Observe mode indicates that Application Control is running but it only monitors and logs observations. When running in Observe mode, the application doesn't prevent any execution or changes made to the endpoints. Instead, it monitors execution activities and it compares them with the local inventory and predefined rules.
Note
Observe mode is available only in a ePO - On-prem managed environment.
When running in Observe mode, Application Control emulates Enabled mode but only logs observations.
An observation event is logged that corresponds to the action Application Control takes in Enabled mode. For example, if not authorized, the execution of Adobe Reader is prevented in Enabled mode. In Observe mode, the file is allowed to execute unless banned by a specific rule.
Observe mode offers two benefits.
It helps you develop policies and determine rules that allow applications to run in Enabled mode.
It performs a dry run for the product to run or install software without any blockages.