I have resolved this and made a guide.
Applocker Intune impelemntation
Open local security policy
Navigate to Application Control Policies -> Applocker
In each: Executable rules, windows installer rules, script rules, packaged app rules right click, and create default rules.
This will create the standard, so nobody can install anything unless they are admin. Programs will only be executed from Program Files and Windows folder.
In executable rules, an extra security measure is to add a deny section to C:\Users\*\Downloads so nothing in the downloads folder will be executed as an extra layer.
Now to migrate this to Entra :
Right click Applocker and export it to .xml
From this xml we need to add two sections to Entra.
https://intune.microsoft.com/#home > devices > windows> config profiles> create new > platform win10 or later > type is templates and then select custom > create
Name it something, click next, add, name should be EXE, OMA-URI is:
./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/Native/EXE/Policy
Type: String
Value is a cut out of the .xml we exported. The section needed starts with after it. Like this:
Copy and paste this into the value in Intune and click save.
Add another one, name it Appx
OMA-URI : ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/Native/StoreApps/Policy
It is a string again and value is: The section needed starts with after it. Like this:
Click save, add the config to the relevant groups you want, sync up device and the check compliance if the policy has been assigned.
