It’s Not Just You: Your App Control Supplementals Aren’t Attaching (….and how to catch it with Intune)

The first post in “It’s Not Just You”, a series on the Intune and Windows problems that make you think you broke something. Here’s what we found, how we caught it, and where to start if App Control burned you before.

If you’ve clicked through Endpoint security in Intune, you’ve seen App Control for Business sitting there. It’s the modern replacement for AppLocker and GPO rules, it’s built into Windows, and it gives you real control over what runs on your endpoints.

A lot of us have tried it. A lot of us hit a wall, lost a week, and went back to detection and remediation scripts to keep unwanted apps off devices.

Most of the time, the problem isn’t you. It’s that the documentation and the device don’t agree.

The plan we all start with

Turn on Built-in controls in audit. Review what gets flagged. Build supplemental policies for the apps you need. Enforce.

Don’t get me wrong, Built-in controls are a nice way to get started. Three clicks and you’re auditing:

But step three is where it falls apart.

My supplementals deployed with Succeeded in Intune.

The apps they allowed were still getting flagged. CiTool told a different story:

In CiTool, IsEnforced means active, not audit versus enforce. So that supplemental is sitting on disk doing nothing. It isn’t broken. It has nothing to attach to. At this point I wouldn’t blame you if App Control has you like:

What’s actually going on

Two things on the Built-in base:

It loads under a different ID than Learn says. The Intune docs list four possible policy IDs for Built-in controls. On my devices it loads as {E0ABDA1F-CCF0-468E-8855-3E0F08B02D6A}, which is the ID of Microsoft’s own DefaultWindows template.
It doesn’t allow supplementals. The base is missing rule option 17, Enabled:Allow Supplemental Policies. Without it, nothing can attach.

Point the exact same supplemental at a base built in the App Control Wizard and it goes active right away (you will need to swap in your actual Base PolicyID).

I’ve confirmed this with multiple tenants and, as of October 30th, asked Microsoft whether it’s by design. No answer yet. I’ll update this post when I hear back.

How we caught it

Intune reports delivery, not activation. Succeeded means the policy got to the device. That’s it.

So I built a detection script for Intune Remediations. It reads CiTool on every device and returns one line per base policy. Here’s one of my lab devices:

That’s an enforced custom base on version 10.3, with both supplementals attached and active, and nothing blocked in the last 24 hours. Exactly what you want to see.

Here’s what each piece tells you:

Segment	What it tells you
BASE	Policy ID, name, version, and audit or enforced
SUPP	Whether the base accepts supplementals, and how many are active
CFG	User-mode code control, managed installer, Intelligent Security Graph (ISG) and script enforcement
BLOCKS	Block and audit events from the local CodeIntegrity log (no Defender for Endpoint needed)
LearnIDs	YES if a base uses one of the four Built-in IDs listed on Learn
INACTIVE / ORPHANS	Only shows up when a supplemental isn’t active or its base is missing

Any device with a base that can’t take supplementals lands in With issues. You can also set the base ID and supplementals every device should have at the top of the script, and anything that drifts gets flagged.

Setup: detection script only, run as SYSTEM, 64-bit PowerShell. It needs CiTool (Windows 11 22H2 or later) and falls back to event 3099 on older builds.

Where to get it: GitHub, Detect-AppControlBasePolicy.ps1

If App Control burned you before, start here

None of these go deep. Each one cost me, or someone I’ve worked with, real time.

Own your base policy. Build it in the App Control Wizard or AppControl Manager, a free tool from Microsoft MVP Violet Hansen (HotCakeX), and deploy it with Enter xml data. Microsoft calls the Signed and Reputable template the ideal starter policy for most end-user devices. Leave Allow Supplemental Policies checked, and audit against the same base you plan to enforce.

Check activation, not delivery. Use CiTool -lp or the script. And keep one base per device. With two active bases, a file has to pass both, so a leftover Built-in base will keep blocking whatever your supplemental allows.

Build supplementals from real block data. Advanced hunting gives you the fleet view (3076 in audit, 3077 in enforce). On a single device, check CodeIntegrity > Operational and AppLocker > MSI and Script in Event Viewer. One supplemental per vendor or app, with a real name. “SupplementalTemplate” times ten gets confusing fast.

One quick thing: in advanced hunting, the PolicyID on policy-loaded events is a label, not the policy GUID. It will never match CiTool. Use CiTool or the script for IDs.

Set the managed installer before you need it. Add the Intune Management Extension as a managed installer and turn on the option in your base. Tagging isn’t retroactive, so apps installed before that need explicit rules. Then make sure your Win32 apps, platform scripts and remediations still run once you enforce. I’ve seen remediation scripts fail outright after a base moved to enforce, and the managed installer setup was usually the cause.

Add an Autopilot validation phase. Most teams test on devices that already have their apps. Run a few fresh devices through Autopilot with the enforced base assigned and confirm every required app installs and launches.

Ring it out and train the team. IT first, then a pilot group, then early adopters. Everyone who touches endpoints should be able to read a 3077 event and run CiTool. Test your help desk workflows too. If App Control blocks the tool your techs use to fix a device, now you have two problems.

When Built-in controls still fit

They’re a fast way to see roughly how much would get blocked on a small pilot. They also work for device groups that never need exceptions, like kiosks where every app comes from Intune. If a group will ever need an app the base doesn’t trust, start with your own base.

Final thoughts…

App Control is one of the most underused security features in Windows 11. It’s not the most polished UI out there, but it’s native to Intune and Windows, and once base and supplemental policies click, the day-to-day overhead gets a lot lighter.

So, is it just you? Run the script, check your supplementals, and let me know in the comments what you find. Same base ID? Something different? And if you’ve hit any other Intune problem that made you question your own config, send it my way. It might be the next It’s Not Just You.

If this helped, share it on LinkedIn, Reddit, or X.

As always, thanks for reading, and happy deploying!

Kevin

Kevin Malinoski