One of the most common requests from companies that are embracing BYOD is: how can I restrict apps from running in the user’s mobile device? One of the Enterprise Mobility Suite components that can help you with that is Windows Intune. By using this cloud service you can manage mobile devices from multiple platforms, such as Windows Phone, iOS and Android. Review this article to understand what are the major capabilities of each platform that can be manage by Windows Intune. For Windows Phone in particular, when the administrator creates this allow/deny list, and the user tries to access a blocked app, he will receive a pop up message similar to the one below:
You can specifically allow or deny (block) Windows Phone 8.1 apps on devices by using app allow and deny lists. You can then centrally deploy these app allow and deny lists by using Microsoft System Center 2012 R2 Configuration Manager and Windows Intune. To learn more about that follow the step by step procedures from this article: Restrict Windows Phone 8.1 Apps
Also, if you are interested in know more about Windows Phone Security capabilities, make sure to review this curation that I put together with a collection of Windows Phone Security related articles.