Our own platform
EAMP: App Control for Business, finally manageable.
Enterprise Application Modernization Platform. Application allow-listing, cloud configuration and packaging for Windows, in one platform that works alongside Intune.
Three domains
What Intune doesn’t solve, EAMP does.
Intune stays the deployment channel. EAMP takes care of the parts Intune has no answer for: creating and signing policies, analysing and converting installers, and keeping trust demonstrable.
App trust
- Compose policies from building blocks: base, blocklists and per-application supplementals
- Simulator: see in advance what would be blocked, and why
- Telemetry on blocked files, deduplicated per device
- Signing with Azure Artifact Signing, and a guided, safe way back
Cloud configuration
- The successor to GPO: templates from ADMX and existing GPOs
- Four-eyes principle: author and approver are different people
- Signed policies with protection against rollback
- Attestation per device: drift and tampering become visible
Packaging
- Analyse installers (MSI, NSIS, Inno Setup, WiX Burn) and convert them to MSIX
- Automatic fixes where an application breaks after conversion
- Sign and publish to Intune as an app
- Third-party installers only run in an isolated, single-use container
From audit to enforce
Without surprises in production.
Inventory
Scan installers and devices: which software runs, and who signed it?
Simulate
The policy in audit mode and in the simulator: what would be blocked, and why?
Sign
After approval by a second person, the policy is signed and versioned.
Enforce
Deploy through Intune or the EAMP agent, with attestation per device and a guided way back.
Built as a security product
Trust you can demonstrate.
Signed
Every policy is signed (ES384). Devices verify the signature before they read anything.
No rollback
Devices refuse older policy versions, and an attempt is reported.
Four eyes
Publishing requires approval by a second person with the Approver role.
No passwords
EAMP never sees passwords and holds no standing access to your tenant: everything runs through Entra app registrations you consent to yourself.
Tenant isolation
Data is stored separately per customer, and a package for one tenant refuses another tenant’s policies.
Isolated conversion
Third-party installers only run in a single-use Windows container that is discarded afterwards.
Requirements
- A Microsoft Entra ID tenant
- Windows 10 version 2004 or later for the EAMP agent
- App Control deployment through the agent: Windows 11 22H2 or Windows Server 2025 (older versions through Intune)
- Microsoft Intune as a deployment channel is optional
- Hosted in Microsoft Azure, West Europe region
See how EAMP works in your environment?
Schedule a demo. We’ll show how EAMP handles your applications and policies, and what it takes to get started.