Possible to disable Microsoft Store while allowing app updates?

[paulr24]

What I'm trying to figure out is if it is possible to disable the Microsoft Store while still allowing apps like the calculator that are managed by it to be updated. I've figured out how to disable the store but it's the updates that are tripping me up. After a bit of research I've seen some options that required Windows 10 Enterprise and/or Azure (found here: https://docs.microsoft.com/en-us/windows/configuration/stop-employees-from-using-microsoft-store), but we don't currently use those and would prefer to avoid the additional expense if possible. All PCs on the domain are Windows 10 Pro.

Does anyone have any ideas as to how I can get this to work, or if it's even possible?

[#2]

@paulr24 

I've been able to replicate your scenario and I cant get it working either :crying_face:

After a bit of digging this is by design :sad_but_relieved_face:.

Here is Microsoft's KB on this - https://support.microsoft.com/en-gb/help/3135657/can-t-disable-windows-store-in-windows-10-pro-throu...

[#3]

Hi,
Windows store IS necessary for app updates because it's the only one responsive for that task.
it's not heavy or causes any problems to be necessary to disable it. you can use it in your domain-based environment without any issues.
are you having any particular problem regarding Windows store?

[#4]

@Iain Fielding

Thanks for the info! I was able to effectively disable it via Ivanti, but the issue now is that apparently the apps won't be able to update (per @HotCakeX)

Really what I'm looking to accomplish in the end is to make it so users can't use the Microsoft store to download apps for personal use. Maybe there is another way to accomplish this?

[#5]

@HotCakeX

That makes sense that the Windows Store is necessary for the app updates. The main reason we wanted to disable it is so that users won't be able to use it to download apps for personal use. Maybe that can be accomplished in a different way?

[#6]

Hi,
I understand, that's right there must be a way to prevent new app downloads but allow currently installed apps to be updated,
please take a look at this article

https://docs.microsoft.com/en-us/windows/configuration/stop-employees-from-using-microsoft-store

at the bottom it says "employees to only see apps you're managing in your private store"
I think you could use this policy to get the result you want.

[#7]

@HotCakeX

That is the correct way to restrict them, however this is only possible on Enterprise versions of W10, and not Pro versions.. 

Windows 10 Pro from 1511 build upward, you notice that the Group Policy settings to disable Microsoft Store are not applied, and you cannot disable Microsoft Store .

This behavior is by design. In Windows 10, version 1511, Windows 10, version 1809, and Windows 10, version 1903, these policies are applicable to users of the Enterprise and Education editions only.

[#8]

@Iain Fielding 

Correct.  If you have Enterprise or Education you can configure Group Policy to block the Store.  If you block it in the USER policy, users will not be able to access the Store, but the computers will still have access to update apps.  If you block it in the COMPUTER policy, the user nor the computer can access it and apps will not update.

[#9]

This is useful information to update existing built-in apps between Windows 10 releases.  We currently set Turn off Store application group policy under Computer Configuration.  So if we set in group under User Configuration, will it update already provisioned UWP built-in apps (ex. Calculator) under existing user profiles?  Also will it allow other UWP apps bundled with drivers (ex. Canon Office Printer Utility) to install in user profiles?  Appreciate your help, just looking to see if you found any limitations.  Also surprised it is not documented anywhere by Microsoft since it seems like a better workaround then using the Store for Business which is reportedly deprecated now.  @Eddie Leonard 

[#10]

@Timothy Kress 

Assuming you devices can connect to the Store through your firewalls/proxies, then yes it should update your Inbox apps and other apps from the Store. As for other apps not installed from the Store, I don't believe it will, but I'm not 100% sure there.  

-Eddie

[#11]

@Eddie Leonard 

Blocking store at user policy and allowing it at computer policy does not prevent users to use store app.

Computer policy seems to be more effective than same setting at user policy.

[#12]

@Tuomo_Koskimaki The question from the OP was is it possible to block the Store for users but still allow the apps to be updated. The correct way to achieve this is by blocking it in the User Policy. This allows the computer to update already installed Store apps while preventing users from installing new ones. 

This policy is not designed to prevent them from using apps that are already installed. If you block the store from the computer policy any Store apps, including inbox apps will not be updated and will eventually cause those apps to potentially stop working.

If you want to ensure the store doesn't even launch, I would suggest using AppLocker.

-Eddie

[#13]

@Eddie Leonard 

Well, at our environment GPO:s do not function as desired. If Store is allowed at computer policy, it is also allowed for users. That is not desired result. Suitable setting was to  set "Only display the private store within the Microsoft Store". Business store/Private store is not configured so, no access nor downloads for users. Computers still get updates from store. I tried applocker policy as well. I denied winstore app  at Domain Users". It did not function either.