Forum Discussion
Possible to disable Microsoft Store while allowing app updates?
That is the correct way to restrict them, however this is only possible on Enterprise versions of W10, and not Pro versions..
Windows 10 Pro from 1511 build upward, you notice that the Group Policy settings to disable Microsoft Store are not applied, and you cannot disable Microsoft Store .
This behavior is by design. In Windows 10, version 1511, Windows 10, version 1809, and Windows 10, version 1903, these policies are applicable to users of the Enterprise and Education editions only.
Correct. If you have Enterprise or Education you can configure Group Policy to block the Store. If you block it in the USER policy, users will not be able to access the Store, but the computers will still have access to update apps. If you block it in the COMPUTER policy, the user nor the computer can access it and apps will not update.
Blocking store at user policy and allowing it at computer policy does not prevent users to use store app.
Computer policy seems to be more effective than same setting at user policy.
Tuomo_Koskimaki The question from the OP was is it possible to block the Store for users but still allow the apps to be updated. The correct way to achieve this is by blocking it in the User Policy. This allows the computer to update already installed Store apps while preventing users from installing new ones.
This policy is not designed to prevent them from using apps that are already installed. If you block the store from the computer policy any Store apps, including inbox apps will not be updated and will eventually cause those apps to potentially stop working.
If you want to ensure the store doesn't even launch, I would suggest using AppLocker.
-Eddie
Well, at our environment GPO:s do not function as desired. If Store is allowed at computer policy, it is also allowed for users. That is not desired result. Suitable setting was to set "Only display the private store within the Microsoft Store". Business store/Private store is not configured so, no access nor downloads for users. Computers still get updates from store. I tried applocker policy as well. I denied winstore app at Domain Users". It did not function either.
This is useful information to update existing built-in apps between Windows 10 releases. We currently set Turn off Store application group policy under Computer Configuration. So if we set in group under User Configuration, will it update already provisioned UWP built-in apps (ex. Calculator) under existing user profiles? Also will it allow other UWP apps bundled with drivers (ex. Canon Office Printer Utility) to install in user profiles? Appreciate your help, just looking to see if you found any limitations. Also surprised it is not documented anywhere by Microsoft since it seems like a better workaround then using the Store for Business which is reportedly deprecated now. Eddie Leonard
Assuming you devices can connect to the Store through your firewalls/proxies, then yes it should update your Inbox apps and other apps from the Store. As for other apps not installed from the Store, I don't believe it will, but I'm not 100% sure there.
-Eddie
