Microsoft has significantly upgraded its Windows 11 in-box app removal policy, now giving IT administrators the power to dynamically remove any preinstalled MSIX/APPX application using Group Policy or MDM, with no custom imaging or complex scripts required.
In a major enterprise management update announced on April 29, 2026, Microsoft expanded the RemoveDefaultMicrosoftStorePackages policy, first introduced in October 2025, to include a dynamic app removal list that empowers IT admins to identify and uninstall any preinstalled Microsoft Store app simply by referencing its Package Family Name (PFN).
This update marks a pivotal shift in how enterprise IT teams manage Windows 11 bloatware at scale, replacing legacy workarounds with a streamlined, policy-driven methodology.
Previously, the RemoveDefaultMicrosoftStorePackages policy only allowed admins to choose from a fixed list of preinstalled Microsoft Store apps and was exclusively available on devices running Windows 11 version 25H2 or later.
With this update, Microsoft has expanded both the scope and compatibility of the policy in two critical ways:
- Dynamic removal capability: Admins can now remove any preinstalled MSIX/APPX app, not just those on the predefined list, by specifying the app’s Package Family Name (PFN).
- Extended OS compatibility: The updated policy now supports Windows 11 version 24H2 Enterprise and Education editions, removing the previous requirement to upgrade to 25H2.
“If your organization has standardized on the 2024 release, you can benefit from policy-driven app management without a full OS version upgrade,” Microsoft noted in its official IT Pro blog post.
The result for enterprise environments: fewer unwanted apps, simpler device provisioning, and a more tailored desktop experience, all enforced through standard policy infrastructure.
Prerequisites and Supported Configurations
To leverage this new capability, administrators must meet the following requirements:
- OS Version: Devices must run Windows 11 version 25H2 or version 24H2 (with at least the April 2026 Windows non-security update installed)
- Editions Supported: Only Enterprise and Education editions are supported; Home and Pro editions are excluded
- Management Platform: Compatible with Group Policy (GPO) or any MDM solution, including Microsoft Intune via custom OMA-URI
- Windows Insiders: Available after installing the March 13, 2026, builds in the Dev and Beta channels
The policy is turned off by default and must be explicitly enabled by the administrator. Once activated, enforcement occurs automatically, a cleanup task deprovisions removed packages, and local app data is deleted from the user’s device.
IT administrators can configure the dynamic removal list through the Local Group Policy Editor or across Active Directory-joined devices using the following steps:
- Find the app’s Package Family Name (PFN) using PowerShell. Replace “Notepad” with your target app name:powershell
Get-AppxPackage *Notepad* | Select-Object PackageFamilyName - Open Group Policy Editor (
gpedit.msc) and navigate to:Computer Configuration > Administrative Templates > Windows Components > App Package Deployment - Select the policy: Remove default Microsoft Store packages from the system
- Add the PFN to the multi-text field under Specify additional package family names to remove, enter one PFN per line
For organizations using MDM/Intune, the policy can be deployed via a custom OMA-URI configuration pointing to:./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RemoveDefaultMicrosoftStorePackages
Microsoft has confirmed that the dynamic list option will be natively available in the Intune Settings Catalog in the coming months. Until then, administrators are advised to use the custom OMA-URI workaround.
Under the hood, Windows enforces this policy by reading package family names from the registry key:
HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackages
When a PFN subkey is found and the policy is enabled, Windows calls the CleanupPackageFromPerMachineStore function, which copies registry data to a “deleted” subtree, removes provisioning information, and moves app files to a DeletedAllUserPackages folder.
Notably, any PFN added to this registry path, even if not on the official GPO list, will be flagged for removal, offering additional flexibility to experienced administrators.
Copilot Removal Policy Also Now Available
Alongside the expanded app removal framework, Microsoft announced in late April 2026 that IT admins can now also uninstall the AI-powered Microsoft Copilot app from enterprise devices using the new RemoveMicrosoftCopilotApp policy.
This setting became broadly available after the April 2026 Patch Tuesday cumulative updates and is configurable via Group Policy (User Configuration > Administrative Templates > Windows AI > Remove Microsoft Copilot App) or through Intune and SCCM.
The policy applies only when three conditions are met: Microsoft 365 Copilot is also installed on the device, the Copilot app was not user-installed, and the app has not been launched in the past 28 days. It supports Enterprise, Professional, and Education SKUs on Windows 11 25H2 devices. Users can still reinstall the Copilot app manually if desired.
FAQ
Q1: Which Windows 11 editions support the RemoveDefaultMicrosoftStorePackages policy?
Only Enterprise and Education editions of Windows 11 versions 24H2 and 25H2 are supported after installing the April 2026 non-security update.
Q2: Can IT admins remove apps not on the official predefined list?
Yes, by adding any app’s Package Family Name (PFN) directly to the GPO’s multi-text field or the registry key, admins can remove any preinstalled MSIX/APPX app.
Q3: When will the dynamic list option be available natively in Microsoft Intune?
Microsoft has confirmed native Intune Settings Catalog support is coming in the next few months; until then, use a custom OMA-URI as a workaround.
Q4: What update is required to enable the new Copilot removal policy?
Admins must deploy the April 2026 Patch Tuesday cumulative update to access the RemoveMicrosoftCopilotApp policy on Windows 11 25H2 Enterprise, Pro, and Education devices.
Site: thecybrdef.com
For more insights and updates, follow us on Google News, Twitter, and LinkedIn.
About the Author
