly enrolled and agent is running
**Possible causes:**
* No custom message configured
* Agent not installed or not running
* Application not properly identified
**Solutions:**
* Configure a custom message in the App Blocking Library Item
* Verify Iru Agent is installed and running on the device
* Check application identification in the blocked applications list
**Possible causes:**
* AppLocker service not running
* Group Policy not applied
* Device not domain-joined (for some features)
* **Publisher**, **Path**, or **SHA256 file hash** values do not match what AppLocker expects for the executable
**Solutions:**
* Check that AppLocker service is running
* Verify Group Policy is applied correctly
* Ensure device meets AppLocker requirements
* For each block rule, confirm the **Publisher**, **Path**, or **SHA256 file hash** you configured matches the executable and what AppLocker expects; use [Gather File Details for Block Rules](#gather-file-details-for-block-rules) to validate values
**Possible causes:**
* App not in personal profile
* Device not properly enrolled
* Package name incorrect
**Solutions:**
* Verify the app is installed in the personal profile
* Check device enrollment status
* Confirm the package name is correct
## Security Considerations
Regularly review blocked applications to ensure they remain appropriate for your security policies.
Establish a process for managing exceptions to blocking rules when business needs require it.
Monitor blocking activity logs to detect potential security issues or policy violations.
Educate users about application blocking policies and approved alternatives.