Separate Store app access restrictions from automatic UWP updates

Source facts

Microsoft documents separate controls for opening the Store app and for automatic UWP updates. Blocking the Store application does not stop Intune’s Store-app installation or automatic UWP updating when the automatic-update policy permits it. That Store-app restriction does not affect the winget command-line tool. UWP apps can keep updating after installation even without an Intune assignment. Microsoft Learn.

Applicability

Review this as a UWP Store policy decision, not a universal application-execution boundary. Record the exact effective Store settings and the managed apps whose update path must remain available.

DSE recommendation

State separately whether the goal is limiting user browsing, limiting app acquisition, or controlling execution. Preserve the automatic-update path required by the approved apps while testing the intended user-facing restriction. Have the endpoint security owner review other installation routes rather than treating one Store setting as comprehensive application control. Keep any additional restrictions under their own tested policy.

Verification

On a representative pilot, verify the intended Store user experience and an authorized Intune deployment. Observe an applicable UWP update and confirm the installed version afterward. Test relevant alternative acquisition paths separately and record their actual behavior. If the browsing restriction works but updates stop, reconcile the automatic-update policy before broadening the block. Retain both effective settings and workload results so acceptance covers maintenance as well as the visible Store interface.

Official references

Microsoft Learn: Add Microsoft Store Apps to Microsoft Intune.