⚙️🪟💻🔓CP - Security - Microsoft Store - Allow
Exclusion stops enforcement; it does not undo it. This is the policy that actually gives the Store back, and it exists because the block writes to a surface that does not clean itself up.
What this policy is about 🔓
This is the counterpart to ⚙️🪟💻CP - Security - Microsoft Store, and it exists for a reason that catches people out constantly.
The block writes a value into HKLM\Software\Policies\Microsoft\WindowsStore. That value stays where it is when a device leaves the profile's scope, because unassigning a policy tells Intune to stop enforcing a setting, not to reverse it. A device you excluded from the block yesterday still has no Store today, and will keep not having one until something writes the value back.
That something is this policy. It sets the same settings to the opposite state and is assigned to the exception group rather than excluded from anything.
This is the single most useful thing to understand about tattooing settings. If a device needs a blocked capability back, it needs two changes: out of the block, and into the inverse. One without the other looks like a broken policy and is actually a misunderstanding of how the registry works.
Why this matters 🕵️
Because otherwise the exception process quietly fails and nobody notices for a fortnight. Someone raises a ticket, the device gets added to the exception group, the ticket gets closed, and three days later the user reports that the Store is still missing. The engineer checks the assignment, sees the exclusion applied correctly, and starts looking for a sync problem that does not exist.
Shipping the inverse alongside the block turns that entire class of confusion into a two-group membership change with a predictable outcome.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Administrative Templates → Windows Components → Store.
| Setting | Value |
|---|---|
| Turn off the Store application | Disabled |
| Turn off Automatic Download and Install of updates | Disabled |
| Disable all apps from Microsoft Store | Not configured |
| Assignment, include | 🛡️🪟💻👈🔓⚙️Group - Microsoft Store Allowed |
| Assignment, exclude | None |
Disabled, not Not configured. This is the part that trips people up. Not configured means "do not manage this setting", which leaves the tattooed value exactly where the block left it and achieves precisely nothing. Disabled writes the value back to zero, which is what actually restores the Store. The distinction is the entire point of this page.
The device must also be excluded from the block. Both policies would otherwise apply, and a device receiving conflicting values for the same setting resolves in a way you do not want to reason about at four in the afternoon. Exclusion plus inverse, always both.
Caveats ⚠️
Membership is device-scoped and it is meant to be small. The scenario is a device that needs a specific vendor application published only through the Store, most often a hardware utility for audio, display or stylus features. It is not "this user finds the block annoying."
Restoring the Store restores the whole Store. There is no partial version of this. The device gets the full shopfront back, browsing and all, so the justification needs to cover the fact that the machine is now outside the app governance story rather than just carrying one extra application.
Verify on the device, not in the portal. Intune will report success for the assignment well before anyone confirms the Store is actually usable again. Check HKLM\Software\Policies\Microsoft\WindowsStore\RemoveWindowsStore reads 0, or simply open the Store on the machine.
Review it on a schedule. Exception groups grow and never shrink unless somebody makes them. Quarterly is enough: confirm the vendor still ships Store-only, and confirm the device still exists.
👥 Assignment scope
Exception group only. Every other Windows device stays on the block.
The bar for entry is a documented, approved business reason recorded per device, with a review date. Temporary exceptions have a well-earned reputation for outliving the people who approved them.
🔗 Related
- ⚙️🪟💻CP - Security - Microsoft Store: the baseline this policy carves an exception out of.
- 🛡️🪟💻👈🔓⚙️Group - Microsoft Store Allowed: the group both assignments depend on.
Two changes, not one: out of the block, into the inverse. Anything less leaves the setting exactly where it was. 🔓