Last year, we introduced Trust Policies in our Cloudpager platform. This feature allows administrators to restrict application containers to specific Windows operating systems and/or designated devices. While the concept is straightforward, our customers have been using it in creative and impactful ways.
If you would like to see Trust Policies in action, you can check out the video below.
In this post, we’ll highlight a few real-world use cases for Trust Policies.
Business Continuity Access Desktops
In highly sensitive environments like healthcare, business-critical electronic health record (EHR) software is often delivered via virtual desktops or as published applications. However, due to the critical nature of the software, some vendors recommend maintaining a subset of machines with a traditional local installation and a special configuration. This setup typically includes a read-only copy of patient data that updates on a set schedule. In the event of network failure or loss of access to virtual desktops, clinical staff can still access essential data from designated machines.
This scenario presents a challenge for IT teams. Managing various EHR client configurations on physical endpoints using traditional deployment tools can be slow, unreliable, and stressful; especially when urgent updates are needed.
By containerizing the EHR application using Cloudpaging, IT teams can streamline this process. They can provision the business continuity configuration only to designated Business Continuity Access (BCA) desktops using a Trust Policy.
For example, they might assign the container to a group of devices whose hostnames begin with a prefix like BCAxxxx perhaps with an Azure Entra ID Dynamic Group. This ensures the application shortcut only appears on the appropriate machines.
Device-Specific Applications and Peripherals
In a previous blog post, we shared a use case where a legacy application required each desktop to be registered in a print table. Otherwise, attempting to print would result in an error. Using a Trust Policy to restrict provisioning only to a group of desktops in the print table eliminated related service desk calls.
Similarly, Trust Policies can be used to limit applications that rely on specific peripherals such as label printers, lab equipment, or payment terminals. Some applications won’t even allow users to log in unless accessed from permitted endpoints. This makes Trust Policies ideal for managing hardware-dependent application delivery.
Limiting Applications by Region
Many organizations use standardized desktop naming conventions that reflect device type, operating system, region, and department. For instance:
- W for Workstation
- L for Laptop
- T for Thin Client
- V for Virtual Desktop
- WVIEIT4921 might indicate a Windows Virtual Desktop in Ireland used by an IT employee
If you have applications that are sensitive or licensed for specific regions, Trust Policies allow you to restrict access based on group membership which can be determined by device naming conventions. This ensures applications are only provisioned where they’re needed and allowed.
Restricting Applications From Deploying to Unsupported Operating Systems
Some organizations enforce strict policies to ensure enterprise applications are only used on supported operating systems. Although shadow IT is less common today, it’s still possible for privileged users (e.g., server or network admins) to unofficially upgrade to Windows 11 or downgrade to an unsupported version.
With Cloudpager and Trust Policies, administrators can restrict application access to specific operating systems. For example, if an application is not compatible with Windows 11 and should only be available on Windows 10, a Trust Policy can enforce this limitation.
Organizations aggressively maintaining only supported versions of Windows 11 (excluding LTSC releases) may also update their Trust Policies routinely to deprecate older Windows 11 builds.
Dynamic Desktop Provisioning
As more enterprises adopt Windows 365 Cloud PCs and Autopilot for remote provisioning, application delivery becomes a bottleneck; especially when relying on outdated package formats or deployment tools. The more applications that need to be installed, the longer it takes for users to become productive on their new desktops.
For years, customers have leveraged Cloudpager Workpods and user assignments to virtualize and deliver applications on-demand, dramatically speeding up the process.
In some cases, applications should only be provisioned on specific devices, such as Windows laptops or Cloud PCs. Using Azure Entra ID Dynamic Groups (as seen in the screenshot above) and Trust Policies, administrators can automatically enforce these restrictions. Dynamic Membership Rules can assign newly provisioned devices to the appropriate group, ensuring Trust Policies are consistently applied.
Conclusion
Trust Policies make it simple to manage applications with unique deployment requirements in Cloudpager. Whether you need to:
- Restrict an application to certain devices
- Limit it to specific Windows versions
- Control availability across regions
- Enforce policies on dynamically provisioned desktops
Cloudpager Trust Policies provide the flexibility and precision IT teams need. To learn more about Cloudpager, check out numecent.com/cloudpager. To see the platform in action and/or explore additional use cases, request a demo with our Technical Solutions team below: