Restrict installation via Microsoft Store for Windows 10/11 Pro devices through Intune.

by

Since the configuration service provider (CSP) or group policy (GPO) settings to configure access to the Microsoft Store app are available to Windows Enterprise and Education editions, we have come up with an alternate workaround through Applocker Store App Rules

Save the below content as an XML file.
<RuleCollection Type="Appx" EnforcementMode="Enabled">
	<FilePublisherRule Id="617edd5b-3360-4281-9724-21e453587fce" Name="All Signed Application Packages" Description="This allows members of the Everyone group to run signed application packages." UserOrGroupSid="S-1-1-0" Action="Allow">
		<Conditions>
			<FilePublisherCondition PublisherName="CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="*"> 
				<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
			</FilePublisherCondition>
		</Conditions>
	</FilePublisherRule>
	<FilePublisherRule Id="617edd5b-3360-4281-9724-21e443587fce" Name="Whitelist Microsoft Windows app" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
		<Conditions>
			<FilePublisherCondition PublisherName="CN=MICROSOFT Windows, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="*">
				<BinaryVersionRange LowSection="0.0.0.0" HighSection="*" />
			</FilePublisherCondition>
		</Conditions>
	</FilePublisherRule>
</RuleCollection>
Create a custom Administration template under the device’s “Configuration”

Chose a name for the “Configuration” and proceed.

Upload the XML file and finish the policy with the necessary assignment.

http://icloud360-in.stackstaging.com/xml.xml

Reference:

https://call4cloud.nl/2020/06/managing-apps-in-the-microsoft-store

Leave a Comment