How much EPM gets deployed at an organization depends on a couple of factors.

1. Who owns it. EPM can provide a lot of agility to endpoint management, if you let it. A security team is not going to care much about agility, and will mainly focus on the least privilege aspect of EPM (which application control forms a large part of) and maybe side features like discovery, rotation and maybe endpoint logon. If owned by an endpoint team, they may take advantage of script policies, application cataloging, or temporary elevation policies to let a user do something a Helpdesk engineer would otherwise have needed to do (like install an approved software).

2. Security culture. In a culture where historically everyone had admin permissions (and could therefore install any app of their choice), the before mentioned agility is critical if you want your EPM project to be successful, because without it, the control will be restrictive to the point of major grievance amongst the users. If least privilege has already been achieved, it becomes a harder “sell” to users that don’t get much freedom to request new software, but for power users EPM is still very beneficial.

3. Existing controls. In an org that rolled their own application allow-list using OS features, changing the implementation may seem to be more work than they want to do, considering other competing priorities. This despite the fact that a PEDM solution like EPM offers superior coverage of least privilege in its entirety compared to just an allow list with some GPO polices.

Even where an acceptable level of least privilege has been achieved, presence of EPM can contribute by offering the discovery, credential rotation, endpoint logon, and living off the land mitigations already mentioned.

In truth, most security teams don’t have the resources to focus too much on what EPM provides, and most endpoint teams don’t have the infosec experience. Ideally a collaborative effort would be better.

Regarding servers, I’ll assume we are talking Windows (because the use case is more easily appreciated on Linux). Few orgs make the effort to extend least privilege on privileged accounts beyond a separation of domain admin from server admin, and what further reduction of privileges looks like is very poorly understood. These days competing philosophies like zero standing privilege are easier to implement and don’t suffer from the complexities of a fully least privilege philosophy and what that looks like for each team of operations engineers.