Disable/Block Microsoft Store App using Intune

In this blog post, we will explore the settings to disable Microsoft store app on Windows devices using Intune. To disable the store app, we can use a setting available in the Settings catalog called Turn off the Store application. Enabling this setting will prevent users access to the Store app.

Please note that Turn off the Store application setting is only applicable to Enterprise licensing.

When you enable Turn off the Store application to disable Microsoft Store app. Access to the store apps via company portal app and also the deployment of store apps using Microsoft Store apps (new) will still work.

• Turn off the Store application:
  • Prevents users from directly accessing the store using the winget APIs.

• Require Private Store Only
  • This setting is also available in the Settings catalog. It also only works for Enterprise licensing customers only. However, it will not block Winget APIs to install apps via Winget. For more information, refer to the link: Block MS Store except Winget.

Disable/Block Microsoft Store App Using Intune

• Sign in to the Intune admin center > Devices > Configuration > Create > New Policy.
• Select Platform as Windows 10 and later.
• Profile type: Settings Catalog.

• Basics: Provide a Name and Description of the policy.
• Configuration settings: Click on + Add settings and search for Turn off store application. Select the setting for configuration.

• Enable Turn off the Store application setting.

Denies or allows access to the Store application. If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. If you disable or don’t configure this setting, access to the Store application is allowed.

About Turn off the Store application

• I would recommend configuring an additional setting to allow auto-update apps from the Microsoft app store. Click on + Add settings again and search Microsoft app store. Select Allow apps from the Microsoft app store to auto update.

• Set Allow apps from the Microsoft app store to auto update to Allowed.

Specifies whether automatic update of apps from Microsoft Store are allowed. Most restricted value is 0.

Allow apps from the Microsoft app store to auto update

• Assignments: Assign this policy to Entra security group containing users/devices.
• Review + create: Review the policy and click Create.

Sync Intune Policies

The device check-in process might not begin immediately. If you’re testing this policy on a test device, you can manually kickstart the Intune sync from the device itself or remotely through the Intune admin center.

Alternatively, you can use PowerShell to force the Intune sync on Windows devices. Restarting the device is another way to trigger the Intune device check-in process.

End User Experience

Once this policy has been successfully applied to the end-user’s devices, any user attempting to launch the Microsoft Store application will encounter an error message stating that the Microsoft Store is blocked. The error code 0x800704EC will also be displayed at the bottom of the window.

Failed to Install or Upgrade Microsoft Store package

After applying the Turn off the Store application policy to the target devices, Winget will also be blocked. If you attempt to install any application using winget, you will receive the following error message:

Failed to install or upgrade Microsoft Store package because Microsoft Store client is blocked by policy

Disable/Block Microsoft Store App for Windows 10/11 Pro Edition

Turn off the Store application and RequirePrivateStoreOnly policy settings configured via Intune are not applicable to Windows 10 and Windows 11 professional editions.

To block Microsoft Store App on Windows 10 and Windows 11 professional edition, you can create a DWORD registry entry RequirePrivateStoreOnly under HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore and set its value to 1.

You could also use a DWORD registry entry RemoveWindowsStore under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore. Set its value to 1 to block Microsoft store and reboot the device.

Please note that I tested blocking MS Store App using RemoveWindowsStore on a Windows 11 Enterprise device and rebooted my device a couple of times. However, Store App was still accessible. If you use this registry key and if it does not work, then you can use RequirePrivateStoreOnly registry entry.

If WindowsStore registry key does not exist, then create it first and then create DWORD reg entry RequirePrivateStoreOnly.

There are few ways to deploy the registry keys and values using Intune. You can deploy it via a simple one off PowerShell script, or you can use Intune device remediations. Please note that device remediations will again require enterprise licensing (#remediations-prerequisites).

PowerShell script deployment method will be more suitable for Pro Editions. I have prepared a script which you can use to create RequirePrivateStoreOnly registry entry to block the Store app on Windows 10/11 Pro editions. You can download the script from my GitHub repo link: Remediate-MSStore.ps1. Use the steps on the post: #step-2-deploy-powershell-script to deploy the script. That’s it!

If you want to use Intune device remediations, I have prepared Detection and remediations scripts for this, you can download the script from the GitHub link: Disable Microsoft Store and use the steps on the post: #step-2-create-a-script-package to create a script package deployment and block MS Store App.

FAQs

Conclusion

Consider blocking access to the Microsoft Store in your company because it offers a wide range of non-productive apps. Additionally, using the Microsoft Store can complicate app management for your IT administrators.

Instead, it’s advisable to centralize app management through Intune, which provides greater control. Furthermore, Microsoft has introduced a new app type in Intune for improved app management: Microsoft Store app (new).

Read Next

Disable/Block Microsoft Store in Windows [7 Ways]

Block Microsoft Store using Intune except Winget