• Intro
• Why this matters
• Prerequisites
• Check current WDAC mode
• Stage the vendor policy file
• Import the vendor supplemental policy
• Return to enforced mode and validate
• Final remark

Intro

This article is part of a series: Navigate to series page

Before creating our own custom supplemental policies, it is worth checking whether the software vendor already provides a WDAC policy that can be imported as-is. In some scenarios this is required for the software to work correctly.

In this article I will show a quick operational flow for importing vendor policies on Azure Local, with Veeam and Lenovo as examples.

Why this matters

Some vendors ship signed components, helper executables, and update tooling that are blocked by WDAC in enforced mode unless their supplemental policy is imported. If the vendor has already packaged a policy for their product, that is usually the fastest and safest place to start.

Vendor references:

• Veeam KB: Importing Veeam Agent for Microsoft Windows into WDAC Policy
• Lenovo XClarity Integrator for Windows Admin Center: Manage nodes without LXCA

Prerequisites

Before you start, make sure:

• Your Azure Local cluster is deployed and healthy.
• You can connect to a node with local admin or AzureStackLCMUser credentials.
• You have downloaded or exported the vendor WDAC policy XML file.
• You reviewed the official Microsoft guidance: Manage Application Control for Azure Local.

Check current WDAC mode

From an elevated PowerShell session:

Get-AsWdacPolicyMode

If you need to stage software installation or troubleshoot initial policy behavior, temporarily switch to audit mode:

Enable-AsWdacPolicy -Mode Audit

Stage the vendor policy file

Copy the vendor XML policy file to a local path on a cluster node, for example:

New-Item -Path C:\wdac -ItemType Directory -Force
# Example: copy vendor policy to C:\wdac\vendor-policy.xml

HINT Keep one folder per vendor and keep the original XML filename so future updates are easier to track.

Import the vendor supplemental policy

Use Add-ASWDACSupplementalPolicy to import and activate the policy across cluster nodes:

Add-ASWDACSupplementalPolicy -Path C:\wdac\vendor-policy.xml

Then verify policy status:

Get-ASLocalWDACPolicyInfo

Confirm that the imported vendor policy appears as active and non-Microsoft-provided.

Return to enforced mode and validate

When validation is complete, set WDAC back to enforced mode:

Enable-AsWdacPolicy -Mode Enforced

Then validate the vendor workload end-to-end (for example, backup agent operations or firmware update workflows) and check that no new WDAC block events are generated for required binaries.

Final remark

Use vendor-provided supplemental policies first when available, and use custom policies only for software where no supported vendor policy exists. This keeps supportability and troubleshooting much simpler over time.