Microsoft has finally given IT admins a supported, first‑party way to remove select preinstalled Microsoft Store apps from managed devices — a device‑level policy for Windows 11 Enterprise and Education (version 25H2) that replaces brittle removal scripts and complex imaging workflows with Group Policy or MDM controls. This change reduces operational overhead, improves image hygiene, and integrates app removal into standard provisioning and management pipelines — but it also requires careful piloting because the behavior is tied to provisioning flows and a small set of known caveats reported in early tests.
Windows 11, version 25H2 introduces a new app management policy named Remove default Microsoft Store packages from the system. The policy is available to Enterprise and Education SKUs and can be deployed through Microsoft Intune (Settings Catalog or CSP), or via Group Policy (ADMX). It targets a curated, pre‑defined list of in‑box Microsoft Store apps and operates at the device level rather than per user. Enforcement is automatic once enabled: Windows will run a cleanup task that deprovisions the selected packages and removes local app data from the device during provisioning events.
This capability answers a frequent operational pain point: scripted or image‑level removals that break whenever Microsoft changes package names, bundle names, or package versions. The new policy centralizes control, keeps your deployment artifacts simpler, and works with modern provisioning methods like Windows Autopilot without requiring custom imaging or fragile uninstall scripts.
Caveat: different 25H2 builds and downstream servicing may adjust package IDs or availability. Validate the package names and IDs in your management console (Intune or GPO) at the time of deployment to ensure they match what Microsoft exposes for your build. If you must target a package not listed in the UI, do not rely on unsupported scripting — work with supported channels and documentation.
Set the CSP OMA‑URI to:
Conclusion: Adopt the Remove Default Microsoft Store packages policy as part of a measured 25H2 rollout — prioritize inventory and pilot work, validate user‑facing cleanup, and coordinate with vendor partners. When applied with care, this capability eliminates years of brittle scripting and finally gives IT a supported, first‑party mechanism to de‑bloat enterprise‑facing Windows images.
Source: Microsoft - Message Center Policy-based removal of pre-installed Microsoft Store apps - Windows IT Pro Blog
Background
Windows 11, version 25H2 introduces a new app management policy named Remove default Microsoft Store packages from the system. The policy is available to Enterprise and Education SKUs and can be deployed through Microsoft Intune (Settings Catalog or CSP), or via Group Policy (ADMX). It targets a curated, pre‑defined list of in‑box Microsoft Store apps and operates at the device level rather than per user. Enforcement is automatic once enabled: Windows will run a cleanup task that deprovisions the selected packages and removes local app data from the device during provisioning events.This capability answers a frequent operational pain point: scripted or image‑level removals that break whenever Microsoft changes package names, bundle names, or package versions. The new policy centralizes control, keeps your deployment artifacts simpler, and works with modern provisioning methods like Windows Autopilot without requiring custom imaging or fragile uninstall scripts.
How the new policy works — technical overview
Key characteristics
- Scope: Device‑level (not per‑user) and targeted at Windows 11 Enterprise and Windows 11 Education devices running version 25H2 or later.
- Delivery: Deployable via Group Policy (ADMX) or MDM. Microsoft Intune supports it through the Settings Catalog and via a dedicated CSP OMA‑URI.
- Default state: Off by default — administrators must explicitly enable it.
- Enforcement triggers: The policy is applied and enforced during OOBE (out‑of‑box experience), when a user signs in after an OS upgrade, or when a user signs in after the policy itself is updated. This ensures the removal aligns with provisioning flows.
- Cleanup behavior: Once enabled, Windows runs an automated cleanup to deprovision selected packages and remove local app data. In practice, deprovisioning prevents the apps from being reprovisioned for new users; it also attempts to remove existing installations and local state.
Management interfaces and configuration surfaces
- Intune Settings Catalog: Administrative Templates → Windows Components → App Package Deployment → Remove default Microsoft Store packages from the system (set to Enabled). Toggle the listed apps to True to remove them.
- CSP OMA‑URI: ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RemoveDefaultMicrosoftStorePackages — an ADMX‑backed CSP that accepts an XML payload specifying which package IDs to remove (example XML entries follow below).
- Group Policy: Computer Configuration → Administrative Templates → Windows Components → App Package Deployment → Remove Default Microsoft Store packages from the system (Value: Enabled). The policy sets corresponding registry values under HKLM for devices that receive the setting.
Supported apps — what you can remove today
Microsoft shipped the policy to work against a curated list of inbox Microsoft Store packages. The list is intended to cover common consumer/out‑of‑box apps administrators often want removed on corporate devices. Examples of supported package families include (selection shown for clarity):- Calculator
- Camera
- Feedback Hub
- Microsoft 365 Copilot
- Clipchamp
- Microsoft Copilot (consumer version)
- Microsoft News
- Microsoft Photos
- Microsoft Solitaire Collection
- Microsoft Sticky Notes
- Microsoft Teams
- Microsoft To Do
- MSN Weather
- Notepad
- Outlook for Windows
- Paint
- Quick Assist
- Snipping Tool
- Sound Recorder
- Windows Media Player
- Windows Terminal
- Xbox Gaming App and related Xbox components (Identity Provider, Speech to Text Overlay, TCUI)
Caveat: different 25H2 builds and downstream servicing may adjust package IDs or availability. Validate the package names and IDs in your management console (Intune or GPO) at the time of deployment to ensure they match what Microsoft exposes for your build. If you must target a package not listed in the UI, do not rely on unsupported scripting — work with supported channels and documentation.
How to enable the policy — step‑by‑step
Below are practical instructions that mirror the supported Microsoft guidance for Intune and Group Policy deployments.Microsoft Intune (Settings Catalog)
- In the Microsoft Intune admin center, go to Devices → Manage devices → Configuration → Create → New policy.
- Choose the Settings catalog and add settings. Use the following path: Administrative Templates → Windows Components → App Package Deployment. Select Remove default Microsoft Store packages from the system and set the policy to Enabled.
- For each app listed under the policy, set the toggle to True for the packages you want to remove. Assign the policy to the appropriate device group(s).
- Monitor device status in Intune. Unsupported devices will show a status of Not applicable; compliant devices will report policy application results.
Microsoft Intune (CSP / Custom policy)
If you prefer a CSP XML payload, set the XML data items for the packages to remove. Example snippet:
Code:
<policy>
<data id="MicrosoftStickyNotes" value="true"/>
<data id="MicrosoftTeams" value="true"/>
<!-- Set other package IDs to "true" to remove them -->
</policy>
./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RemoveDefaultMicrosoftStorePackages and deliver the XML payload to the device. When the device processes the policy, it will set the configured packages to be removed.Group Policy (GPO)
- Open the Group Policy Management Console and create or edit a GPO targeted at your device OU(s).
- Navigate to: Computer Configuration → Administrative Templates → Windows Components → App Package Deployment.
- Double‑click Remove Default Microsoft Store packages from the system and set the policy to Enabled. Use the policy UI to select the apps you want removed.
- Apply the GPO. The policy writes values under
HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackages— you can verify the presence and values of these registry keys to confirm the policy is configured. Avoid applying both an Intune and a GPO removal policy to the same device to prevent conflicting settings.
Verification and operational signals
- Registry verification: After policy application, verify the configured values under
HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackages. Configured values indicate which packages are marked for removal. - Event logs: Microsoft documents Appx and deployment‑related event IDs that indicate successful deprovisioning/unprovisioning operations. Monitor Windows Event Logs for AppxDeployment events after policy application.
- Intune/GPO reporting: Intune will show a policy status for the targeted devices. Unsupported or non‑applicable devices will be flagged as such. GPO results can be checked via Group Policy Results / RSOP on individual machines.
Recommended rollout plan — pilot, monitor, and scale
The policy is powerful and low‑friction, but because it ties into provisioning flows it should be rolled out conservatively. A suggested pilot checklist:- Inventory and dependency mapping
- Search repositories and existing provisioning scripts for explicit references to the apps you plan to remove. Confirm no business processes depend on the packaged apps.
- Lab validation
- Create clean test images (25H2) and apply the removal policy using both Intune and GPO test deployments. Validate outcomes across OOBE, post‑upgrade sign‑in, and post‑policy update scenarios. Confirm both per‑device deprovisioning and user profile impacts.
- Small pilot ring (5–10% of fleet)
- Include a cross‑section of hardware, EDR/AV agents, backup agents and managed peripherals. Watch for unusual interactions, driver regressions, and provisioning artifacts.
- User‑facing validation
- Confirm the end‑user experience: Start menu, All apps, taskbar, and desktop shortcuts. Early community testing revealed occasional lingering Start menu shortcuts or dead entries after unprovisioning — plan scripts to clean these as part of early waves if needed.
- Telemetry and rollback planning
- Collect error events, crash dumps, and helpdesk tickets. Prepare rollback steps (clear the policy, re‑provision, and, if needed, reinstall apps via your app deployment process). Test rollback on pilot devices.
Real‑world caveats and the things that break
This policy reduces the need for bespoke scripts, but it’s not a magic bullet. Key caveats and operational impacts IT teams should weigh carefully:- Provisioning‑centric behavior: The policy is most effective when applied before or during provisioning (OOBE/first sign‑in). Applying it after multiple users have already signed into a device may not remove every trace from existing profiles; in practice, removal can prevent future reprovisioning more reliably than it cleans up all historical user data. Test on representative devices before enterprise wide deployment.
- UI artifacts: Community pilots have reported dead Start menu shortcuts and other UI remnants after deprovisioning. These artifacts require scriptable cleanup in some early flights — expect to include a cleanup pass in your early deployments until Microsoft ships additional polish.
- Package list changes across builds: Microsoft may update package IDs, bundle names, or the curated list in future releases. Relying on hard‑coded package names in scripts is brittle; use the policy UI or CSP and validate IDs at deployment time.
- Avoid policy conflicts: Do not apply duplicate or conflicting removal policies via both Intune and GPO to the same device. Choose a single management channel per device to avoid race conditions or conflicting registry values.
- Third‑party vendor compatibility: Some third‑party agents and installers may interact with in‑box apps or expect them to be present. Engage critical ISVs early in your pilot and include EDR/backup/endpoint vendors in your validation ring.
Related operational changes in 25H2 you must consider
Windows 11, version 25H2 includes other platform changes that intersect with this policy rollout and your broader automation estate:- PowerShell 2.0 removal: Windows 25H2 finalizes the removal of the legacy PowerShell v2 engine from shipping images. Scripts that explicitly invoke PowerShell v2 (for example, via
powershell.exe -Version 2) will fail unless migrated to PowerShell 5.1 or PowerShell 7+. Audit and remediate scripts and scheduled tasks prior to rolling out 25H2. - WMIC deprecation/removal: The
wmic.exeutility is being removed from shipping images. Replace WMIC usage with PowerShell CIM/WMI cmdlets such asGet‑CimInstanceor programmatic WMI APIs. These two changes are often the largest compatibility risk for automation pipelines.
Mitigations and remediation playbook
- Script scanning and remediation: Run automated searches across repos and image builders for
wmic,powershell -Version 2, and any hard‑coded Store package names. Convert WMIC calls toGet‑CimInstanceand test scripts under PowerShell 5.1 or PowerShell 7+. - Provisioning-first policy application: Apply the removal policy in Autopilot/ESP or during OOBE when possible to avoid inconsistencies between already provisioned user profiles and device‑level settings.
- Cleanup scripts for UI artifacts: Prepare short PowerShell helper scripts to remove dead Start menu shortcuts and stale All apps entries for early waves until Microsoft provides additional UX polish. Validate these scripts across user profiles and languages.
- Coordinate with ISVs: Share pilot details with critical ISV vendors (EDR, backup, VPN, management agents) and validate agent behavior on 25H2 images before a broad rollout.
- Use telemetry and logging: Monitor AppxDeployment events and Intune policy status; collect device event logs during pilot to catch edge cases quickly.
Strengths — why this change matters
- Reduces operational complexity: Removes the need for fragile, maintenance‑heavy scripts and custom imaging to produce clean enterprise images. The change lets IT use standard policy tooling to control provisioned inbox apps.
- Integrates with modern management: Works with Intune (Settings Catalog and CSP) and Group Policy, aligning app removal with existing device management workflows and reporting.
- Improves security posture indirectly: A cleaner image reduces attack surface by limiting unnecessary apps and associated auto‑update surfaces, and aligns with Microsoft’s broader effort to remove legacy binaries such as PSv2 and WMIC.
- Low friction for 24H2 → 25H2 devices: Because 25H2 is delivered as an enablement package for devices on the 24H2 servicing branch, the binary footprint is small and activation typically requires a single restart; this reduces rollout friction for organizations current on updates.
Risks and open questions
- Residual UI artifacts: Early community testing shows Start menu shortcuts and other artifacts may persist after deprovisioning; expect to address these with supplementary cleanup until Microsoft provides additional fixes. This is a practical risk for user experience during early waves.
- Partial cleanup for existing profiles: The policy is strongest when applied before or during provisioning. On devices with many existing users, the policy might not fully clean historical profile data — expect manual or scripted remediation for such devices.
- Evolving package IDs: If Microsoft changes package identifiers in future cumulative updates, any assumptions baked into scripts or third‑party tools will break. Use the official policy UI or CSP and avoid hard‑coding names.
- Third‑party interactions: Some third‑party agents or workflows may implicitly rely on preinstalled apps or components. Validate vendor compatibility early in the pilot phase.
- Unverifiable marketing claims: Microsoft’s messaging that built‑in Store apps “now come updated out‑of‑the‑box” addresses a historical pain point where inbox apps arrived stale. This claim is plausible and reflected in guidance, but organizations should still validate actual app versions on their images and during provisioning — treat the marketing claim as an operational improvement to confirm rather than assume. Flagged for validation during pilot.
Practical example: Minimal Intune settings recap
- Policy path: Administrative Templates → Windows Components → App Package Deployment → Remove default Microsoft Store packages from the system (Enabled).
- CSP OMA‑URI:
./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RemoveDefaultMicrosoftStorePackages. Use ADMX‑backed XML payload entries such as<data id="MicrosoftStickyNotes" value="true"/>to indicate packages to remove. - Verification: Check
HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackagesand AppxDeployment event logs on a target device.
Bottom line
The new policy to remove default Microsoft Store packages on Windows 11 Enterprise and Education (25H2) is a welcome, practical addition to the IT admin toolbox. It turns a historically messy, script‑heavy task into a manageable policy setting that integrates with Intune and Group Policy, reduces long‑term maintenance, and supports cleaner provisioning workflows. That said, this is a provisioning‑centric tool with some early UX rough edges — plan a careful pilot, validate with your ISVs, and prepare short remediation scripts for UI artifacts. Properly piloted and applied, this policy will simplify image hygiene and lower operational overhead for managed Windows fleets.Conclusion: Adopt the Remove Default Microsoft Store packages policy as part of a measured 25H2 rollout — prioritize inventory and pilot work, validate user‑facing cleanup, and coordinate with vendor partners. When applied with care, this capability eliminates years of brittle scripting and finally gives IT a supported, first‑party mechanism to de‑bloat enterprise‑facing Windows images.
Source: Microsoft - Message Center Policy-based removal of pre-installed Microsoft Store apps - Windows IT Pro Blog

