Business Premium: block unapproved RMM tools

Key insights

• The approach combines an Intune App Control for Business policy with Defender URL and domain indicators.
• The demonstrated tool requires Defender for Endpoint onboarded and configured on the devices.
• The generated App Control policy allows applications broadly and blocks listed tools; the demonstrated policy is not in audit mode.
• The creator warns that indicators can block legitimate services, so exclude approved tools and test before wide deployment.
• Network indicators can help when a listed executable is renamed, but the video does not establish that the method is foolproof.

Microsoft 365 Business Premium administrators can use Intune App Control for Business and Defender network indicators to block unapproved remote monitoring and management (RMM) tools. The approach is aimed particularly at managed service providers (MSPs) and IT teams that need to reduce the chance that an attacker or user can run an unauthorized remote-access tool. Jonathan Edwards demonstrates the setup with Microsoft MVP Lewis Barry, who created a free tool to generate the policy files.

What's new

This is a practical blocking method rather than a new Microsoft feature. It combines two controls: an App Control for Business policy deployed through Intune and URL or domain indicators imported into the Microsoft Security portal. The first layer is designed to stop listed remote tools from running; the second is intended to disrupt their connections to associated servers.

That second layer matters because the demonstration shows a limitation in blocking by executable name and path alone. When the presenter renames an AnyDesk executable, it launches, illustrating that a name-based App Control rule can be evaded in that test. The network indicator layer is intended to make the renamed tool unable to connect, adding a separate obstacle.

The generator uses a list of remote-management tools, their expected executable names and paths, and network indicators. Its creator says the source list is maintained externally and the tool’s site is updated by an automated process that he reviews. This is a community-built utility, not a Microsoft-provided security feature.

Who it is for and what you need

The demonstration focuses on organizations using Microsoft 365 Business Premium, especially MSPs managing customer Windows devices. Lewis Barry says the devices need to be onboarded to Defender for Endpoint and have the necessary configurations for the indicators to work. The transcript does not enumerate those prerequisites or provide a complete Defender setup guide.

The approach depends on Intune for the App Control policy and the Microsoft Security portal for importing URL and domain indicators. It is not stated whether the generator or the complete approach is available in every tenant, region, or configuration. The creator describes the site as a preview, and the video does not provide a Microsoft availability statement.

The network-indicator-only option may be useful in an estate that includes Windows and macOS, according to the demonstration. The App Control policy shown is a Windows policy; the transcript does not describe an equivalent macOS application-control setup. Advanced hunting is not required for the two blocking layers described, but the optional KQL query for investigating connections does require Advanced Threat Hunting, which the speakers say is not included in the Business Premium setup they discuss.

How it works

Start by reviewing the list and deciding which remote tools the organization or customer actually uses. The generator lets the operator exclude tools from the block list and optionally include the related indicators. The demonstration warns that some indicators may also match legitimate websites or services, so check the list against the customer’s environment before importing it.

1. Use the generator to select tools to exclude and download its App Control XML policy. If using the network layer, also download the indicator files; they are split because bulk import has a limit.
2. In Intune, go to Endpoint Security, then App Control for Business, and create a policy. The demonstration selects XML, uploads the generated file, and assigns the policy.
3. In the Microsoft Security portal, check the relevant endpoint setting that enables custom indicators. Then open URLs/Domains, choose Import, and upload the indicator files.
4. Allow time for the policies and indicators to take effect, then test on a device and confirm that approved business tools still work.

Pay close attention to assignment scope. The demonstration briefly assigns the App Control policy to all devices, but the presenter explicitly says not to use that as the rollout approach. He also says the generated policy is live when applied, rather than being configured in audit mode. The description advises testing in audit mode first; the transcript does not explain how to convert or adapt this generated policy for that test.

Limitations and open questions

This is not a guarantee that every unapproved remote tool will be blocked. The demonstrated App Control rules use executable names and paths, and renaming a file bypasses that layer in the test. The network layer is intended to address that case, but the demo does not show a complete test of every tool or configuration.

Indicators can create false positives. Some listed domains may be shared with meeting platforms or used by legitimate services, and the site may include indicators beyond the main tool list. Review exclusions carefully, and do not assume that a domain associated with a remote tool is used only for unauthorized activity.

The transcript also leaves the exact Defender configuration, detailed deployment-ring procedure, and recovery steps for a blocked business-critical application unspecified. It describes waiting for policy application and testing, but not a guaranteed deployment time. For MSPs, Barry suggests considering the controls after discovery and handover from a previous provider, once the customer’s legitimate remote tools are understood.

Sources

• Jonathan Edwards demonstration with Lewis Barry

Frequently asked questions

Can Microsoft 365 Business Premium block unapproved RMM tools?

The demonstrated approach uses Intune App Control for Business and Defender network indicators. The devices must be onboarded to Defender for Endpoint and have the required configuration; the transcript does not list every prerequisite.

Does the RMM-blocking approach require a Defender add-on?

The speakers describe the blocking approach as usable with Business Premium without an add-on. The optional hunting query requires Advanced Threat Hunting, which they say is not available in the Business Premium setup discussed.

How do you deploy the RMM block list?

Upload the generated XML under Intune's Endpoint Security > App Control for Business policy workflow. Import the URL and domain indicator files through URLs/Domains in the Microsoft Security portal after checking the custom-indicator setting.

Can the block list interrupt legitimate remote tools or websites?

Yes. The demonstration warns that indicators may match legitimate websites or services, and recommends excluding approved tools and testing before broad deployment.