---
updatedAt: 2026-09-18T18:36:03.000Z
---
# Application Groups | EPM-WM Cloud
## What are Application Groups?
Application Groups are used to define logical groupings of applications. Application Groups are assigned to Workstyles, so you must define Application Groups for all the applications you want to assign to a Workstyle.
There are three ways to add an application to a group:
* [Events](https://docs.beyondtrust.com/epm-wm/docs/policy-editor-application-groups#add-an-application-to-a-policy-and-application-group-via-an-event): Add an existing application on-the-fly from the **Events** tab on the **Analytics** page.
* [Application templates](https://docs.beyondtrust.com/epm-wm/docs/policy-editor-application-groups#add-an-application-to-an-application-group-from-a-list-of-existing-applications): Add an existing application from a list of known applications (application templates).
* [Application definitions](https://docs.beyondtrust.com/epm-wm/docs/policy-editor-application-groups#add-application-using-application-definitions): Create an application using the application definitions and properties.
## Environment variables
You can use the following environment variables in file path and command line application definitions.
To use the variables, enter the variable, including the % characters, into a file path or command line. EPM expands the environment variable prior to attempting a file path or command line match.
### System variables
* %ALLUSERSPROFILE%
* %COMMONPROGRAMFILES(x86)%
* %COMMONPROGRAMFILES%
* %PROGRAMDATA%
* %PROGRAMFILES(x86)%
* %PROGRAMFILES%
* %SYSTEMROOT%
* %SYSTEMDRIVE%
### User variables
* %APPDATA%
* %USERPROFILE%
* %HOMEPATH%
* %HOMESHARE%
* %LOCALAPPDATA%
* %LOGONSERVER%
## Create a new Application Group
> ℹ️
>
> There are predefined application groups available that are already populated with applications and linked to Workstyles. You can create application groups and customize the application and associated properties.
1. From the left menu, click .\
The **Policies** page displays.
2. [Create a new policy](https://docs.beyondtrust.com/epm-wm/docs/policies#create-a-policy).
3. Alternatively, locate an unlocked policy you want to edit from the list and click  **> Edit & Lock Policy**.\
The **Policy Editor** opens, and the **Workstyles** page displays by default.
4. In the left panel, click **Application Groups**.\
The **Application Groups** page displays.
5. On the **Policy Editor** page, expand **Windows** or **macOS**.
6. Click **Application Groups**.
[block:image]
{
"images": [
{
"image": [
"https://files.readme.io/8ac67e903147bd7c5e66536514341709e94d25daf4c930faaf31df52e69d119b-create-app-group.png",
"",
"Application groups main page"
],
"align": "center",
"border": true
}
]
}
[/block]
7. Click **Create New Application Group**.
8. Add a **name** and **description**.
9. Click **Create Application Group**.\
The Application Group is created and displays in the navigation pane and the grid. You are now ready to add applications to the group.
## Show hidden groups
Some Application Groups are hidden by default; for example, Application Groups prefixed by (Default) in the QuickStart Policy. You can show or hide Application Groups.
To show groups hidden by default:
1. In the Policy Editor, expand the **Windows** or **macOS** node.
2. Select **Application Groups**.
3. Select **Show Hidden**.
4. Hide the groups again by selecting **Hide Hidden**.
## Add an application to a policy and Application Group via an event
> 🚧 Important
>
> You can add an application to a policy based on events generated from a particular application type. Supported event types include:
>
> * Process
> * Process with File
> * COM Class
> * Service
> * ActiveX
> * Challenge Response Failed
>
> You can select more than one event in the list to add to the same policy. The matching criteria for all selected and compatible events are added to the selected policy and Application Group selected.
> ℹ️
>
> You can only add an event's application to an unlocked policy.
1. From the left menu, click  .\
The **Analytics** page displays.
2. Locate the event that contains an application you want to add to a policy.
3. In the event row, click  .\
The **Add to Policy** panel displays.
4. Select an unlocked policy and available application group from the drop-down list.
5. Click **Add and Edit Policy**.\
The Policy Editor opens and the **Applications Group** page displays.
6. Edit the application settings.
7. Click **Save Changes**.\
The policy saves.
## Add application using Application Definitions
> 🚧 Important
>
> You must add an application to an Application Group inside of a policy. When adding an application, you can configure the following properties:
>
> * **Application Definitions:** The application definitions are the properties of an application that are used to detect the application in your environment. When the application matches on the configured criteria the rule triggers.
> * **Advanced Options:** When adding the application, advanced settings on child processes and standard user rights enforcement can be configured.
>
> When adding file or folder paths, you can use environment variables as part of the entry. Using environment variables is optional.
>
> The procedure for adding an application is generally the same for every application. The matching criteria varies depending on the application.
1. From the left menu, click .\
The **Policies** page displays.
2. [Create a new policy](https://docs.beyondtrust.com/epm-wm/docs/policies#create-a-policy).
3. Alternatively, locate an unlocked policy you want to edit from the list and click  **> Edit & Lock Policy**.\
The **Policy Editor** opens, and the **Workstyles** page displays by default.
4. In the left panel, click **Application Groups**.\
The **Application Groups** page displays.
5. Click the **Create New Application Group**.\
The **Create New App Group** panel displays.
6. Enter a unique **name** and **description**.\
The description can have up to 1024 characters. The description is not used in rule matching.
7. Click **Create App Group**.\
The Application Group is created and displays in the **Application Groups** list.
8. Click the new Application Group's name.\
The **Applications** page displays.
9. Click **Create New Application**.\
A drop-down with a list of application definitions displays.
10. Select an application definition and configure it based on the [Application definitions](https://docs.beyondtrust.com/epm-wm/docs/application-definitions).\
The screen capture shows the installer package application type and the app definitions you can configure. Scroll to see all options.
[block:image]
{
"images": [
{
"image": [
"https://files.readme.io/ef80d4a65fbb1ecff8e6ab0fa70deb12148abd741588a265ac2b988011f5b693-app-definition.png",
"",
"Application definition configuration for the installer pacakge"
],
"align": "center",
"sizing": "80% ",
"border": true
}
]
}
[/block]
11. Optionally, configure the **Advanced Options**.
*
When selected, any child processes that are launched from this application (or its children) will also match this rule. The rules are still processed in order, so it is still possible for a child process to match a higher precedence rule (or Workstyle) first. Therefore, this option prevents a child process from matching a lower precedence rule.
When an application is launched by an on-demand rule and this option is selected, then the children are processed against the on-demand rules, and not the Application Rules. If this option is not selected, then the children will be processed against the Application Rules in the normal way. You can further refine this option by restricting the child processes to a specific Application Group. The default is to match \<**Any Application**>, which will match any child process.
> ℹ️
>
> If you want to exclude specific processes from matching this rule, then toggle **match** to **does not match**.
>
> Child processes are evaluated in the context that the parent executed. For example, if the parent executed through on-demand shell elevation, then it will first attempt to match On-Demand Application Rules for any children of the executed application.
*
When the application allows a user to open or save files using the common Windows open or save dialog box, this option ensures the user does not have admin privileges within these dialog boxes. These dialog boxes have Explorer-like features, and allow a user to rename, delete, or overwrite files. If an application is running with elevated rights and this option is disabled, the open/save dialog boxes will allow a user to replace protected system files.
Where present, this option **is selected by default** to force these dialog boxes to run with the user’s standard rights, to prevent the user from tampering with protected system files.
When enabled, this option also prevents processes launched from within these dialog boxes from inheriting the rights of an elevated application.
12. Click **OK**.
### Copy an application definition
> ℹ️
>
> For ease-of-use, copy one or more application definitions to save time when setting up an application group. Copy to another application group in the same policy or another policy.
1. From the left menu, click .\
The **Policies** page displays.
2. [Create a new policy](https://docs.beyondtrust.com/epm-wm/docs/policies#create-a-policy).
3. Alternatively, locate an unlocked policy you want to edit from the list and click  **> Edit & Lock Policy**.\
The **Policy Editor** opens, and the **Workstyles** page displays by default.
4. In the left panel, click **Application Groups**.\
The **Application Groups** page displays.
5. Click an Application Group's name.\
The **Applications** page displays.
6. Locate the application you want to copy and click  **> Copy**.
7. In the left panel, click Application Groups again.\
The Application Groups page displays.
8. Locate the Application Group to which you want to copy the application to.
9. Click **Paste**.
> ℹ️
>
> If the **Paste** button is not available, check that the XML is a valid application definition. Copy the XML to a text editor to confirm.
## Add application from template
Use application templates to select an application from a list of known applications. The Policy Editor provides a standard set of templates that covers basic administrative tasks for all supported operating systems, common ActiveX controls, and software updates.
1. From the left menu, click .\
The **Policies** page displays.
2. Locate an unlocked policy you want to edit from the list and click  **> Edit & Lock Policy**.\
The **Policy Editor** opens, and the **Workstyles** page displays by default.
3. Go to **Application Groups**.
4. Select the application group you want to add the app to, and then click **Add From Templates**.
[block:image]
{
"images": [
{
"image": [
"https://files.readme.io/84bcb999c86cac20e25da9a6914ae64532aaa644c0c6f0615aedf9bd37cfcca9-app-templates.png",
"",
"A list of application templates"
],
"align": "center",
"border": true
}
]
}
[/block]
5. Select an application template from the list, and then click **Add**. You can select more than one template at a time.
## Disable an application in an Application Group
> ℹ️
>
> You can temporarily pause the processing of an application rule against an application in an Application Group.
>
> Use this feature if you are rolling out or testing new rules, or while you investigate and fix any problems.
1. From the left menu, click .\
The **Policies** page displays.
2. [Create a new policy](https://docs.beyondtrust.com/epm-wm/docs/policies#create-a-policy).
3. Alternatively, locate an unlocked policy you want to edit from the list and click  **> Edit & Lock Policy**.\
The **Policy Editor** opens, and the **Workstyles** page displays by default.
4. In the left panel, click **Application Groups**.\
The **Application Groups** page displays.
5. Locate the Application Group with the application you want to temporarily disable.
6. Click the Application Group's name.\
The **Applications** page displays.
7. Locate the application in the list.
8. Click  **> Disable**.\
The application temporarily disables.
## Enable a disabled application in an Application Group
> ℹ️
>
> You can enable a paused application in an Application Group.
>
> Use this feature if you are rolling out or testing new rules, or while you investigate and fix any problems.
1. From the left menu, click .\
The **Policies** page displays.
2. [Create a new policy](https://docs.beyondtrust.com/epm-wm/docs/policies#create-a-policy).
3. Alternatively, locate an unlocked policy you want to edit from the list and click  **> Edit & Lock Policy**.\
The **Policy Editor** opens, and the **Workstyles** page displays by default.
4. In the left panel, click **Application Groups**.\
The **Application Groups** page displays.
5. Locate the Application Group with the application you want to enable.
6. Click the Application Group's name.\
The **Applications** page displays.
7. Locate the application in the list.
8. Click  **> Enable**.\
The application enables.