## Allowlisting control modes

You can control how allowlisting behaves for each of your devices in idemeum. `App control mode` defines how idemeum agent behaves for rule enforcement and event collection.

| Mode     | Definition |
| -------- | ----------- |
| Disabled | idemeum agent is not capturing any `execution` events and not enforcing any rules. User experience does not change on the workstation. |
| Audit    | idemeum agent is capturing `execution` events and uploading them to the cloud periodically. However, agent is not applying any rules or interrupting execution or elevation flows. |
| Rules    | Idemeum agent controls application `executions` and enforces the rules that you created in the portal. For allowlisting `default deny` policy is applied for untrusted applications. If the application is not explicitly allowed, it will not run. |

## Change allowlisting control mode

- Navigate to your idemeum admin portal
- Select `Devices` and search for the device you want to change the app control mode for
- Click on `...` then choose `Set app control mode`
- Choose the mode and save the configuration

## Bulk allowlisting control mode change

- Navigate to your idemeum admin portal
- Access `Devices` section and select multiple devices with check boxes
- Click on the bulk change button at the top and choose `Set app control mode`
- Choose the mode and save the configuration

Idemeum tracks every execution across your workstations and represents each application as an event in the cloud.