Many attacks on organizations start with one simple moment: a user downloads a file to their machine and runs it. It might be an installer from a fake site, an "update" that came from an ad, or a free tool that looks harmless.
Most organizations count on their EDR to catch the file once it's already on the endpoint. That reacts too late. It makes far more sense not to let an unapproved file reach the endpoint in the first place.
That's exactly what Admin By Request's Web Access Management does: it controls what users download and which sites they browse, before the problem reaches the endpoint.
What is Web Access Management?
Web Access Management is the third product in Admin By Request's Zero Trust platform, alongside Endpoint Privilege Management (managing local admin rights) and Secure Remote Access. It launched in August 2026.
It runs inside the Admin By Request agent that's already installed on the endpoint. There's no proxy, no DNS filtering, no firewall changes and no browser extension. Policy is enforced on the endpoint itself, so protection works even when the employee is off the corporate network.
For organizations already using Admin By Request for privilege management, turning it on is a click in the portal, with no new agent to install. Anyone who wants to try it can use the free plan, which includes 25 endpoints with no time limit.
The downloads module: no executable reaches the endpoint unchecked
Every executable a user downloads goes through the organization's policy before it opens. The file is held in a protected area on the endpoint that the user can't access, until it's checked and approved.
Pre-approved software. The organization defines an allowlist of trusted software. Software can be identified by five criteria: site, download URL, file hash, the vendor's digital certificate, or a combination of vendor and application name. Approved software downloads without waiting for approval, but is still scanned.
Scanning with dozens of engines. Every file is scanned with OPSWAT MetaDefender across more than 37 antivirus engines. A malicious file is quarantined automatically, and an unknown file can be sent for deep analysis in the cloud.
An approval request for everything else. Software that isn't on the allowlist needs a request from the user and approval from IT. You can require users to give a reason, or to verify their identity with Entra ID MFA before the download is released.
With an allowlist setup, where everything else needs approval, downloads are sealed tight. And because enforcement happens in the agent rather than in a browser extension, it can't be bypassed with a direct download using curl on the command line or Invoke-WebRequest in PowerShell.
The web filtering module
The organization defines which sites users may browse, by user group. You can block a whole domain or just a specific path within it, and show users a custom message explaining why the site is blocked. A user who needs a blocked site can request access.
A particularly useful option: allow browsing a site but block downloads from it. Employees keep working as usual, and the site doesn't become a way in for software.
Expected by the end of the year:
- Filtering sites by category.
- Browser extension control: an organization-wide list of approved extensions, and an approval request to install any other.
- Integration with Google Threat Intelligence to identify malicious sites.
More capabilities
- Browsers and versions. The organization decides which browsers are allowed, such as Chrome, Edge or Firefox, and the minimum version of each. An old or unapproved browser is blocked, and so are browsers embedded inside apps.
- VPN detection in the browser. The system detects VPN browser extensions and removes them, so users can't get around the browsing policy.
- Downloads for the device owner only. On shared endpoints you can limit software downloads to the endpoint's primary user. Other users can keep browsing.
- Intune compliance check. An endpoint that doesn't meet the Intune compliance policy can't download executables.
- A full audit trail. Every visit, download, approval and block is logged, so there's a complete record for investigations and audits.
Three problems it solves
1. Unapproved AI tools. Employees download AI tools to their machines, or browse to AI sites and upload sensitive documents. With Web Access Management the organization decides which AI tools are allowed. An unapproved AI tool doesn't download to the endpoint, and an unapproved AI site is blocked, so no data can be uploaded to it.
2. Shadow IT. When every piece of software that enters the endpoint goes through an allowlist or an approval request, IT knows exactly what's installed and running on every endpoint. Combined with Endpoint Privilege Management, which prevents installs without admin rights, you get full control over both what enters the endpoint and what runs on it.
3. Threats that arrive through a download. Many attacks start with a malicious file that users download and run themselves. Instead of waiting for the EDR to detect the file after it has already run, Web Access Management stops it before it reaches the endpoint: the file is held in quarantine, scanned by dozens of engines and released only if it's clean and approved.
Summary
Web Access Management moves protection from the moment a file is already running to the moment before it reaches the endpoint. One agent, with no extra infrastructure, controls downloads, browsing and browsers, and deals with unapproved AI tools, Shadow IT and threats that arrive through downloads.
At OnCloud we sell and implement the Admin By Request platform: building the allowlist, setting browsing policy by group, and connecting it to Entra ID and Intune. Want to see it working in your organization?
Book a technical demo