June 6, 2026

UT1 categories: what to block first on a pilot fleet

Turning on every UT1 category on day one is how pilot programmes die. Legal pushes back on adult and gambling blocks, engineering complains about misclassified dev tools, and the SOC drowns in review tickets. A phased category rollout keeps security wins visible while helpdesk load stays bounded.

Phase 1: threat-aligned (week one)

Enable malware, phishing, and command-and-control categories plus your signed threat indicator feeds — URLhaus, OpenPhish, PhishTank. These blocks rarely generate false-positive debates and give immediate value in incident metrics. Pair with the local block page so users see feed source and domain, not a broken browser state.

Phase 2: acceptable use (week two–three)

Add adult, gambling, and extreme content categories for corporate-owned devices where HR and works-council policy already prohibits personal use. Communicate before enablement; document the policy reference in your ISO 27001 statement of applicability. Monitor review queue volume — if appeals spike, a CDN or shared host is probably mis-tagged; fix with tenant allowlist entries tied to owners and expiry dates.

Phase 3: AI and shadow SaaS (week four+)

Block the UT1 AI chat category by default, then allowlist sanctioned endpoints only. Add custom blocklists for file-sharing and paste sites if DLP policy requires it. Pilot contested categories on a subset of devices first — one-size-fits-all fleet enablement is what drives shadow DNS overrides.

What to defer

Social media, streaming, and shopping categories are politically noisy and weak on security ROI unless you have a explicit productivity mandate. Defer them until threat and AI controls are stable. Document deferred categories in your risk register as accepted exposure with compensating awareness training if required by internal audit.

ClearScreen assigns blocked categories on the Customer Environment policy every enrolled device inherits. Stage phase two by enabling one contested category at a time and watching the review queue, then export block CSVs weekly to tune allowlists before you attach Intune deployment to the wider fleet.

Measuring pilot success

Define success before install: target reduction in malware-related tickets, maximum acceptable appeals per 100 devices per week, and percentage of fleet on current policy version. Review with legal and HR after phase two, not only with the SOC. If appeals cluster on one UT1 category, split that category out or refine allowlists rather than abandoning the whole phase. NIS2 and ISO 27001 surveillance audits reward documented rollout decisions — which categories, which groups, which date, which exception process — more than they reward a screenshot of a block count dashboard.

Plan group count and version drift with the endpoint fleet sizing tool before you scale past the pilot.