CybersecurityInfrastructure

Microsoft Enhances App Removal Policy for Windows 11 Enterprises

Analyst 207||Source: BleepingComputer
Diverse IT team gathered around a monitor in a corporate office setting.

"IT admins, you can now simplify Microsoft Store app management with dynamic removal on more devices across your enterprise. Use policy to remove any preinstalled MSIX/APPX app by referencing its Package Family Name (PFN)," Microsoft said on Thursday.

What the updated RemoveDefaultMicrosoftStorePackages policy does

Microsoft has expanded a Windows 11 in-box app removal policy introduced in October to include a dynamic list that lets IT administrators choose which preinstalled Microsoft Store apps to uninstall. The updated RemoveDefaultMicrosoftStorePackages policy enables admins to remove any preinstalled MSIX/APPX app by referencing its Package Family Name (PFN). Administrators may apply the policy using Group Policy Object (GPO) or a custom OMA-URI for mobile device management (MDM).

How to apply the policy using Group Policy

Microsoft published step-by-step guidance for using the Group Policy Editor. The source provides this example sequence:

  • Locate the app's PFN with PowerShell, for example: Get-AppxPackage *Notepad* | Select-Object PackageFamilyName.
  • Open Group Policy Editor (gpedit.msc) and navigate to Computer Configuration > Administrative Templates > Windows Components > App Package Deployment.
  • Select Remove default Microsoft Store packages from the system, then add PFNs to the multi-text list under Specify additional package family names to remove. Enter one package family name per line.

Microsoft also notes there is guidance for applying the policy to a single device via the Local Group Policy Editor or to multiple Active Directory–joined devices.

Availability: updates, channels, and edition support

To use the dynamic removal feature, devices must have at least the April 2026 Windows non-security update deployed. Windows Insiders can access the capability after installing the March 13, 2026, builds in the Dev and Beta channels. Microsoft has also extended support for the RemoveDefaultMicrosoftStorePackages policy to systems running Enterprise and Education editions of Windows 11 24H2. The policy was introduced in October 2025 but was previously available only on devices running Windows 11, version 25H2 or later. Microsoft said organizations standardized on the 2024 release can now benefit from policy-driven app management without a full OS version upgrade.

Intune, MDM, and the coming change to the Intune settings picker

At present, Microsoft says the Intune entry for this policy does not include the dynamic list option. The company expects the capability to appear in Intune in the coming months. "When this feature becomes generally available in Intune, search for 'Remove Default Microsoft Store packages' in the settings picker to locate it," Microsoft noted. For environments using MDM today, administrators can use a custom OMA-URI as an interim path to apply PFN-based removals.

How enterprise admins, Windows 11 24H2 customers, and Intune teams should respond

  • Enterprise administrators: If you manage Active Directory–joined fleets, the Group Policy path gives an immediate method to remove preinstalled MSIX/APPX apps by PFN once devices have the April 2026 non-security update; use the PowerShell command Microsoft published to discover PFNs.
  • Windows 11 24H2 Enterprise and Education customers: Organizations that standardized on the 2024 release can implement policy-driven removals without upgrading to 25H2, provided devices receive the required April 2026 update.
  • Intune and MDM teams: Plan for a forthcoming Intune settings-picker entry; until then, consider OMA-URI deployment for vehicles that require remote management and removal of specific preinstalled Store apps.

Separately, Microsoft earlier this month added a related enterprise control: after installing the April 2026 Patch Tuesday cumulative updates, IT admins can uninstall the AI-powered Copilot digital assistant from enterprise devices using the new RemoveMicrosoftCopilotApp policy setting.

Microsoft's change centralizes choice for administrators: instead of accepting a fixed set of in-box apps, organizations can now specify the exact package family names to remove. The next practical question for many IT teams will be timing—coordinating the April 2026 update rollouts, testing PFN removals in pilot groups, and monitoring for the promised Intune picker update in the months ahead.

Original story

Endpoint ManagementEnterprise SecurityWindows 11App ManagementMicrosoft StorePackage Family NameGroup Policy ObjectOMA-URI
Related Intelligence

Continue Reading

Close-up of a smartphone's circuit board with blurred background, components out of focus.

BootROM Exploit Targets Millions of iPhones

Millions of iPhones are vulnerable to a newly discovered BootROM exploit, known as "usbliter8", that can't be fixed with software updates because it's embedded in the device's hardware. This means iPhones with A12 and A13 processors will be at risk for the rest of their lifespan.

Analyst 207
Blurred laptop screen on office table surrounded by coworkers.

AI Agents Emerge as Unchecked Identities in Enterprise Security

The equation for enterprise security is no longer simple: with AI agents now connected to critical business services, controlling identities is no longer enough to control risk. These emerging insiders have quietly become privileged - and potentially invisible - attack paths that security and identity programs must urgently address.

Analyst 207
Security analysts work at computer workstations and a large wall screen in a brightly-lit operations center.

AI Shifts Threat Management from Reactive to Proactive Stance

With a sprawling security stack of 40+ tools, enterprise teams are drowning in overlapping alerts and manual handoffs, leaving gaping holes for adversaries to exploit. This disjointed approach leaves teams scrambling to respond to threats, with attackers enjoying a lengthy 43-day window to wreak havoc.

Analyst 207
Windows desktop with Recycle Bin open, showing a file and a confirmation dialog with a partially obscured filename.

Microsoft Updates Trigger Recycle Bin Filename Glitch

Microsoft just revealed a frustrating glitch in the Recycle Bin that displays a confusing filename when you permanently delete an item, showing a cryptic code instead of the file's original name. Luckily, the issue only affects the deletion confirmation dialog and doesn't change the file's name in the Recycle Bin or when it's restored.

Analyst 207