We are looking for guidance on the best approach to restrict PowerShell execution on standard user workstations in our enterprise environment.

Current environment

Our Windows endpoints are managed through Microsoft Intune. Both the Intune team and CloudOps team use PowerShell extensively for day-to-day operations, including device provisioning, configuration, software deployment, and other administrative/automation activities.

At the same time, we have a security requirement to prevent standard users from executing unauthorized PowerShell scripts or commands.

We have tested the following:

PowerShell Execution Policy = Restricted

Blocks execution of .ps1 scripts.

  However, users can still open PowerShell and execute commands interactively by typing or pasting the commands.
  
  **RemoteSigned**
  
     Blocks downloaded/Internet-originated unsigned scripts.
     
        However, users can potentially bypass this by unblocking the file, recreating the script locally, or executing the commands interactively.
        
        We are therefore considering **AppLocker or WDAC** to restrict PowerShell execution for standard users.
        

Concern

We do not want to implement a blanket AppLocker/WDAC rule that blocks powershell.exe for everyone because Intune and CloudOps automation legitimately depend on PowerShell.

For example, an Intune deployment may effectively use:

Intune Management Extension
        ↓
    powershell.exe
        ↓
   PowerShell script

If we block powershell.exe, we are concerned that Intune deployments, device provisioning, configuration scripts, or CloudOps automation could be impacted.

Requirement

We would like to achieve something similar to:

Standard User
    └── Interactive PowerShell
            → BLOCK

Intune Management / Device Management
    └── Required PowerShell scripts
            → ALLOW

CloudOps / Approved Automation
    └── Required PowerShell scripts
            → ALLOW

CMD
    └── Normal user access
            → ALLOW

Questions

What is Microsoft's recommended approach for restricting interactive PowerShell usage by standard users while continuing to allow PowerShell scripts executed by Intune Management Extension and approved administrative/automation processes?

Is AppLocker appropriate for this requirement, or should we use WDAC / App Control for Business?

Can AppLocker/WDAC rules distinguish between:

A standard user launching powershell.exe interactively

  Intune Management Extension executing PowerShell under its required security context
  
     CloudOps automation executing approved PowerShell scripts?
     
     What is the recommended way to identify and create allow rules for Intune and CloudOps PowerShell execution without creating overly broad exceptions?
     
     Does setting PowerShell Execution Policy to `Restricted` through GPO have any potential impact on Intune PowerShell scripts or scripts executed by the Intune Management Extension?
     
     Is there a Microsoft-recommended combination of controls such as:
     
        App Control/WDAC
        
           AppLocker
           
              PowerShell Execution Policy
              
                 PowerShell Constrained Language Mode
                 
                    Defender/EDR
                    
                       PowerShell logging
                       
                       that would provide strong restriction for standard users without disrupting enterprise management automation?
                       
                       What would be the recommended **pilot/testing approach** before deploying such a policy across production endpoints?
                       

Our main objective is to prevent standard users from bypassing script restrictions simply by opening PowerShell and pasting/typing the commands interactively, while ensuring that legitimate Intune and CloudOps PowerShell automation continues to function.

How to restrict PowerShell for standard users without impacting Intune and CloudOps automation?

We are looking for guidance on the best approach to restrict PowerShell execution on standard user workstations in our enterprise environment.

Current environment

Our Windows endpoints are managed through Microsoft Intune. Both the Intune team and CloudOps team use PowerShell extensively for day-to-day operations, including device provisioning, configuration, software deployment, and other administrative/automation activities.

At the same time, we have a security requirement to prevent standard users from executing unauthorized PowerShell scripts or commands.

We have tested the following:

PowerShell Execution Policy = Restricted

Blocks execution of .ps1 scripts.

  However, users can still open PowerShell and execute commands interactively by typing or pasting the commands.
  
  **RemoteSigned**
  
     Blocks downloaded/Internet-originated unsigned scripts.
     
        However, users can potentially bypass this by unblocking the file, recreating the script locally, or executing the commands interactively.
        
        We are therefore considering **AppLocker or WDAC** to restrict PowerShell execution for standard users.
        

Concern

We do not want to implement a blanket AppLocker/WDAC rule that blocks powershell.exe for everyone because Intune and CloudOps automation legitimately depend on PowerShell.

For example, an Intune deployment may effectively use:

Intune Management Extension
        ↓
    powershell.exe
        ↓
   PowerShell script

If we block powershell.exe, we are concerned that Intune deployments, device provisioning, configuration scripts, or CloudOps automation could be impacted.

Requirement

We would like to achieve something similar to:

Standard User
    └── Interactive PowerShell
            → BLOCK

Intune Management / Device Management
    └── Required PowerShell scripts
            → ALLOW

CloudOps / Approved Automation
    └── Required PowerShell scripts
            → ALLOW

CMD
    └── Normal user access
            → ALLOW

Questions

What is Microsoft's recommended approach for restricting interactive PowerShell usage by standard users while continuing to allow PowerShell scripts executed by Intune Management Extension and approved administrative/automation processes?

Is AppLocker appropriate for this requirement, or should we use WDAC / App Control for Business?

Can AppLocker/WDAC rules distinguish between:

A standard user launching powershell.exe interactively

  Intune Management Extension executing PowerShell under its required security context
  
     CloudOps automation executing approved PowerShell scripts?
     
     What is the recommended way to identify and create allow rules for Intune and CloudOps PowerShell execution without creating overly broad exceptions?
     
     Does setting PowerShell Execution Policy to `Restricted` through GPO have any potential impact on Intune PowerShell scripts or scripts executed by the Intune Management Extension?
     
     Is there a Microsoft-recommended combination of controls such as:
     
        App Control/WDAC
        
           AppLocker
           
              PowerShell Execution Policy
              
                 PowerShell Constrained Language Mode
                 
                    Defender/EDR
                    
                       PowerShell logging
                       
                       that would provide strong restriction for standard users without disrupting enterprise management automation?
                       
                       What would be the recommended **pilot/testing approach** before deploying such a policy across production endpoints?
                       

Our main objective is to prevent standard users from bypassing script restrictions simply by opening PowerShell and pasting/typing the commands interactively, while ensuring that legitimate Intune and CloudOps PowerShell automation continues to function.