How to block users from installing software that doesn't require admin rights, for example Google Chrome and Zoom by using Microsoft Intune

To block users from installing software like Google Chrome and Zoom that don’t require admin rights, use a combination of Intune device restriction policies and Windows application control so that only approved apps can run or be installed.

A practical approach based on the provided information:

1. Block non-admin app installs (packaged apps)
   • Use the BlockNonAdminUserInstall policy so that only administrators can initiate installation of Windows app packages (where applicable):
     • This policy is exposed via the CSP path:
       • ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/BlockNonAdminUserInstall
     • Set the value to 1 to prevent non-administrator users from initiating installation of Windows app packages.
     • This applies to Windows 10 Enterprise/Education/IoT Enterprise 2004 and later.
2. Restrict where apps can be installed from
   • In Intune, use the App Store device restriction settings to limit app installation sources:
     • Apps from store only (SmartScreen/EnableAppInstallControl):
       • Set to Store Only to block installation of apps downloaded from the internet and recommend the Microsoft Store instead.
       • Other options:
         • Anywhere – allows installation from any location (not recommended for this scenario).
         • Prefer Store / Recommendations – only warn or recommend; they don’t fully block.
     • This setting controls the user experience when installing apps from outside the Microsoft Store and helps prevent users from installing typical EXE/MSI-based apps they download (such as Chrome and Zoom) from the web.
3. Prevent users from changing install options / using elevated MSI behavior
   • In the same Windows device restrictions profile in Intune, configure:
     • User control over installations (ApplicationManagement/MSIAllowUserControlOverInstall):
       • Set to Block so users can’t change installation options that are typically reserved for administrators.
     • Install apps with elevated privileges (ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges):
       • Set to Block so Windows Installer doesn’t use elevated permissions for arbitrary MSI installs.
   • These settings reduce the chance that users can work around restrictions using MSI installers.
4. Use App Control for Business (WDAC) to allow only approved apps
   • For stronger control, use App Control for Business (formerly WDAC) to define which applications can run:
     • Create an App Control for Business policy that allows only approved applications (for example, Microsoft 365 Apps, line-of-business apps) and blocks everything else, including Chrome and Zoom executables.
     • Alternatively, create an allow list and explicitly deny specific executables if they are not needed.
   • App Control for Business is the same technology used to block unenlightened apps like Chrome or PowerShell from running or from accessing Microsoft resources, as described for tenant restrictions v2.
   • Deploy the App Control for Business policy to devices via Intune after testing on a pilot group.
5. Combine with least-privilege accounts
   • Ensure users are standard users (no local admin rights) on their Windows devices.
   • Optionally, use Endpoint Privilege Management (EPM) to allow elevation only for specific, IT-approved installers or binaries, while keeping users non-admin for everything else.

Summary of configuration in Intune:

1. Create a Windows device configuration profile (Device restrictions) and configure:
   • Apps from store only = Store Only.
   • User control over installations = Block.
   • Install apps with elevated privileges = Block.
2. Deploy a custom OMA-URI policy (if needed) to set BlockNonAdminUserInstall = 1.
3. Deploy an App Control for Business policy (via Intune) that only allows approved applications to run, thereby blocking Chrome, Zoom, and other unapproved software.
4. Ensure users are not local administrators; optionally use EPM for controlled elevation.

This combination prevents standard users from installing most third-party software and blocks unapproved executables from running, even if they are copied from USB or network shares.

References:

• Policy CSP - ApplicationManagement
• Windows device settings to allow or restrict features using Intune
• Set up tenant restrictions v2
• Use Endpoint Privilege Management with Microsoft Intune