Microsoft Store app is blocked in my tenant, but not in another tenant, both use Win 11 Business

[incedIT]

Both tenants are based on OIB 4.0, there are some customisations but nothing affecting Store app, both are on Win 11 Business.

In my tenant, I can run the Store app, it opens the window but says "Microsoft Store is blocked". On other tenants, I can open the Store and it loads ok, user can try to install apps, my Applocker policy blocks the install.

It seems only my tenant blocks the app, I have done a lot of searching but can't find where this is happening. I have exported the SETTINGSOUTPUT from two tenants and compared, can't find anything there. It's not an Applocker block as the Store window opens for me. Can't see anything in Conditional Access causing it.

Does anyone have any ideas? Ideally, I would block it in all tenants like mine. Both use M365 Bus Prem, I have some bolt-on licences such as defender for endpoint p2, entra ID 2 and E5 security but can't see any of these allow the setting Win - OIB - SC - Microsoft Store - U - Configuration - v3.3 "Turn off the Store application" which is blocked on Pro/Business Windows SKU.

[aappuupatell]

The setting behind that OIB profile — Turn off the Store application (ADMX_WindowsStore/RemoveWindowsStore_1/_2) — is documented by Microsoft as ❌ Pro / ✅ Enterprise / ✅ Education, and the Store configuration doc says it outright: "The CSP configuration is available to Windows Enterprise and Education editions only." Only display the private store (RequirePrivateStoreOnly) has the same gate. "Windows 11 Business" is the Pro SKU, so on a genuine Business/Pro device the policy is silently ignored — that's what your other tenants are showing you. A SETTINGSOUTPUT diff can't find it because the policies are identical; the difference is on the devices.

So the first check in the tenant where it does block is the edition the devices actually run: Intune → Devices → (device) → Hardware → Operating system edition, or on the box DISM /Online /Get-CurrentEdition. I'd put money on Enterprise. Subscription activation steps Pro up to Enterprise automatically for any user holding a Windows Enterprise E3/E5 licence (including the one inside Microsoft 365 E3/E5/F3) — a trial that was once in the tenant is enough, and devices stay stepped up until the licence has been gone for up to 90 days — or the machines were imaged from Enterprise media. If they really do come back as Pro, then look on a blocked device for the value itself (HKLM/HKCU → SOFTWARE\Policies\Microsoft\WindowsStore → RemoveWindowsStore / RequirePrivateStoreOnly) and in MDM Diagnostics, because something other than the OIB profile would have to be writing it.

For "apply it everywhere": there is no policy that blocks the Store UI on Pro/Business — it's a licensing gate, not a configuration one. Your options are (a) licence Windows Enterprise (M365 E3/E5 or the Windows Enterprise E3 add-on) so the OIB setting applies as-is, or (b) block the Store app package with what you already run: an AppLocker Packaged app deny rule for Microsoft.WindowsStore (publisher CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US) scoped to non-admins, or the equivalent App Control for Business rule — AppLocker enforces on all editions since KB5024351. Two side notes: Turn off the Store application never stops Intune from deploying Store apps or UWP apps from auto-updating (Microsoft calls that out), and removing the Store package with Remove-AppxProvisionedPackage is the one route I'd avoid — it breaks inbox-app updates.

[incedIT]

The device blocking store is my own, I would not have blocked it manually. In Windows Settings, System it shows as Win 11 Business, in Intune it shows as "Operating system SKU Windows 10/11 Professional (48)​". The media used to install Windows was created by the Media Creation Tool, I then use Ntlite to strip out all editions except Pro.

HKCU\Software\Policies\Microsoft\WindowsStore\RemoveWindowsStore value is 1, no entry in HKLM.

MDM Diag shows the following and is tied to Intune enrollment:
ADMX_WindowsStore RemoveWindowsStore_1 user01

In both tenants, the "Turn off the Store application (User)" setting shows as "Succeeded".

You can see my confusion as I was aware of the Enterprise limitation but my devices are all Pro/Business SKU.