Intune: Microsoft Store app (new) and built-in apps - Not super obvious!

-
Back in the day when Windows 10 OS was launched, it came with a lot of built-in apps that most enterprise customers didn't want to offer to their end users. This obviously created an additional task for the administrators to find a way to remove such apps during the build process. The method of choice was using a PowerShell script to remove the apps which you could simply put in a imaging process and work away. When the management of the devices moved to the modern solutions like Intune, so did this removal process. Nothing much changed in this aspect, other than how they were setup in the Intune admin portal. I personally used this method for a long time, even when the OS moved to Windows 11, but then eventually dropped the method in favor of using the Microsoft Store app type, built into Intune. I would just import the store app, create an uninstall assignment and be done with it. It was simple and elegant. Then Microsoft replaced it with the new store experience and segregated the two store app types between Microsoft Store app (Legacy) and Microsoft Store app (New) with the intention of improving the overall admin experience for managing the apps. The only problem then and still to date, is that, not all apps are visible in the new store. However, one can still add some of the apps for management (mostly uninstallation), but the method isn't not super obvious. Therefore, I decided to write a quick blog on it.

I am using Mail and Calendar as an example here. As of writing this blog, if you search for it in new store, it doesn't show up.


This is true for some other apps as well. However, in some cases, you can just use the app id to search and if you are in luck, they may show up. Not so obvious now, is it? :-)



How can you find the app id? Well, the simplest way is to look it up in the store and grab it from there.


Assign it normally for uninstallation and that's it. The app should uninstall and report the same in Intune.


Until next time..

Comments

Post a Comment

Popular posts from this blog

How to force escrowing of BitLocker recovery keys using Intune

-
Image
Every now and then it so happens that BitLocker recovery keys do not escrow in AAD. The usual culprits are incorrect BitLocker policies and\or the device hardware configuration failing to meet the minimum requirements. The other scenario and something I recently experienced is when everything is setup right and still the recovery key doesn’t escrow in AAD. As I understand, this can happen if the escrow process got interrupted the first time due to network or local devices related issues and the process could not resume. To circumvent this issue, one can simply push a PowerShell script to the devices to force the escrow of the recovery keys to AAD. Here is a script to do so. try{ $BitlockerVol = Get-BitLockerVolume -MountPoint $env:SystemDrive         $KPID=""         foreach($KP in $BitlockerVol.KeyProtector){             if($KP.KeyProtectorType -eq "RecoveryPassword"){              ...
Read more

Prevent users from running certain programs or applications on Windows endpoints using Intune

-
Image
  When it comes to blocking or preventing users from running an application on Windows devices, one normally uses App locker policy, Windows Defender Application Control and not so new but pretty useful method called Defender Vulnerability management within Microsoft 365 Defender Portal. A recent question on the Tech Community Microsoft forum prompted me to look for all possible alternatives. I started reminiscing over the legacy GPO policies and that is when I stumbled upon the policy  Don’t run specified Windows applications  located under User Administrative Templates - The policy setting does come with its own caveat - " This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from st...
Read more

Intune: Configure Printers for Non-Administrative Users

-
Image
Configuring printers for end users or giving them the ability to do it themselves is a normal requirement for organizations. Now if your users are Administrators, then the configuration can be straight forward, but in case of Non-Administrators there are additional steps required as Non-Administrators will not be able to add a driver in the driver store despite being able to install a printer. In this blog, I will cover the steps that I took to address this requirement using Intune. The setup involves 2 steps -  1. Setup registries. 2. Install the driver and configure the printer Setting up registries – The registries that need to be configured are actually part of a GPO setting – Allow non-administrators to install drivers for these device setup classes It can be found under: Computer Configuration -> Policies -> Administrative Templates -> System -> Driver Installation I used a Powershell script to set the values and wrapped it in a Win32 application. $P...
Read more