Locking down the Microsoft Store

[AutoJuan]

Hi Tech Community,

I am currently trying to find a way to lock down the Microsoft Store on our enterprise devices running Windows 10.

I am aware that we can redirect our users to use a curated business store, but there is no stop for a user to log onto a personal account and using the store to download and install any other application.

Any insights are greatly appreciated,

Thanks in advance!!

[#2]

You can either disable the Microsoft Store completely, or use the Windows Store for Business only. If you want to do the later, first make sure you configured the Business Store to your liking and then disable the public store either with GPO or Intune:

GPO:
Computer Configuration > Administrative Templates > Windows Components > Store > Only Display The Private Store within the Microsoft Store

Intune:
https://docs.microsoft.com/de-de/archive/blogs/beanexpert/block-windows-10-public-store-using-micros...

[#3]

Hi,
I created a blog about managing the store with applocker/intune, some time ago. Maybe this is what you are looking for?

https://call4cloud.nl/2020/06/managing-apps-in-the-microsoft-store/

[#4]

It's a complete mess, the only way we found to lock the store down was using AppLocker.
You can add all the default Windows apps to a policy really easily if you install GPMC onto one of your endpoint devices and edit the policy from that.
The user experience isn't ideal - you just get an error message if you try and install a non-approved app, but it works and stops apps you haven't approved from being installed. I'm using this on Win11 but it'll work on Win10 too.
Make sure you have a policy entry to allow administrators to run any application.

[#5]

Applocker is indeed the way to go... there are more options to block/prevent/remove it... but... that's not my cup of tea... Applocker it is!

https://call4cloud.nl/2020/06/managing-apps-in-the-microsoft-store/#part2

[#6]

@Rudy_Ooms_MVP Blocking the store completely isn't an option due to the amount of Windows functionality that would never update if you did, and some manufacturers are delivering drivers and support software through the store, e.g. it seems to be the only way to get the Waves MaxxAudio driver. No Store = no audio functionality on your machine 😞

It's a shame Microsoft have made such a mess of being able to manage it, this stuff has been possible on other platforms for a very long time, and was possible on Windows until fairly recently. It's bizarre that any product manager would think the current situation is acceptable for a release product used in business (i.e Windows Pro/Enterprise).

[#7]

Block Microsoft Store using AppLocker

Type secpol in the search bar to find and start AppLocker.
In the console tree of the snap-in, click Application Control Policies, click AppLocker, and then click Packaged app Rules.
On the Action menu, or by right-clicking on Packaged app Rules, click Create New Rule.
On Before You Begin, click Next.
On Permissions, select the action (allow or deny) and the user or group that the rule should apply to, and then click Next.

Regards,
Rachel Gomez

[#8]

🙂 ... I guess you misread the article.. as I am not advising the block/remove the store at all... but just limiting it with the use of applocker and packaged app rules 🙂

[#9]

Is this not working on a Windows 10 Home device because the user is an Administrator?
I believe i configured it as stated above to Deny the Microsoft Store.

[#10]

Windows 10 home 🙂 as home in no support for aadj and almost no support for intune 🙂

[#11]

Thanks. While the business case for disabling or controlling the Store is obvious, it should be even more obvious to designers and program managers that controlling Store access for kids is essential functionality.

The Store should be controllable via Microsoft Family Security functionality. Child access should be controllable. Please pass this on to folks responsible for Family account design. Thanks.

[#12]

@Rudy_Ooms_MVP Hmm, yeah not sure what I had been reading... I was on a bit of a rant about how annoying the situation is/was - apologies for that 

Also, have you seen the interesting (but sadly [hilariously] broken) new Store "integration" with AppLocker since Store version 22303.1401.5.0? Could be really good if they hadn't messed up the version checking...

[#13]

How do I get the information for the App Rule? Ive followed the article listed from call4cloud.nl and it works only for MS apps. I want to include Apple apps but not sure where to get the configuration info from for the XML file

[#14]

@dretzer  Thanks for the sharing knowledge ,Its not working on Windows 10 Pro.

can you help to provide for win10 Pro.

[#15]

@AutoJuan 

I understand it is an old topic, but here's is an updated information on the query:

The best way is to use a Settings Catalog policy "Turn off store application". It still allows you to Install Store Apps from the Company Portal App. Refer to this blog post, for more detailed information about this subject: https://cloudinfra.net/how-to-disable-microsoft-store-in-windows-using-intune/