How to update Windows App Store apps in enterprise environment

In an enterprise environment where Microsoft Store access is blocked, app lifecycle (update/remove/reinstall) is handled via policy and management tools instead of the Store UI.

1. Control Store-based updates via Group Policy

If Store is blocked but some devices still have it installed, ensure Store-driven updates are configured as desired:

• Use the Turn off Automatic Download and Install of updates policy:
  • Path: Computer Configuration > Administrative Templates > Windows Components > Store
  • Effect:
    • Enabled → automatic download/installation of Store app updates is turned off.
    • Disabled → automatic download/installation of Store app updates is turned on.
• Use the Turn off Store application policy:
  • Path: Computer Configuration > Administrative Templates > Windows Components > Store or User Configuration > Administrative Templates > Windows Components > Store
  • If enabled in the computer context, access to Store is denied and app updates via Store are turned off.

These policies let IT control whether Store is used at all for app updates. If Store is fully blocked, rely on management tools (Intune, ConfigMgr, provisioning, etc.) to deploy and update apps.

2. Policy-based removal of pre-installed Microsoft Store apps

For Windows 11 Enterprise/Education (25H2 and later), use the Policy-Based Removal of Pre-installed Microsoft Store Apps feature to remove built-in Store apps at the device level without using the Store:

• Enable the removal policy:
  • Group Policy: enable Remove Default Microsoft Store apps under:
    • Computer Configuration > Administrative Templates > Windows Components > App Package Deployment.
  • Or via MDM/Intune using the Remove Default Microsoft Store packages CSP (custom OMA-URI policy).
• Select apps for removal:
  • GP: in Remove Default Microsoft Store apps, select the apps to remove from the predefined list, then log off/log on.
  • CSP/Intune: set the selected apps’ values to true in the custom CSP policy, then log off/log on.
• Verify removal:
  • On the device, confirm the selected apps are no longer installed.
  • Or check Event Viewer → Applications and Service Logs > Microsoft > Windows > AppxDeployment-Server > Microsoft-Windows-AppxDeploymentServer/Operational for Event ID 762 (“RemoveDefaultPackages uninstall override policy successfully removed package”).

This approach removes pre-installed Store apps without requiring Store access and is fully policy-driven.

3. Reinstalling apps removed by policy

If an app was removed via the Remove Default Microsoft Store packages policy and later needs to be allowed again:

• Update the removal policy:
  • Intune: go to Devices > Manage devices > Configuration > Policies, open the removal policy, and set the app’s removal flag to False, then trigger a device sync.
  • CSP: in the custom OMA-URI XML, set the app’s value to false, then sync.
  • GPO: go to Computer configuration > Administrative templates > Windows components > App package deployment > Remove default Microsoft Store packages from the system, deselect the app, then run gpupdate /force.
• Reprovision/reinstall the app:
  • Reinstall via Microsoft Store (if allowed on that device), or
  • Deploy via ISO, Intune Win32 app, provisioning package, or other management tools.

Note: For the policy-based in-box app removal feature, simply deselecting the app in policy does not automatically reinstall it; reprovisioning or redeployment is required.

4. Updating Store apps without Store UI

When Store is blocked, updates for Store-origin apps must come from management tools or alternative packages:

• Use Intune or other MDM to deploy updated MSIX/AppX packages.
• For apps installed via Store package through Intune, automatic updates can still apply if configured, even without user access to the Store UI.
• If Store is removed or blocked via policy, ensure a separate update mechanism (Intune, ConfigMgr, provisioning packages, or ISO-based reprovisioning) is used for those apps.

5. Verifying policy-based removal on clients

To confirm the policy-based removal feature is active and applied:

• Registry: check for keys under:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackages
• PowerShell: run before and after sign-in to see which apps remain:

    Get-AppxPackage -AllUsers | Select Name, IsPartOfSystem
  

This helps validate that targeted pre-installed apps are removed and that only permitted apps remain.

References:

• Group Policy and packaged apps
• Policy-Based Removal of Pre-installed Microsoft Store Apps
• Policy-based in-box app removal
• Find, install, and uninstall applications from the Microsoft Store