Instead of looking for known bad programs, it works as an allowlist: only software that matches your policy, for example by publisher, signature or file hash, is allowed to run. Everything else is blocked, including malware that has never been seen before. Microsoft now also uses the name App Control for Business for the feature.
It is one of the strongest controls against malicious executables and scripts, but it takes planning. A policy that is too strict breaks business software, and one that is too loose gives little protection. An audit mode lets you see what would be blocked before you enforce the policy.
Policies need maintenance as software changes, and attackers sometimes use allowed programs that are already on the system to run their own code.
Start in audit mode, build policies around signed software, roll out in stages, keep a plan for updating them and deploy first on systems with the highest risk.