Is software installation automatically controlled and unauthorized software blocked?
This question is really about local administrator rights, and the honest answer in most organisations is more permissive than the policy suggests.
What the carrier is actually asking
The carrier is asking whether an ordinary user can install arbitrary software on a corporate device, and whether anything prevents unauthorised programs from running. It is asking about both prevention and enforcement, because a policy that forbids installation without a technical control is a request rather than a restriction.
Why it is underwritten
Unauthorised software introduces unpatched components, unwanted remote access tooling, and outright malware. Local administrator rights also remove most of the friction from an intrusion, since an attacker who lands on a device with administrative rights can disable protection and persist immediately.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Local administrator posture and application control are visible through endpoint management, and the tenant shows the enforcement side.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Local administrator assignment policy for joined devices | Standard users are not local administrators by default, and the exceptions are enumerated |
| Microsoft 365 | Local Administrator Password Solution state | Enabled, so the local administrator account that does exist is unique per device and rotated |
| Microsoft 365 | Application control or allow-listing policy on endpoints | A policy in enforcement rather than audit mode, at least for high-risk locations such as user-writable directories |
| Microsoft 365 | Attack surface reduction rules for script and executable behaviour | Rules enforced, covering the execution paths that installers and droppers actually use |
| Entra ID | Device join and registration restrictions | Who can join devices to the tenant, since an unrestricted join policy lets an unmanaged device become a corporate one |
Of everything in the endpoint block, removing standing local administrator rights from ordinary users changes intrusion economics the most, and it is the item most often deferred because it generates support friction in the first month. Carriers know this, and some ask about it directly.
What a defensible yes requires
- Standard users do not hold local administrator rights, with named exceptions and a review.
- The built-in local administrator password is unique per device and managed.
- Application control is enforced somewhere meaningful, even if a full allow-list is not practical.
- Attack surface reduction rules block rather than audit.
- A request path exists for legitimate software, because a control with no route around it gets disabled.
How this answer goes wrong
The policy forbids installation and every user is a local administrator, so nothing enforces it. Or application control was deployed in audit mode during a pilot two years ago and never moved to enforcement, which produces logs and no prevention. Both look configured in a settings review and stop nothing.
Frequently asked
Is full application allow-listing expected?
On endpoints, rarely. On critical servers, increasingly yes, and a separate question usually asks about that. Partial enforcement on user-writable paths is a common, credible middle ground.
What about developers?
Developers usually need broader rights, and the answer is to define them as a scoped exception with additional monitoring rather than to leave the whole fleet permissive.
Does blocking installation break things?
It changes support patterns and rarely blocks the business, provided a request path exists. The organisations that fail at this are the ones that remove rights without providing an alternative.
How does this connect to browser extensions?
Directly. Extensions are software installed without an installer, which is why carriers now ask about them separately.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture