Blocked Esri Apps setting does not prevent connecting to the Organization from ArcGIS Pro

Summary

The Manage blocked Esri apps and capabilities setting in ArcGIS Online and ArcGIS Enterprise (located under Organization > Settings > Security) is designed to control whether ArcGIS Pro can be licensed through an ArcGIS organization designated as the licensing portal. It is not a comprehensive mechanism for controlling the ability to connect and other privileges when connecting to a portal from ArcGIS Pro. 

Behavior

When ArcGIS Pro is blocked by selecting it under Blocked Esri apps and capabilities: 

• Members cannot authorize ArcGIS Pro using a Named User license from that organization. 
• Members who license ArcGIS Pro through a different licensing portal or a Standalone (single use) license can add any ArcGIS organizations as portal connections and sign in with valid credentials. 
• Those members can consume content from and, if granted the necessary privileges, publish content to the active portal. 
• This is the as-designed behavior in both ArcGIS Online and ArcGIS Enterprise. 

Additional Guidance

Organizations that need to restrict what ArcGIS Pro users can do after connecting to a portal should consider using custom roles and privilege management. These controls govern what authenticated users can do within the portal regardless of how ArcGIS Pro itself is licensed.