In certain situations, Admin By Request pre-approval does not override portal or sub-setting policies that block system-file or System32 subprocesses. In practice, this means a parent application can be pre-approved and still fail if it launches a child process that is blocked by policy.
The over-arching business priority is to:
enforce least privilege and application control on Windows endpoints, ensuring that only approved applications can run with elevated privileges, and
ensure that system integrity is maintained by blocking potentially risky system subprocesses (e.g. those in System32).
Admin By Request always attempts to achieve the correct balance between user productivity (allowing necessary workflows) and security (preventing unapproved or dangerous actions), but sometimes, those priorities do conflict.
When documenting or configuring Admin By Request pre-approvals:
Pre-approval is not a higher-priority override than system subprocess blocking policies.
If the child process is blocked by policy, the approved parent process can still fail.
When that happens, solve it with policy scope and settings design, not just with application pre-approval.
For more information, refer to Pre-Approval Does Not Override System Subprocess Blocking.