Forum Discussion

LearningSponge's avatar
LearningSponge
Copper Contributor
Jan 25, 2026

Ability to Block Windows Store on Windows 11 Pro

Dear friends,

I have quite a huge number of student laptops which run Windows 11 Pro (latest) and are connected to Microsoft Entra ID.

The laptops are controlled by InTune.

I am having a problem as they are able to run Windows Store and able to download X-VPN software, even though they do NOT have administrator access to their laptop.

 

I would like to:

  1. Be able to block them from loading Windows Store
  2. Uninstall X-VPN software through inTune

The issue is that, since they are running Windows 11 Pro, I cannot use AppLocker or GPOs since they would need to run the Education or Enterprise version to use AppLocker. The GPO setting to block Store from running has been depricitaed.

Did anyone find a solution to block Windows Store from running on Windows 11 Pro please?

Thanks a lot in advance.

Intune

6 Replies

  • Jenthej's avatar
    Jenthej
    Copper Contributor
    Jan 28, 2026

    you could also try to create a platform script that changes or adds the registry key below, and push the script through Intune. (keep in mind this is a one-time push if you're not having the E3-5 license or A3-5 license you can't use the remediation script option) 

    HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsStore
    HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsStore
    set the name and value as following: RemoveWindowsStore REG_DWORD = 1 

    Do this for both HCU and HKLM. 

    Indeed as LearningSponge​ is saying to manage this through Intune Settings Catalog, you need Enterprise or Education Windows.

  • DM-se's avatar
    DM-se
    Copper Contributor
    Jan 27, 2026

    Hello, you can use script to set registry item. 

    Then use the script like win32 app or platform script, based on you licence.

     

    Key for registry is

     

    $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore"

    $regName = "RequirePrivateStoreOnly"

    $regValue = 1

     

    David

  • Bogdan_Guinea's avatar
    Bogdan_Guinea
    Steel Contributor
    Jan 26, 2026

    LearningSponge​ 

    Hi,

    Hmm, have you tried blocking it via a Custom OMA-URI profile? Not sure if it will work on PRO, but give it a try.

    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowStore

    Data type: Integer

    Value: 0

    or Sign in block same only change the OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Experience/AllowMicrosoftAccountConnection

     

    X-VPN - i will go with a detection/remediation

    Good luck!

    • LearningSponge's avatar
      LearningSponge
      Copper Contributor
      Jan 26, 2026

      Hi,

      Thanks for your feedback.

      Unfortunately, Microsoft restricted the URI: /Device/Vendor/MSFT/Policy/Config/ApplicationManagement/AllowStore

      to Enterprise and Educational editions only.

       

      The other URI still provides access to the Store.

      I cannot understand how Microsoft comes up with such nonsense when, at the same time, entities are pushing for 'Bring Your Own Device'. 

      As if I am going to force users to upgrade their O/S to an educational or Enterprise version.

      I does not make sense at all.

      Thanks

      • Bogdan_Guinea's avatar
        Bogdan_Guinea
        Steel Contributor
        Jan 27, 2026

        LearningSponge​ 

        It is nonsense actually and a bad alternative at this point. Did you try to completely uninstall and remove the Store manually or via script on a device?

        Good luck!

  • MSizec's avatar
    MSizec
    Copper Contributor
    Jan 26, 2026

    Would like to know how to to that efficiently too