Allowednonadminpackagefamilynamerules Now

: If an app's family name is on this list, a standard user can install it even if the general block-policy is active.

: Allowed package family names for non-Administrator user Windows app package installation. Mobile Device Management (Intune/MDM) : allowednonadminpackagefamilynamerules

sudo defaults write /Library/Preferences/com.apple.installer allowednonadminpackagefamilynamerules -array "com.microsoft.*" "com.google.*" : If an app's family name is on

Use specific, narrow rules (e.g., com.company.appname ) instead of broad wildcards like com.* to limit risk. narrow rules (e.g.