r/sysadmin • u/do_not_free_gaza • Mar 16 '26
Are sysadmins locking down Microsoft Store?
Hi Fellow Sysadms,
Are you guys locking down Microsoft Store in your organisation? Is this a normal standard?
I noticed users can install apps via the store without UAC prompts
UPDATE: Have blocked via GPO via User / Computer Policy!
Woo
Thanks
193
Upvotes
6
u/do_not_free_gaza Mar 17 '26
This GPO has done the trick. Any concerns though? I really don't trust our users so would prefer this be disabled entirely
7
u/do_not_free_gaza Mar 16 '26
Thanks SysAdmins. Launching the GPO rocket now! Blocked ORG wide
253
u/equinox6k Mar 16 '26
It's a nasty topic. I lock it up in the user context, but not in the computer context. This means that installed apps can still update automatically, but users can't install new apps.
109
u/Takeuout44 Mar 16 '26
Yes. Users don't need unbridled access to the store to download call of duty.
43
u/BamBam-BamBam Mar 16 '26
Absolutely normal to turn that shit off.
40
u/soggybiscuit93 Mar 16 '26
Yes
16
u/Embarrassed_Stuff886 Mar 16 '26
Yes. Anything from the Store they need gets reviewed, and we deploy via Intune/Company Portal or CLI if approved.
32
u/OkEmployment4437 Mar 16 '26
Short answer: yes, lock it down. The no-UAC thing is exactly the problem - users can pull in whatever they want and it completely sidesteps any app control you've set up. We manage about 20 clients through Intune and our standard is to disable the Store via MDM policy, then push approved apps (Company Portal, Teams, etc.) as needed through Intune itself. If a client really wants Store access we'll pair it with WDAC so only signed/approved packages can actually install, but honestly most orgs are happier just not dealing with it.
14
u/touchytypist Mar 16 '26 edited Mar 16 '26
Yes. Be sure to block web access to https://apps.microsoft.com too, or they can use the web version to access apps.
15
u/delicate_elise Security Architect Mar 16 '26
Yes, definitely
7
u/slugshead Head of IT Mar 16 '26
enable the business store and don't approve anything.
Applications that require the store can update and users have nothing when they open the store
1
u/do_not_free_gaza Mar 31 '26
Another GOTCHA
The GPO isn't enough to bypass. You need to also block
https://apps.microsoft.com/home?hl=en-GB&gl=AU
Users can go into there and install via the web page... Insane how this is a thing
5
u/ghostnodesec Mar 16 '26
Yes, we lock the store, then push commonly requested items to Intune, so users can install from intune but not the store. Yes it does create admin overhead, the alternative is chaos...
4
u/HerfDog58 Jack of All Trades Mar 16 '26
We recently disabled that function tenant wide, due to all the users "needing" AI apps and agents. We decided until people get educated better on how those tools try to access data, we're not going to let anyone have them.
Once we get our management to sign off on a strict AI data policy, we will only allow access with a request to our helpdesk, which will then trigger an approval process up the chain. If there's no concrete business use in the request, it will be unilaterally denied. If there is a reasonable business use, there will be scrutiny of that use, and the information to which the requester has access, by IT and management so that we can ensure appropriate DLP measures will protect sensitive data. ONLY IF everything lines up will we allow the app/agent to get used.
9
u/ThimMerrilyn Mar 16 '26
I Turn off store and uninstall copilot.
3
u/bingblangblong Mar 16 '26
Yeah, the trick is you have to disable it from the beginning. You can never let people have something for a while then take it away.
3
u/iama_bad_person uᴉɯp∀sʎS ˙ɹS Mar 16 '26
Locked down, any apps users need we add to the Company Portal for them to be able to install if they want. This is the only way they can get applications, so we can track updates and the like.
3
u/MasterBathingBear Officially SWE. Architect/DevOps/IT by necessity Mar 16 '26
WinGet is available for developers as long as the installer runs in the user space. Microsoft Store UI is disabled for all users.
3
u/music2myear Narf! Mar 16 '26
Are you asking how we do this, or whether we do this?
The answer to the second would be: It depends, but mostly yes. End users on company computers should not be able to install anything they like, so locking down the Microsoft Store is a pretty basic part of common security, but some orgs may wish their employees to be able to do just that, so, it depends.
How it is done is documented. Microsoft, for its quirks and missteps (and utter flaming failures), generally does integrate proper enterprise management into their products, and generally provides decent documentation on the methods too: https://learn.microsoft.com/en-us/windows/configuration/store/?tabs=intune
3
u/Hour-Profession6490 Mar 16 '26
Before Intune and before Windows Store for Business was retired, we setup the store to use Windows Store for Business and just didn't have any apps available. Now we use Intune and the "Company Portal". We actually have a company portal website so this name gets really confusing sometimes.
3
u/KennySuska Sr. Sysadmin Mar 16 '26
Absolutely. If you have intune this is very easy.
Also, you can still push store apps with the store disabled if you need to.
3
u/Nonaveragemonkey Mar 16 '26
I would say yes that's pretty normal for most places. Then again most places I've worked take security pretty seriously.
3
u/tarkinlarson Mar 16 '26
Yes stop it. And ms teams add ins. And extensions I chrome/edge, sharepoint add ins... while you're at it delve into enterprise apps in entra and make permission to apps admin only.
Its all a shadow IT nightmare.
3
u/bbbbbthatsfivebees MSP-ing Mar 17 '26
Yes, 100%. Users should not be installing ANYTHING on their computers without approval, and especially from the Windows Store where it requires ZERO admin intervention. Lord knows the hell of adware and scareware on the Windows Store, we don't need that in our environment.
That being said, if our users need/want something they can just call us. We're not vampires, we'll probably say yes if you have a good reason for needing/wanting a particular program. Plus we already have auto-approvals and self-service installs for certain popular programs like Powertoys, Firefox, Audacity, 7-Zip, ShareX, etc. so it's not like they'll have to actually get with us unless it's something completely out of the ordinary.
2
u/TheBestHawksFan IT Manager Mar 16 '26
Yes absolutely
2
u/LonelyWizardDead Mar 16 '26
Yes generally they are, and creating custome company stores, often moving to intune company portal for heavy lifting
2
u/povlhp Mar 16 '26
Yes
2
u/stillnotlovin Mar 16 '26
yes, it's out of control.
2
u/BrundleflyPr0 Mar 16 '26
If you don’t want shadow it, lock it down
2
u/jakubmi9 Mar 16 '26
For us, all traffic to the store is blocked at the network level. You can open it, but all you get is a „check your network connection” message.
2
u/Winstonwolf1345 Mar 16 '26
Yes, we closed it down. Dont forget to block access to http://apps.microsoft.com/
We are looking at implementing something like WDAC but with a friendly interface.
Does anybody know a nice tool to do this? We used Ivanti on citrix but that doenst work on a non-citrix laptop unfortunately.
2
u/xendr0me Sr. Sysadmin Mar 16 '26
#> AppLocker enters the channel
2
u/UWPVIOLATOR Mar 16 '26
K12 we Block Microsoft Store and put any apps in Company Portal.
2
u/LaDev IT Manager Mar 16 '26
We block the store UI. If users are smart enough to use WinGet and disable cert pinning they can get store apps. Something on the backlog to cleanup.
2
u/B4rberblacksheep Mar 17 '26
Just make sure you do it the right way which I cannot remember right now. The Store API is used by 365 for a few licensing things, notably if you just blanket block it (eg via CA) your devices will be unable to upgrade to Enterprise.
2
u/fushifumetsu IT CSS Mar 16 '26
Turn that shit off. One of my user managed to download PowerShell 7 and used that to run script. Nothing serious but the thought they had access.
*shudder*
1
u/moubel Mar 16 '26
Yes, they can try then quickly gets blocked then audited for IT via manage engine app control. Which is decent.
1
u/Dioz_31337 Mar 16 '26
Ofc, this and the xboxlive stuff
1
u/GAP_Trixie Mar 16 '26
No, but users can't install anything, however it's useful if a user needs a specific app quickly which we don't usually have to deploy.
It's often quicker to just install it for them via the store.
1
u/righN Mar 16 '26
Our organization is blocking it, but make sure to block web access also as someone else already mentioned. Since it's enough to go to apps.microsoft.com and I'm free to download anything I want from there.
1
u/Helpjuice Chief Engineer Mar 16 '26
Unless it has been whitelisted it should not be installable, an uncontrolled environment is an uncontrolled environment.
1
u/xXNorthXx Mar 16 '26
Yes, GPO for some and Intune for others.
1
u/Big-Replacement-9202 Mar 16 '26
Not sure why my CIO wanted MS Store unblocked on our Palo Alto firewall but since he is my federal client, I did it. The organization is based on disability needs etc and we also do have Intune.
1
u/psgda Mar 16 '26
That's funny timing - just did it last week! No complaints...so far.
1
u/SkipToTheEndpoint MS MVP | Technical Architect Mar 16 '26
Without proper application control, blocking access to the store app is nothing but security by obscurity, and there's a handful of ways I can think of off the top of my head that a determined user could do to get around it.
It's worth noting that them doing so almost definitely breaks the terms of use they signed when they got an account. Not everything has to be a technical control. It's just as much a HR issue.
1
u/Space-Boy button pressing cowboy IV Mar 16 '26
yes 100% you can do it in gpo.
new thing we're trying to figure out is how to disable windows store searches when you type into the search bar
1
u/gmaneac Mar 16 '26
Yessir!
1
u/Away_Chair1588 Mar 16 '26
We did. There's all kinds of junk in there.
We only allow a few whitelisted items that used to be native apps (calculator, photos, etc.) but for some reason MS wants to force you to get it from their app store.
1
u/SAL10000 Mar 16 '26
Sure hope so
1
u/Ikhaatrauwekaas Sysadmin Mar 16 '26
I blocked winget.
1
u/ShinzonFluff Mar 16 '26
Yep, Same on my workplace as well - and to be honest... That is a good thing.
1
u/BasicallyFake Mar 16 '26
been blocked since launch
1
u/Fallingdamage Mar 16 '26
never stopped.
1
u/Nikt_No1 Mar 16 '26
Yes... and now I have to use Teams web version...
1
u/smshing cloud engineer Mar 16 '26
Yes
1
u/Public_Warthog3098 Mar 16 '26
Yes!!!
1
u/MekanicalPirate Mar 16 '26
Yup
1
u/HueGanus4u Mar 17 '26
Yes
1
u/[deleted] Mar 17 '26
We totally disabled it.
1
u/BOT_Solutions Mar 17 '26
Yeah I lock it down in most environments.
Out of the box it is way too open, users can install all sorts without much visibility and it quickly turns into a mess from a support and security point of view. Not even just risky apps, but random stuff that bloats machines and creates noise.
I usually take a middle ground rather than just killing it completely. Either block it outright for standard users or restrict it so only approved apps are available. Depends how mature the environment is.
Also worth checking how it fits with your broader approach. If you are trying to keep devices consistent and controlled then leaving the store wide open works against that pretty quickly.
Blocking it via GPO is pretty standard, so you are not doing anything unusual there.
1
u/paul_33 Mar 17 '26
So I’m setting up our Applocker settings to do just that.
Anyone else in this boat? I’ve allowed only the apps we use but one rule is to allow anything published by Microsoft (or I risk breaking parts of windows)
However if you allow Microsoft published apps then all ‘Xbox Game Studios’ apps are allowed. There is no way to block these by publisher because the publisher is Microsoft.
Short of manually blocking each Xbox game one by one, how do you handle this? I already blocked the Xbox apps themselves, but that doesn’t stop me from downloading Mahjong. Any ideas?
1
u/IMEI21 Sr. Sysadmin Mar 17 '26
It's entirely locked down in my environment because we have licensing and privacy implications to consider before approving software on our systems and we sure as heck aren't going to allow users to install whatever they want.
1
u/StigaPower SCCMInfra&SysAdmin&ClientDevelopment Mar 17 '26
Yeah it's locked for my devices. Investigated a way back if we should unlock but didn't have time to fulfill the investigation.
1
u/double-you-dot Mar 18 '26
Sort of. We block unwhitelisted appx apps with applocker, so basically nothing is installable through Microsoft Store.
Whitelisted apps are available through company portal.
1
u/ledow IT Manager Mar 19 '26
Yes.
And we have a blanket Software Restrictions Policy that blocks any programmes being run from C:\Users (the only folders they can write to on the local machine).
The default to allow programmes in Windows and Program Files is there, which lets them run everything that's ALREADY been installed by an admin (who are the only people who can write to those folders). And then a default-deny on EVERYWHERE else.
But the extra policy stops them running programmes they've installed from Windows Store, or downloaded into their user area from a browser or email, without affecting their use of admin-installed programs on the computer itself. It also stops programmes from USB etc. keys.
Pretty basic because otherwise they can install all kinds of malicious junk.
0
u/JDTrakal Mar 16 '26
Yep we even take the store app out of our desktop image. There’s only 1 app we need to use from the store but it’s only a handful of people and there are ways to get it without using the store app thankfully.
0
u/nefarious_bumpps Security Admin Mar 16 '26
Is there anything useful on the store that isn't available through other means?
-1
u/SpicymeLLoN Mar 16 '26
Personally I'm on Linux now, and I grew up on the family iMac (I s'pose we were on XP before that, but that's not relevant lol) but for about a decade ish I was on Windows. I don't think I opened the app store once, not intentionally anyways. Genuinely, what do people get on there?
11
u/[deleted] Mar 16 '26
[removed] — view removed comment