This blog post is about showing you the steps to remove pre-installed Microsoft store apps via Intune. This is a new feature in Windows 11, 25H2. These are Microsoft store inbox apps, which comes pre-installed on Windows 11 devices. Not everyone needs these default apps, and therefore can be easily removed and blocked with the help of policies. Once you apply the necessary policies to remove those apps, a user will not be able to re-install it until that policy is removed for that specific app.
You can target the removal of below apps via Intune.
- Feedback hub
- Microsoft 365 Copilot
- Microsoft News
- Microsoft Photos
- Microsoft Clipchamp
- Microsoft Copilot
- Microsoft Solitaire Collection
- Microsoft Teams
- Microsoft Sticky Notes
- Microsoft To Do
- MSDN Weather
- Outlook for Windows
- Paint
- Quick Assist
- Snipping tool
- Windows Calculator
- Windows Camera
- Windows Media Player
- Windows Notepad
- Windows Sound Recorder
- Windows Terminal
- Xbox Gaming app
- Xbox Identity provider
- Xbox Speech to Text Overlay
- Xbox TUCI
Prerequisites
- Windows 11, 25H2 or later Enterprise or Education editions.
- Devices enrolled into Intune.
- Administrator access to Intune admin center.
Remove Pre-Installed MS Store Packages Intune Policy
You can remove these apps by creating a device configuration profile in Intune. You can use a Settings catalog policy or OMA-URI setting for removing default store packages Intune policy.
1. Using Settings catalog
- Sign in to Intune admin center > Devices > Windows > Configuration > Create > New Policy.
- Platform: Windows 10 and later, Profile type: Settings catalog. Click Create.
- Basics tab: Provide a Name and Description of the policy. For example: Remove Default Microsoft Store Packages. Click Next.
- Configuration tab: Use the settings picker to search for Remove Default Microsoft Store packages, then navigate to Administrative Templates > Windows Components > App Package Deployment. Select the apps you want to target for removal. Use the toggle switches to set each app to True if you want to remove it, or False if you want to keep it installed.
- Scope tags (optional): A scope tag in Intune is an RBAC label you add to resources (policies, apps, devices) to limit which admins can see and manage them. For more Information, read: How to use Scope tags in Intune.
- Assignments: Assign the policy to Entra security groups that contain the target users or devices. As a best practice, pilot with a small set first; once validated, roll it out more broadly. For guidance on assignment strategy, see Intune assignments: User groups vs. Device groups.
- Review + create: Review the deployment summary and click Create.
2. Using OMA-URI
Alternatively, you can create a custom device configuration profile in Intune and user OMA-URI setting to remove the default pre-installed Microsoft apps.
- Sign in to Intune admin center > Devices > Windows > Configuration > Create > New Policy.
- Platform: Windows 10 and later, Profile type: Templates, Template name: Custom
- Basics tab: Provide a Name and Description of the policy. For example: Remove Default Microsoft Store Packages. Click Next.
- Configuration settings: Click on Add button to add below OMA-URI Settings:
- OMA-URI Setting:
- Name: Provide a name of the setting, for example: Remote default Store apps.
- Description: Provide a description
- OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RemoveDefaultMicrosoftStorePackages
- Data type: String
- Value: In the value text box, Copy and paste below code. Packages with true value will be removed. Change it to false if you do not want to remove the app.
<enabled/><data id="WindowsFeedbackHub" value="true"/>
<data id="MicrosoftOfficeHub" value="false"/>
<data id="Clipchamp" value="true"/>
<data id="Copilot" value="false"/>
<data id="BingNews" value="true"/>
<data id="Photos" value="false"/>
<data id="MicrosoftSolitaireCollection" value="true"/>
<data id="MicrosoftStickyNotes" value="true"/>
<data id="MSTeams" value="false"/>
<data id="Todo" value="false"/>
<data id="BingWeather" value="true"/>
<data id="OutlookForWindows" value="false"/>
<data id="Paint" value="false"/><data id="QuickAssist" value="false"/>
<data id="ScreenSketch" value="false"/>
<data id="WindowsCalculator" value="false"/>
<data id="WindowsCamera" value="false"/>
<data id="MediaPlayer" value="false"/>
<data id="WindowsNotepad" value="false"/>
<data id="WindowsSoundRecorder" value="false"/>
<data id="WindowsTerminal" value="false"/>
<data id="GamingApp" value="true"/>
<data id="XboxGamingOverlay" value="true"/>
<data id="XboxIdentityProvider" value="true"/>
<data id="XboxSpeechToTextOverlay" value="true"/>
<data id="XboxTCUI" value="true"/>
- Scope tags (optional): A scope tag in Intune is an RBAC label you add to resources (policies, apps, devices) to limit which admins can see and manage them. For more Information, read: How to use Scope tags in Intune.
- Assignments: Assign the policy to Entra security groups that contain devices. As a best practice, pilot with a small set first; once validated, roll it out more broadly. For guidance on assignment strategy, see Intune assignments: User groups vs. Device groups.
- Applicability Rules: Add the rules for applying this policy. For example: Assign this profile only if the OS edition is Windows 11 Enterprise. Intune will only apply the profile to devices that meet the combined criteria of these rules.
- Review + create: Review the deployment summary and click Create.
Update Intune Policies
The device check-in process might not begin immediately. If you’re testing this policy on a test device, you can manually kickstart Intune sync from the device itself or remotely through the Intune admin center.
Alternatively, you can use PowerShell to force the Intune sync on Windows devices. Restarting the device is another way to trigger the Intune device check-in process.
End User Experience
App removal only occurs after a user sign-in or when you are provisioning a device (e.g., via Autopilot). Therefore, if you have applied the policy and still see the apps, then consider signing out and signing back on to the device once.
