This article explains how to block applications and domains directly from the Device Details → Applications tab in Swif. These controls are part of Swif’s consolidated blocking experience for Shadow IT and endpoint application control.
Use this workflow when you:
Discover a risky or unapproved app on a specific device, and
Want to immediately block its usage (and/or related domains) across one or more devices or device groups.
What you can do from Device Details → Applications
From the Device Details → Applications tab, you can:
Add applications to a blocklist based on:
Application usage (blocking the app from running)
Application domains (blocking access to app‑related domains)
Target the block to:
Individual devices, or
Device groups
This flow is consolidated with other Shadow IT blocking experiences so admins see consistent options and behavior across the product.
Opening the blocklist from a device
Go to Devices in Swif.
Select the device you’re interested in.
Open the Applications tab.
Find the application you want to block.
Click Add to blocklist (or the equivalent action for managing the blocklist).
Swif will open the Manage blocklist modal with the current device context already applied.
Choosing what to block
Inside the Manage blocklist modal, you can choose between:
Applications
Select from known apps (Swif catalog)
Enter custom application name (manual entry)
Domains
Enter domain (manual)
Upload file (for many domains at once)
Category (bulk category domains at once)
Known applications vs custom application names
To keep the UI focused and reduce confusion, Swif shows only one input strategy at a time:
Select from known apps
Use this if the app exists in Swif’s Applications Catalog.
As you type, you’ll see matching applications to pick from.
The custom app name field is hidden in this mode.
Enter custom application name
Use this if the app is not in the catalog or if you prefer manual entry.
You see a simple input box with this placeholder:
“Type an Application Name / Domain and Press Enter”
The dropdown does not open by default. It only appears once you type something and there’s a match.
The known app dropdown is hidden in this mode.
This makes it clear whether you’re choosing from known apps or entering a custom string, while still supporting both workflows.
OS‑specific behavior for desktop app blocking
Swif's backend uses different technologies per operating system (e.g., Santa for macOS, AppLocker for Windows, the Swif Agent for Linux, and a manifest‑based uninstall flow for Android). The UI abstracts this, but there are a few important OS‑specific details.
Mac
For macOS devices, Swif can block applications by name matching and other app attributes. When you block an app for macOS:
You can simply provide the application name (or select one from the catalog).
Swif creates or updates an Application Block Policy that prevents the app from running on targeted macOS devices.
Linux
For Linux devices, Swif blocks applications by application name:
Provide the app name string (or select it).
Swif creates or updates a Linux Application Block Policy.
Windows – path‑based blocking
For Windows devices, application blocking relies on file path information because it uses Windows AppLocker under the hood.
When you include any Windows devices in the target:
The Manage blocklist modal will ask you for an Application path (appPath).
A Windows‑specific placeholder is shown, e.g.:
C:\Program Files\Teamviewer
If you try to save without a path, you'll see an error message:
"Application path is required for Windows"
Internally, Swif uses this path to create or update a Windows AppLocker Policy across multiple rule collections (e.g., .exe, .appx, .msi).
Note: Some critical Windows applications (for example, certain Microsoft apps like Edge) may not be fully enforceable due to OS limitations. Always test your policy against a small set of devices first.
Android – package‑based blocking
For Android devices, application blocking uses the app's Android package identifier (e.g., com.company.app) rather than a display name or file path.
When you include any Android devices in the target:
Known apps — If you select an app from Swif's Applications Catalog, Swif automatically resolves the correct Android package ID. No additional input is required.
Custom apps — If you use the "Enter Custom Application Name" option, provide the Android package name (e.g.,
com.example.myapp).No installation path is needed for Android — only the package identifier.
Under the hood, Swif adds the app to the device‑level uninstall manifest rather than creating a separate MDM policy. The backend computes the effective uninstall list per device at manifest‑update time, merging any blocked‑app overrides with baseline app settings.
Note: If an app does not have a known package identifier in Swif's catalog, the package ID will not be resolved automatically. In that case, use the custom entry option and provide the package name directly.
Desktop app blocking: Entering custom app names and domains
Placeholder behavior
Where you can type a value directly (for both app names and domains), the placeholder text is:
Type an Application Name / Domain and press Enter
Behavior:
Type your custom application name or domain.
Press Enter to add it to the queue.
This helps clarify that typing alone is not enough; pressing Enter confirms the entry.
“Enter Custom Application Name” interactions
When you choose Enter Custom Application Name:
You get a plain input box instead of an immediate dropdown.
The known app dropdown is not opened by default.
As you type, if there are matches in the application catalog:
Those are suggested in a dropdown.
You can select one of the matches, or just continue with your manual string.
This avoids confusion with the Select from known apps option and makes it clear that this field:
Accepts free‑text values, and
Optionally helps you find catalog entries if they exist.
Domain blocking: manual / file upload / category (web filtering)
You can block domains associated with the application directly from this flow.
Entering domains manually
Select Domain → Enter Domain.
Type a domain (for example,
example.com).Press Enter to add it.
Repeat for additional domains.
Uploading a file of domains
Select Domain → Upload file.
Upload a CSV or other supported file containing domains.
The blocklist UI will:
Display the uploaded file name.
Show the total count of domains in the file.
Avoid listing every individual domain in the UI if you have thousands of entries.
"Block sign‑up” control
When you open Manage Blocklist from a Shadow IT app, Swif now supports an app‑level Block sign‑up control:
A toggle such as Block sign‑up for this app appears in the app‑level blocking area.
This blocklist control is scoped to the domains you uploaded, not the entire team or tenant. The blocklist can then be assigned to devices or groups to be effective.
When enabled:
New sign‑ups to those specific domains are blocked according to Swif’s standard enforcement (for example, via the browser extension on managed devices).
When disabled:
Sign‑up behavior control will be removed.
Select from Categories (category-based domain blocking)
In addition to entering domains manually or uploading a file, you can now block entire categories of domains at once. This is ideal for organizations that need to enforce compliance standards (e.g., ISO, SOC2) without manually entering thousands of individual domains.
How it works
When you choose Application Domain in the Manage Blocklist modal:
Set the Domain Selection mode to "Select from Categories."
Swif loads a list of pre-populated domain categories from the backend, each with a domain count.
Select one or more categories using the checkboxes.
Click "+ Add to Blocklist Queue" to add the selected categories to your queue. A success toast confirms the addition.
Proceed to Step 2: Device Selection to assign the category block to specific devices or device groups.
Click Continue to save.
Category | Description |
Advertising | Ad-serving and tracking domains |
AI | AI tool and service domains |
Core | Core infrastructure blocklist domains |
FireBog | Community-maintained blocklist domains |
NRDs | Newly Registered Domains |
Porn | Adult content domains |
Social Media | Social networking platform domains |
Telemetry | Telemetry and analytics collection domains |
Block Sign-Up Only with categories
The "Block Sign-Up Only" toggle is also available when using category selection. When enabled, Swif allows website access but prevents the user from signing up or logging into web apps within the blocked categories.
How category blocks appear in Device Details
Once saved, category blocks appear in the Device Details → Apps → Blocked tab with:
Category name (e.g., "AI")
Domain count (e.g., "18 domain(s)")
Block Type badge showing "Category" — distinguishing them from per-domain or file-upload blocks
Removing category blocks
To remove a single category block, click Allow on the category row in the Blocked list.
To remove all blocks (including both category and per-domain entries), use "Allow All."
Notes
Category and per-domain blocks can coexist on the same device — they are displayed with different Block Type badges for clarity.
Subdomains within a category are automatically covered with wildcard rules.
Selecting devices and device groups
You can apply your blocklist to:
The current device (pre‑selected when starting from Device Details), and/or
Other devices or device groups.
Key behavior:
All eligible devices (based on your environment) are available for selection.
Device groups can have arbitrary names and are displayed consistently in the selector.
You can mix devices and device groups in a single operation to roll out a block quickly.
Swif automatically creates the correct policies per OS for all targeted devices.
How blocklist entries appear in Device Details
Once a block is configured, you can view how it’s applied on the Device Details → Applications tab.
Applications and policies
For each blocked application, you’ll see:
Application Name
The text you entered or the name you selected from the catalog.Block Type / Policy usage
Shows how the application is being blocked (e.g., application usage vs domain).
Displays the policy name that is enforcing the block.
The policy name is clickable, so you can jump directly to that policy for more detail or editing.
Domains from uploaded files
For domain lists added via file upload:
Swif displays:
The file name, plus
The number of domains in that file.
This keeps the table readable, even when blocking thousands of domains.
Rule‑type chip and tooltip
In the policy/usage columns, you may see a chip indicating how many rule types the policy contains.
Hover over the chip to open a tooltip with more detail (for example, whether the policy contains multiple OS‑specific rules or both application and domain rules).
This lets you quickly understand how broad or granular a policy is without opening the full policy page.
Summary
From Device Details → Applications, you can now:
Block risky or unapproved apps on a specific device and roll that block out to other devices or groups.
Use a single, consolidated UI to:
Select known or custom apps,
Provide required Windows paths,
Block domains individually or via bulk file upload, and
See exactly which policies are enforcing those blocks.