{"id":3319,"date":"2026-08-07T10:07:03","date_gmt":"2026-08-07T10:07:03","guid":{"rendered":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/deploying-the-policy\/"},"modified":"2026-08-17T05:42:32","modified_gmt":"2026-08-17T05:42:32","slug":"deploying-the-policy","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/deploying-the-policy\/","title":{"rendered":"Creating a Deployment Policy in Application Control"},"content":{"rendered":"\n

A deployment policy is what actually enforces an application group on real devices. It ties one or more application groups to an enforcement action, defines what end users see when something is blocked, and scopes the policy to specific device groups, with the option to exclude individual exceptions.<\/p>\n\n\n\n

What is a Deployment Policy?<\/h2>\n\n\n\n

While an application group defines what to look for, a deployment policy defines how and where it’s enforced. The same application group can be attached to multiple policies. For example, one policy could silently audit a group across the whole organization, while a second, stricter policy actively blocks the same group on a smaller, high-risk device population.<\/p>\n\n\n\n

Create Deployment Policy<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

To create a deployment policy:<\/p>\n\n\n\n

    \n
  1. Log in to the Zecurit portal<\/strong>.<\/li>\n\n\n\n
  2. Go to Endpoint Manager \u2192 Application Control<\/strong>.<\/li>\n\n\n\n
  3. Select the Deployment<\/strong> tab.<\/li>\n\n\n\n
  4. Click Create Deployment Policy<\/strong>.<\/li>\n\n\n\n
  5. Select the required Platform<\/strong>, such as Windows, Linux, or macOS<\/strong>.<\/li>\n\n\n\n
  6. Click New Deployment Policy<\/strong>.<\/li>\n\n\n\n
  7. Configure the Policy Details, Enforcement, and Target Scope<\/strong> sections as required.<\/li>\n\n\n\n
  8. Click Publish<\/strong> to activate the policy immediately, or select Save as Draft<\/strong> to complete it later..<\/li>\n<\/ol>\n\n\n\n

    Note: At least one application group must exist before a policy can be created. See Creating an Application Group.<\/p>\n\n\n\n

    Policy Details<\/h2>\n\n\n\n
    Field<\/strong><\/th>Required<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
    Policy Name<\/td>Yes<\/td>A descriptive name for the policy (e.g., “Application control policy”). Shown in the Violations log to identify which policy triggered an action.<\/td><\/tr>
    Application Groups<\/td>Yes<\/td>One or more application groups to enforce, attached via Add Application Group. A policy can enforce multiple groups at once.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Note: A single policy can combine groups with different access types (Block List and Allow List) if your enforcement strategy requires layered rules, though most organizations keep one access type per policy for clarity.<\/p>\n\n\n\n

    Enforcement Actions<\/h2>\n\n\n\n

    The Enforcement Action determines what happens when a matched application is detected. Choose exactly one per policy:<\/p>\n\n\n\n

    Action<\/strong><\/th>User Sees a Message?<\/strong><\/th>Application Runs?<\/strong><\/th>Best For<\/strong><\/th><\/tr><\/thead>
    Block & Notify<\/td>Yes<\/td>No<\/td>Standard enforcement where users should understand why access was denied<\/td><\/tr>
    Block Execution<\/td>No<\/td>No<\/td>Silent, hard enforcement with no user interaction; appropriate for high risk applications<\/td><\/tr>
    Notify Only<\/td>Yes (warning)<\/td>Yes<\/td>Testing a new policy before fully enforcing it, or discouraging use without hard blocking<\/td><\/tr>
    Audit Only<\/td>No<\/td>Yes<\/td>Silent logging to understand application usage before deciding on an enforcement action<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    A typical rollout pattern is to start a new policy on Audit Only, review the resulting Violations data, move to Notify Only if user awareness is needed, and finally switch to Block & Notify or Block Execution once confident the rule is accurate.<\/p>\n\n\n\n

    Figure 1: Example End-User Block Notification<\/strong><\/p>\n\n\n\n

    This is what an end user sees when Block & Notify or Notify Only is configured the Title, Reason, and Contact fields from the Policy Details render directly in the alert dialog on the device.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    End-user “Application blocked by IT Admin” dialog, showing the Reason text and IT support contact configured in the policy’s block message.<\/p>\n\n\n\n

    Figure 2: Application Details View for a Blocked Application<\/strong><\/p>\n\n\n\n

    When an application is matched and blocked, administrators can drill into the specific detection from the Violations log to see the vendor, product name, verification status, file path, and file hash useful for confirming that the correct binary triggered the policy.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Application Details panel showing a blocked instance of Google Chrome (chrome.exe), including vendor, verification status, file path, and file hash.<\/p>\n\n\n\n

    User-Facing Block Message<\/h2>\n\n\n\n

    Available only when the Enforcement Action is Block & Notify or Notify Only, since Block Execution and Audit Only never surface a message to the user.<\/p>\n\n\n\n

    Field<\/strong><\/th>Description<\/strong><\/th>Example<\/strong><\/th><\/tr><\/thead>
    Title<\/td>Short heading shown in the block dialog<\/td>“Application blocked by IT policy”<\/td><\/tr>
    Reason<\/td>Explanation shown to the user<\/td>“Your access to this application has been blocked by your IT administrator.”<\/td><\/tr>
    Contact<\/td>An email address users can reach out to for help or an exception request<\/td>contact@example.com<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Keeping this message clear and including a real contact address reduces help desk confusion and repeat tickets from users who don’t understand why an application won’t open.<\/p>\n\n\n\n

    Target Scope and Exceptions<\/h1>\n\n\n\n

    Target Scope controls which devices the policy applies to:<\/p>\n\n\n\n

      \n
    • Choose a target type from the dropdown (e.g., Groups) and select the relevant device groups under Select Groups.<\/li>\n\n\n\n
    • Optionally add an Except rule; choose a type (e.g., Devices) and select specific endpoints to exempt from this policy, even if they belong to a targeted group.<\/li>\n\n\n\n
    • Click the + icon next to a target to add additional target\/exception pairs, allowing multiple scoping rules within a single policy.<\/li>\n<\/ul>\n\n\n\n
      Scenario<\/strong><\/th>Recommended Scope Setup<\/strong><\/th><\/tr><\/thead>
      Enforce company wide<\/td>Target: Groups \u2192 All Devices; no exceptions needed<\/td><\/tr>
      Enforce on one department only<\/td>Target: Groups \u2192 select that department’s device group<\/td><\/tr>
      Enforce broadly but exempt IT admin machines<\/td>Target: Groups \u2192 All Devices; Except: Devices \u2192 select admin machines<\/td><\/tr>
      Pilot on a small test group first<\/td>Target: Groups \u2192 select pilot group only<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Publishing vs. Saving as Draft<\/h1>\n\n\n\n
      Option<\/strong><\/th>Effect<\/strong><\/th><\/tr><\/thead>
      Publish<\/td>Activates the policy immediately; enforcement begins on all in-scope devices<\/td><\/tr>
      Save as draft<\/td>Stores the policy configuration without activating it, so it can be reviewed or completed later<\/td><\/tr>
      Cancel<\/td>Discards changes and exits without saving<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Example Deployment Policies<\/h1>\n\n\n\n
      Policy Name<\/strong><\/th>Application Groups<\/strong><\/th>Enforcement Action<\/strong><\/th>Target Scope<\/strong><\/th><\/tr><\/thead>
      Block Unauthorized Browsers<\/td>Approved Browsers – Kiosk Devices<\/td>Block Execution<\/td>Kiosk Devices group<\/td><\/tr>
      Remote Access Tool Audit<\/td>Unauthorized Remote Access Tools<\/td>Audit Only<\/td>All Devices<\/td><\/tr>
      US Branch Prohibited Apps<\/td>Prohibited app – US Branch<\/td>Block & Notify<\/td>US Branch group, except IT Admins<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Best Practices<\/h1>\n\n\n\n
        \n
      • Name policies clearly enough that they’re identifiable later in the Violations log without opening them.<\/li>\n\n\n\n
      • Roll out new policies with Audit Only first to avoid disrupting legitimate business workflows.<\/li>\n\n\n\n
      • Use Target Scope exceptions rather than creating a separate application group just to carve out a few devices.<\/li>\n\n\n\n
      • Review published policies periodically, since application usage and risk levels change over time.<\/li>\n<\/ul>\n\n\n\n

        Troubleshooting Tips<\/h1>\n\n\n\n
        Issue<\/strong><\/th>Resolution<\/strong><\/th><\/tr><\/thead>
        Publish button is disabled<\/td>Confirm a Policy Name is entered and at least one Application Group is attached<\/td><\/tr>
        Policy enforced on wrong devices<\/td>Review Target Scope; confirm the correct Groups\/Devices were selected and exceptions are correctly configured<\/td><\/tr>
        Users report no block message shown<\/td>Confirm Enforcement Action is Block & Notify, not Block Execution or Audit Only<\/td><\/tr>
        Draft policy not enforcing<\/td>Draft policies are inactive by design; open the policy and click Publish to activate it<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"featured_media":0,"parent":3309,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","meta":{"_is_vendor_doc":"0","footnotes":""},"doc_tag":[],"class_list":["post-3319","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=3319"}],"version-history":[{"count":14,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3319\/revisions"}],"predecessor-version":[{"id":3442,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3319\/revisions\/3442"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3309"}],"next":[{"title":"Monitoring Violations","link":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/monitoring-violations\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3322"}],"prev":[{"title":"Creating an Application Group in Zecurit","link":"https:\/\/zecurit.com\/help\/endpoint-management\/application-control\/creating-an-application-group-in-zecurit\/","href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/3310"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=3319"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=3319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}