FORGE AC / APP CONTROL FOR BUSINESS
Review observed applications, approve narrowly scoped allowances and generate validated App Control for Business (WDAC) policy XML. In an Azure deployment your organisation owns.
CUSTOMER PILOT PREPARATIONCore workflows have been exercised in Terinnovation trials. Customer-led commissioning and fresh-device acceptance remain release gates.
THE WORKFLOW
Review Windows Code Integrity events and correlated signer information collected by the Forge exporter. Evidence freshness and completeness affect which requests can proceed.
Choose a supported allowance and a managed supplemental-policy target. Record the justification and supporting evidence.
A different Approver reviews the request. Self-approval is prevented, including when the requester also holds the Approver role.
A separate Windows worker validates the approved request and generates policy XML. Download and review the artifact before explicitly publishing it as the current registered source.
Upload and assign the reviewed policy through Intune separately. Validate the resulting behaviour on pilot devices; publishing in Forge does not deploy a policy.
PRODUCT CAPABILITIES
Hash, Publisher, FilePublisher with optional version bounds, and protected exact-file-path allowances. Single and bulk requests retain per-file evidence and independent approval. Existing allowances can be removed through reviewed changes.
Create blank supplementals linked to a registered base, Windows-default bases, or clones of existing bases. New policy identities require independent approval and explicit registration. Existing bases remain protected from in-place edits.
Registered policy inventory, source-based Allowed Applications, candidate investigation, job status and approval history connect the evidence to the policy source. Source coverage does not establish device deployment or compliance.
Single-tenant Microsoft Entra sign-in with server-enforced Viewer, Reviewer and Approver roles. Separate portal and worker identities, signed worker commands and durable audit records support controlled operations.
Independently approve and explicitly retire a managed supplemental policy from active Forge inventory and future request targets. Retain its XML and history. Removal from Intune and endpoints is a separate operation.
Backup/export, an independently retained copy, and guarded restore workflows support recovery of policy sources, approval history and configuration. Customer backup schedules, monitoring and recovery objectives require commissioning and validation.
OWNERSHIP & DEPLOYMENT
Each organisation owns its Forge AC deployment, identities and data in its own Entra tenant and Azure subscription. The architecture separates the web portal from the Windows policy-generation worker.
Provision the Azure foundation, identity configuration, portal and Windows worker for the organisation. Permanent vendor access is not required by the operating model.
Verify access, fresh device evidence, approval workflows, endpoint policy behaviour, upgrade, rollback and recovery before a production rollout.
The organisation owns access, operating costs, alerts, updates, backups, recovery and Intune deployment as part of the agreed handover.
CURRENT SCOPE
LET’S TALK APPLICATION CONTROL
Start with your environment and the workflow you need.