Blocking app instals from apps.microsoft.com

[Reth]

We've recently discovered pupils are able to install Microsoft store apps by going to apps.microsoft.com. We have the store itself blocked but it seems like a update in late April changed how apps from the web store are packaged and downloaded and this bypasses any store blocks that are in place.

 

Has anyone else ran into this or have an idea of something we could change to prevent them from downloading these apps?

[6Foot2]

Have you tried changing your DNS pointer record for apps.microsoft.com to one that is not valid? (e.g.: 0.0.0.0 or 127.0.0.1)

[mavhc]

Disable the store with GPO?

[georgeescott]

Just tested on a Windows 11 PC. Store is restricted to 'private' via GPO/Intune Policy.

It seems not all apps on apps.microsoft.com are available to download directly.

 

E.g. trying with Adobe Acrobat Reader DC you only have an 'Install' button, but with WhatsApp, you can 'Download' or 'View in Store'.

 

If you 'Install' or 'View in Store', it opens the Microsoft Store app and is blocked. If you 'Download', it launches a download from "blob:https://apps.microsoft.com".

 

The .exe's are digitally signed by 'Microsoft Corporation' as 'Store Installer'. You might be able to use AppLocker to block these. Assuming it doesn't then break the store/updates.

 

Not sure if blocking apps.microsoft.com would also then break app deployments either.

 

A bit annoying that blocking the store doesn't also block these though.

[sigma]

Just tested on a Windows 11 PC. Store is restricted to 'private' via GPO/Intune Policy.

It seems not all apps on apps.microsoft.com are available to download directly.

 

E.g. trying with Adobe Acrobat Reader DC you only have an 'Install' button, but with WhatsApp, you can 'Download' or 'View in Store'.

 

If you 'Install' or 'View in Store', it opens the Microsoft Store app and is blocked. If you 'Download', it launches a download from "blob:https://apps.microsoft.com".

 

The .exe's are digitally signed by 'Microsoft Corporation' as 'Store Installer'. You might be able to use AppLocker to block these. Assuming it doesn't then break the store/updates.

 

Not sure if blocking apps.microsoft.com would also then break app deployments either.

 

A bit annoying that blocking the store doesn't also block these though.

 

That’s going to be a Safeguarding issue for many apps for particular age groups - under 13’s and under 16’s depending.

[NicholasEsping]

Try blocking the ms-appinstaller protocol. I do this with Intune but you should be able to with GPO.

[mavhc]

That’s going to be a Safeguarding issue for many apps for particular age groups - under 13’s and under 16’s depending.

 

Why would that be?

[sigma]

Why would that be?

 

Age inappropriate apps mainly.

[mavhc]

But why can they run exe files?

[psydii]

But why can they run exe files?

Microsoft *signed* exe files. Because sometimes we take shortcuts because it's better than not doing anything.

 

Slapping an applocker deny rule using the rule suggested by @GeorgeScott seems like the quickest win to get this absolutely daft problem closed off.

 

I really can't understand why Microsoft is working against the administrators who are the last bastion of their dwindling advocates. Though just writing that out does lead one to a potential conclusion, and if that's true I'm hoping that in 15-20 years time knowing how to admin a Windows 2000 era AD and GPOs will become like having COBOL skills is today.

[sigma]

Microsoft *signed* exe files. Because sometimes we take shortcuts because it's better than not doing anything.

 

Slapping an applocker deny rule using the rule suggested by @GeorgeScott seems like the quickest win to get this absolutely daft problem closed off.

 

I really can't understand why Microsoft is working against the administrators who are the last bastion of their dwindling advocates. Though just writing that out does lead one to a potential conclusion, and if that's true I'm hoping that in 15-20 years time knowing how to admin a Windows 2000 era AD and GPOs will become like having COBOL skills is today.

 

Em. I can still write IBM COBOL and JCL, it was my day job in the early 1980’s…back in the days of paper coding sheets and punched cards.

[Norphy]

Em. I can still write IBM COBOL and JCL, it was my day job in the early 1980’s…back in the days of paper coding sheets and punched cards.

 

Ok, but how much of that skill set do you now use in your day to day working life? I think that is the point that Psydii is going for here. COBOL still has its place, but for most people it’s legacy. Psydii is saying he’s looking forward to the day that AD administration is the same. Possibly Netware may have been a better thing to compare it to

[sigma]

Not the specific coding obviously, but the analysis skills from those days - all the time. I've never stopped.

 

Things change and move on, they go round in cycles, I've been round enough times. Nothing ever quite fully works, that's what's kept me employed all these years.

Edited May 31, 2024 by sigma

[ITGuyNW]

Just come across this... absolutely bewildering.

[Olliedawg]

Interesting, i'm going to give this a test. We block .exe, .msi etc with applocker & also block the store via GPO.

 

Edit : No work around with our setup, it just says the store is blocked & they can't run the .exe files

Edited May 15, 2025 by Olliedawg

[ITguywhoneedshelp]

How did you set this up? We have intune devices and would GPO apply in this case?

 

Could you please guide me on how to do this, I'm having trouble setting this up.

 

Thank you.

 

 

[ITguywhoneedshelp]

On 15/05/2025 at 22:18, Olliedawg said:

Interesting, i'm going to give this a test. We block .exe, .msi etc with applocker & also block the store via GPO.

 

Edit : No work around with our setup, it just says the store is blocked & they can't run the .exe files

Can you please let me know how you did this?

[Olliedawg]

3 hours ago, ITguywhoneedshelp said:

Can you please let me know how you did this?

 

We don't use Intune so I can't help with that side of things, we're all local domain still here. GPO will only apply if you still have a local domain, and your devices are hybrid joined?

 

We use AppLocker to block all non Microsoft signed software by default, and create rules to allow specific things where required.

 

 

[ckedu-local]

On 04/07/2025 at 01:56, ITguywhoneedshelp said:

How did you set this up? We have intune devices and would GPO apply in this case?

 

Could you please guide me on how to do this, I'm having trouble setting this up.

 

Thank you.

 

 

 

You can use App Control for Business in Intune, it's similar to AppLocker.

This link should help you get it setup - I would advise that you deploy it to blocks of PCs instead of all at once to avoid any issues!

 

Manage approved apps for Windows devices with App Control for Business policy and Managed Installers in Microsoft Intune | Microsoft Learn

[ITguywhoneedshelp]

3 hours ago, ckedu-local said:

 

You can use App Control for Business in Intune, it's similar to AppLocker.

This link should help you get it setup - I would advise that you deploy it to blocks of PCs instead of all at once to avoid any issues!

 

Manage approved apps for Windows devices with App Control for Business policy and Managed Installers in Microsoft Intune | Microsoft Learn

Thanks but just making sure you mean WDAC right? or is that a different thing?

[NicholasEsping]

On 29/07/2025 at 18:44, ITguywhoneedshelp said:

Thanks but just making sure you mean WDAC right? or is that a different thing?

App Control for Business is WDAC. We use WDAC but not the App Control for Business method since that did not exist when we implemented it. We use OMA-URI to deploy our WDAC policy and then use proactive remediation scripts to deploy the managed installer options in AppLocker. This allows us to easily add additional managed installers as necessary.

[ITguywhoneedshelp]

 

3 hours ago, NicholasEsping said:

App Control for Business is WDAC. We use WDAC but not the App Control for Business method since that did not exist when we implemented it. We use OMA-URI to deploy our WDAC policy and then use proactive remediation scripts to deploy the managed installer options in AppLocker. This allows us to easily add additional managed installers as necessary.

I just wanted to say thank you so much for your help with this! Intune can be confusing. Would you recommend any good videos on how to get this setup? I'm watching the video below and I hope that should be enough.

Thank you!

 

[NicholasEsping]

On 31/07/2025 at 18:26, ITguywhoneedshelp said:

 

I just wanted to say thank you so much for your help with this! Intune can be confusing. Would you recommend any good videos on how to get this setup? I'm watching the video below and I hope that should be enough.

Thank you!

 

I am not aware of any videos that would be helpful. I mostly just use Microsoft's documentation.

Application Control for Windows | Microsoft Learn