How policies work

Downloads, Websites and Clipboard each have their own list of policies, under Protection.

• Checked from the top. The first enabled policy that matches decides: Allow Audit Warn or Block. Use the arrows to reorder; put exceptions above the policies they're exceptions to.
• Default policies come last. Dangerous file types, ZIPs inside ZIPs, and malicious commands on the clipboard. They can be switched off but not changed.
• Switch a policy off with its switch, to keep it for later.
• Who it applies to: all enrolled users, selected groups, or selected users. Each browser only receives the policies for its user.

Browsers pick up saved changes within minutes. If two admins edit at once, the second save is refused rather than overwriting the first; reload and try again.

Each list's own default

Below each list, what happens when no policy matches: Allow, unless you change it.