Updating Microsoft Store apps & WSUS

Question

I have been troubleshooting an issue where our Microsoft Store (Business/EDU Store) apps are not getting updates. We have WSUS set up for Windows Updates. I've been playing with the group policies and have not been able to figure out what is causing the problem. Additional to the update problem we have one app "Paint 3D" which will not launch, it gives an error "This app has been blocked by your system administrator", we aren't blocking any apps currently. Other apps like Snip & Sketch or Windows Calculator do launch. Our users are not admin users. We have the following group policies:

Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update:
Configure Automatic Update
Do not allow update deferral policies to cause scans against Windows Update
Enable client-side targeting
No auto-restart with logged on users for scheduled automatic updates installations
Specify intranet Microsoft update service location
Turn off auto-restart for updates during active hours

Computer Configuration\Policies\Administrative Templates\Windows Components\Store:
Turn off Automatic Download and Install of updates :: Disabled
Turn off the offer to update to the latest version of Windows :: Enabled
Disable all apps from Microsoft Store :: Enabled
Turn off the Store application :: Disabled
Only display the private store within the Microsoft Store :: Enabled

Answer 1

Hello @MikeG ,

Thank you for your patience.

1Based on "our Microsoft Store (Business/EDU Store) apps are not getting updates.", where do you want to Microsoft Store (Business/EDU Store) apps get update? Is it WSUS or Microsoft catalog website?

2I can see your configuration below:

Computer Configuration\Policies\Administrative Templates\Windows Components\Store:
Turn off Automatic Download and Install of updates :: Disabled
Turn off the offer to update to the latest version of Windows :: Enabled
Disable all apps from Microsoft Store :: Enabled
Turn off the Store application :: Disabled
Only display the private store within the Microsoft Store :: Enabled

But for "Turn off the offer to update to the latest version of Windows", should we disable this setting?

3Based on "Additional to the update problem we have one app "Paint 3D" which will not launch, it gives an error "This app has been blocked by your system administrator"", if we move the machine with one app "Paint 3D" from one OU to Default Computers container (I mean if this machine does not use any custom group policy settings), and restart this machine, can we launch"Paint 3D"?
Via this way, we can if it is related to GPO setting.

Best Regards,
Daisy Zhou