Windows 11: 22H2 · 1.0 to 24H2 · 1.0

This policy controls the auto[removed: ][added: -]update interval for package-based sources.[added: The default source for Windows Package Manager is configured such that an index of the packages is cached on the local machine. The index is downloaded when a user invokes a command, and the interval has passed.] If you disable or do not configure this setting, the default interval or the value specified in [removed: settings will be used by the Windows Package Manager.][added: the Windows Package Manager settings will be used.] If you enable this setting, the number of minutes specified will be used by the Windows Package Manager.

When this policy is enabled, devices will receive Windows updates for the classes listed from the specified update source: either Windows Update or Windows Server Update Service.[removed: ] Note: To receive any updates from the Windows Server Update Service you must have properly configured an intranet Microsoft update service location via the “Specify intranet Microsoft update service location” policy. If this policy is not configured or is disabled, the device will continue to detect updates per your other policy configurations.[removed: ] Note: If you are using “Do not allow deferral policies to cause scans against Windows Update” currently to ensure devices only scan against your specified server, we recommend configuring this policy instead or in addition to such.

This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect.[added: Note: Application Virtualization (App-V) will reach end-of-life April 2026. After that time, the App-V client will be excluded from new versions of the Windows operating system. See aka.ms/AppVDeprecation for more information.]

This policy setting allows you to manage the deployment of [removed: Windows][added: packaged Microsoft] Store apps when the user is signed in using a special profile. Special profiles are the following user profiles, where changes are discarded after the user signs off: Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies Mandatory user profiles and super-mandatory profiles, which are created by an administrator Temporary user profiles, which are created when an error prevents the correct profile from loading User profiles for the Guest account and members of the Guests group If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of [removed: Windows][added: packaged Microsoft] Store apps when using a special profile. If you disable or do not configure this policy setting, Group Policy blocks deployment operations of [removed: Windows][added: packaged Microsoft] Store apps when using a special profile.

This policy setting allows you to manage the installation of trusted line-of-business (LOB) or developer-signed [removed: Windows][added: packaged Microsoft] Store apps. If you enable this policy setting, you can install any LOB or developer-signed [removed: Windows][added: packaged Microsoft] Store app (which must be signed with a certificate chain that can be successfully validated by the local computer). If you disable or do not configure this policy setting, you cannot install LOB or developer-signed [removed: Windows][added: packaged Microsoft] Store apps.

Manages a sideloaded apps' ability to auto-update in the background.[removed: ] If you enable this policy, sideloaded apps will not auto-update in the background. If you disable this policy, sideloaded apps will auto-update in the background. Default is 'disabled' (key not present).

Manages a sideloaded apps' ability to auto-update in the background on a metered network.[removed: ] If you enable this policy, sideloaded apps will not auto-update in the background on a metered network. If you disable this policy, sideloaded apps will auto-update in the background on a metered network. Default is 'disabled' (key not present).

This policy setting lets you control whether [removed: Windows][added: packaged Microsoft] Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than [removed: Windows][added: packaged Microsoft] Store apps, there is a risk that a [removed: Windows][added: packaged Microsoft] Store app might compromise the system by opening a file in the default desktop app for a file type. If you enable this policy setting, [removed: Windows][added: packaged Microsoft] Store apps cannot open files in the default desktop app for a file type; they can open files only in other [removed: Windows][added: packaged Microsoft] Store apps. If you disable or do not configure this policy setting, [removed: Windows][added: packaged Microsoft] Store apps can open files in the default desktop app for a file type.

This policy setting lets you control whether [removed: Windows][added: packaged Microsoft] Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than [removed: Windows][added: packaged Microsoft] Store apps, there is a risk that a URI scheme launched by a [removed: Windows][added: packaged Microsoft] Store app might compromise the system by launching a desktop app. If you enable this policy setting, [removed: Windows][added: packaged Microsoft] Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other [removed: Windows][added: packaged Microsoft] Store apps. If you disable or do not configure this policy setting, [removed: Windows][added: packaged Microsoft] Store apps can open URIs in the default desktop app for a URI scheme. Note: Enabling this policy setting does not block [removed: Windows][added: packaged Microsoft] Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.

This policy setting lets you control whether Microsoft accounts are optional for [removed: Windows][added: packaged Microsoft] Store apps that require an account to sign in. This policy only affects [removed: Windows][added: packaged Microsoft] Store apps that support it. If you enable this policy setting, [removed: Windows][added: packaged Microsoft] Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead. If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account.