It would be nice to be able to set a Deny rule against a Provision, so that then we could have a separate provision for that group of devices. At the moment we would need to set a deny rule against each application

Example here is we have a group of restricted research devices that we only want to have a small number of applications available to. If we could deny this group via the main provision and then we could create a new Restricted Research provision and allow only the apps we wanted. This would also work better when making apps available via AVD.