Windows has been moving towards a more agile and modern model where various components that might once have been part of the operating system code itself are now built using the Universal Windows Platform (UWP) and serviced from the Microsoft Store as apps. This offers several advantages, including reduced disruption to the end user as a restart is not needed to complete the update process.
This article offers some tips to help you optimize bandwidth when a large number of updates to provisioned or installed Windows apps are delivered to the Windows 10 devices in your environment. This information may be interesting to you if you have devices in your environment that have limited network bandwidth. There are several recommended approaches. Which one you choose depends on your use case and available bandwidth constraints.
- Ensure that Delivery Optimization is configured correctly. You can use Delivery Optimization to reduce bandwidth consumption by sharing the workload required to download update packages among multiple devices in your environment.
- If Delivery Optimization doesn’t completely solve the bandwidth issues you are seeing with app updates, try removing those apps from your devices that are not actively being used. For example, removing apps that are no longer used from the image you deploy on new machines will reduce the overall bandwidth used by updates, while ensuring that your devices always have the latest versions of any apps that are actively used.
- If removing unused apps is not feasible, it is also possible to turn off updates for specific apps, such as ones that aren’t being actively used. This method will also reduce overall bandwidth used by app updates and ensures that, as we make improvements to the apps you do use, those updates will still occur automatically. You can turn off updates for specific apps by utilizing the Enterprise Modern App Management CSP.
I’d now like to walk you through how to turn off updates for specific apps using Microsoft Intune. If you are using another mobile device management (MDM) provider, please refer to their documentation for instructions to use the Enterprise Modern App Management CSP to turn off specific app updates.
Turning off specific app updates using Microsoft Intune
On Windows 10 devices, an administrator can create a block list for Microsoft Store apps and prevent the Store from updating these apps when updates are triggered. This is accomplished by using the DoNotUpdate setting, under the AppStore node, in the Enterprise App Management CSP, as shown below:
Figure 1. DoNotUpdate setting in the Enterprise App Management CSP.
To configure this via the Microsoft Intune admin console, launch the Microsoft Intune Admin console and open the Device configuration blade. Select Profiles and then Create profile.
Figure 2. Creating a new device configuration profile in the Microsoft Intune admin console
Enter a Name for the profile (e.g. Block Store App Updates), a Description of what the policy will do, and set the Platform to Windows 10 and later. Set the Profile type to Custom and select Configure. On the new page, select Add to create a new Custom URI setting.
The example below shows how to block the Calculator app from being updated.
Figure 4. A custom OMA-URI setting that blocks updates to the Calculator app.
In this example:
- The OMA-URI is: ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/<PackageFamilyName> /DoNotUpdate, where PackageFamilyName =WindowsCalculator
- The Data type is Integer.
- The Value is 1, which blocks the Calculator app from being automatically updated.
Once you have configured your policy, select OK. This will create a setting in the profile.
Figure 5. The custom OMA-URI setting in the profile.
You will need to repeat the steps above for each Microsoft Store app for which you want to prevent automatic updates. (Tip: The PackageFamilyName for typically installed and provisioned apps in Windows 10 can be found here.)
Once you have added all of your settings to the profile, select OK on the Custom URI settings page and select Create to create the profile. Once the profile has been created, use the Assignments tab to deploy these settings to your devices.
To re-enable updates for an app at any time, simply update the Value field for that app to 0.
Bulk creating the policy via Microsoft Graph
Each row in the profile represents a setting for a single app. Currently, we do not support ability to create settings in bulk or import a list of settings directly into the Microsoft Intune admin console. To configure settings in bulk, you may want to consider using the Intune APIs in Microsoft Graph.
Here is a sample Graph call excerpt for this task:
{
"@odata.type": "#microsoft.graph.windows10CustomConfiguration",
"lastModifiedDateTime": "2017-01-01T00:00:35.1329464-08:00",
"description": "Policy to block automatic store app updates",
"displayName": "Block Store App updates ",
"version": 1,
"omaSettings": [
{
"@odata.type": "microsoft.graph.omaSettingInteger",
"displayName": "Block Alarm App",
"description": "Block Alarm app from the store from getting app updates",
"omaUri": "./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.WindowsAlarms/DoNotUpdate ",
"value": 1
},
{
"@odata.type": "microsoft.graph.omaSettingInteger",
"displayName": "Block Calculator App",
"description": "Block calculator app from the store from getting app updates",
"omaUri": "./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.WindowsCalculator/DoNotUpdate ",
"value": 1
},
]
}
For each app that needs to be added to the DoNotUpdate list, an additional omaSettings object will need to be added.
Learn more
Referring to the list of apps that ship in Windows 10 may help you to identify which provisioned or installed Windows apps you may want to select to no longer receive updates. You can also block updates for apps you acquire from the Microsoft Store, Microsoft Store for Business, or Microsoft Store for Education; for example, if you temporarily need to keep a single version of an app on all your devices. In the future, we are looking at additional controls and options to help you better manage app updates and will share more details as these become available.
For more help with using the Microsoft Graph APIs for Intune, please see the following resources:
- Intune Graph Samples ReadMe – prerequisites and guidance on how to get started with the API
- PowerShell sample script repository – examples of how to access Intune service resources using the Graph API
- Graph Explorer – free tool that let make requests and see responses against the Microsoft Graph to create your policies
