Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees as explicit allow or deny rules do. Security considerations with managed installer As long as there are no deny rules for the binary, WDAC will allow it to run based purely on its managed installer origin. When that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. You can then configure WDAC to trust files that are installed by a managed installer by adding the 'Enabled:Managed Installer' option to your WDAC policy. As files are written, they're tagged as originating from a managed installer. When one of these trusted binaries runs, Windows monitors the binary's process (and any child processes it launches) and watches for files being written to disk.

Managed installer uses a special rule collection in AppLocker to designate binaries that are trusted by your organization as an authorized source for application installation. This option lets you automatically allow applications installed by a designated software distribution solution, such as Microsoft Configuration Manager (MEMCM) or Microsoft Intune. Windows Defender Application Control (WDAC) includes an option called managed installer that helps balance security and manageability when enforcing application control policies. Learn more about the Windows Defender Application Control feature availability. Some capabilities of Windows Defender Application Control are only available on specific Windows versions.

Instal DefenderUI 1.12