An organization recently experienced losses caused by users who installed applications from unauthorized sources on their smartphones. The organization wants to reduce the risk of reoccurrence but…

Configuring and deploying Group Policy to enforce an application whitelist directly prevents users from installing applications from unauthorized sources, addressing the root cause of the losses. Combining this with consistent enterprise-level policy enforcement ensures the control applies uniformly across all managed devices in scope. This approach simultaneously meets the risk-reduction objective by blocking unauthorized installs and the monitoring objective through centralized policy compliance reporting.

Modifying the MAM configuration to capture application-related events improves detection and monitoring but is a detective control that does not prevent users from installing unauthorized applications in the first place.

Setting GPOs to collect logs and feed them to the enterprise SIEM improves visibility but remains a detective control - it does not enforce application restrictions or prevent unauthorized installations from occurring.

Enforcing device configurations with API-leveraging agents and feeding logs to a central system addresses monitoring but does not implement the application whitelist enforcement needed to prevent unauthorized installs.