Need to block app from intune

Yep - AppLocker seems to be the more suitable choice for this requirement because its Publisher condition supports file-version comparisons, including the ability to specify versions at or below a given value. This allows you to control which versions of an application are permitted to execute.

On a Windows 10/11 reference computer, open secpol.msc as administrator and navigate to Application Control Policies > AppLocker > Executable Rules. First, select Create Default Rules. This is important because once an AppLocker rule collection is enforced, executables that do not match an applicable allow rule can be blocked. Default rules establish baseline permissions for Windows and applications in Program Files.

Next, right-click Executable Rules and select Create New Rule. Choose Deny as the action, Everyone as the user or group, and Publisher as the condition. Browse to an executable belonging to the application. AppLocker will extract its publisher information, product name, and executable filename. Configure the rule to target the appropriate application and use the file-version slider to establish the version restriction.

For your example, if version 8.0.0.0 is the minimum approved version, you need to account for the fact that the And below comparison is inclusive. A Deny rule using version 8.0.0.0 would also block that version. One approach is to create an Allow Publisher rule with the And above condition, specifying 8.0.0.0. This permits version 8 and subsequent versions, provided no other applicable Deny rule overrides it.

Once the rules are configured, right-click AppLocker and select Export Policy. Save the resulting XML file and open it in a text editor. Locate the executable rule collection:

<RuleCollection Type="Exe" EnforcementMode="NotConfigured">

Change NotConfigured to Enabled:

<RuleCollection Type="Exe" EnforcementMode="Enabled">

Retain the complete executable rule collection, including the applicable default rules and your custom rules. Do not deploy only the custom rule if doing so leaves the executable collection without the necessary baseline allow rules.

To deploy the policy through Intune, navigate to Devices > Windows > Configuration profiles > Create profile. Select Windows 10 and later, choose Templates, and select Custom. Under Configuration settings, add an OMA-URI setting with the name Block Outdated Application Versions, the following OMA-URI, and String as the data type:

./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/BlockedApps/EXE/Policy

Paste the complete XML RuleCollection into the Value field. The BlockedApps portion is simply a policy grouping identifier, so you can use another unique name if required. Assign the configuration profile to your target device group.

The Application Identity service (AppIDSvc) must be running for AppLocker enforcement. Verify its status on a target computer using:

Get-Service AppIDSvc

If necessary, configure its startup through Intune. Do not assume that deploying the AppLocker policy automatically means the service is running.

For troubleshooting, examine Event Viewer under Applications and Services Logs > Microsoft > Windows > AppLocker. Pay particular attention to the EXE and DLL logs, which record application execution decisions, including blocked and permitted execution events.

More at AppLocker CSP.

Btw. note that AppLocker evaluates the file version of the executable, not necessarily the application version displayed in Programs and Features. Verify that the executable's file version accurately reflects the application's release version before deploying the policy.

I would suggest piloting the configuration using three application versions: an older version (7), the minimum approved version (8), and a newer version (9). Confirm that version 7 is blocked while versions 8 and 9 are permitted. This validates the version boundary and helps identify conflicts with other AppLocker rules.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin