15 — FEDERAL CLOUD · 2026
App-Control Signing Pipeline
Application control as software: signed, versioned WDAC policy (Windows' allow-list for what code may run), built by pipeline and rolled out ring by ring.
- Built
- An application-control program I lead, run as software: policy authored, signed and rolled out by pipeline.
- Stack
- WDAC, HSM-backed Key Vault signing, build pipelines, Managed Run Command.
- State
- Being built.
IN PROGRESS · UPDATED 3 SEP 2026
Described at the architecture level; the program is still being built.
Carter Barnes · cloud engineer, federal Azure · Contact
Built at work for a federal client. I describe how it works and why; no client, system names, data or results.
What it is
Windows Defender Application Control decides what code is allowed to run on a machine. Managed per endpoint and by hand, it does not scale. Managed as software, it does.
I lead an application-control program built that way: policy authored centrally, held under version control, signed with HSM-backed keys, built and deployed by pipeline, and rolled out ring by ring with a rollback path defined before ring one.
How it works
- Authoring
- Centralized policy authoring under version control.
- Signing
- Code-signing infrastructure backed by an HSM-protected Key Vault.
- Delivery
- An automated policy build and deployment pipeline.
- Rollout
- Ring-based, with rollback at every ring.
- Fan-out
- Managed Run Command across subscriptions for deployment.
Decisions
- 01
Security policy is a signed, versioned artifact
The same model already applied to application code. Nothing about it is novel except the decision to stop treating policy as configuration. Per-endpoint approaches stall for operational reasons, not technical ones.
- 02
'Deployed' and 'enforcing' are different claims
Only one of them is worth anything. Ask for the enforcement state by name, from the endpoint, every time, never from the dashboard that describes the intent.
- 03
Rollback has to exist before ring one
The failure mode of a bad application-control policy is machines that will not run their own management agent.