Microsoft store apps (New) Is not getting installed.

Question

We are in the process of migrating the endpoints from SCCM to Intune. So, I planned to keep the Microsoft store block to have better control of application management. I did configure the policy as below,
Require Private Store Only - Only Private store

Require Private Store Only (User) - Only Private store

Turn off the Store application - Disabled

Turn off the Store application (User) - Disabled
Based on this configuration, Company portal getting installed successfully and deployed through Microsoft store app (new). We are ensuring it is getting installed through Autopilot. Now I deployed couple of apps from Microsoft Store app such as ChatGPT, Display Link Manager etc., those are not getting installed successfully and getting the error code as '0x800704EC'. Upon exploring this error code, found due to store block unable to install those app. At present, we don't want to use WDAC or App locker. Need some suggestions please. Thanks.
ChatGPT, Display Link Manager, Company Portal all are configured the install behavior as 'System'.

Answer 1

Hello Karthick,

The error 0x800704EC confirms the Store is being blocked by policy, which is why apps like ChatGPT and DisplayLink Manager fail to install even though Company Portal succeeds. The Company Portal works because it is a special case published by Microsoft and exempt from certain restrictions, but other Store apps still require the Store service to be accessible. With your current configuration, “Require Private Store Only” effectively prevents public Store apps from being delivered, so Intune attempts fail.

If you want to continue blocking direct user access to the public Store but still allow Intune to deploy Store apps, you need to adjust the policy so that the Store app itself is not blocked. The supported approach is to leave “Turn off the Store application” set to Disabled and avoid enforcing “Require Private Store Only” until after migration. Alternatively, move those apps into Win32 packaging (using IntuneWin format) or line-of-business app deployment so they bypass the Store entirely. WDAC and AppLocker are not required here; the key is that Intune’s Microsoft Store app (new) delivery mechanism depends on the Store service being available. In short, either relax the Store restriction during migration or repackage those apps as Win32/LOB deployments to ensure they install successfully.

Answer 2

Error 0x800704EC indicates that Microsoft Store is blocked by policy, which prevents Microsoft Store app (new) deployments that still rely on Store infrastructure from installing.

From the configuration described:

• Require Private Store Only is set to Only Private store (device and user).
• Turn off the Store application is Disabled (device and user).

Key behaviors from the documented policies:

1. Turn off the Store application
   • Does not affect Intune’s ability to install Microsoft Store apps.
   • Does not block Store auto‑updates for UWP apps as long as Turn off Automatic Download and Install of updates is not enabled.
2. Require Private Store Only
   • Blocks end‑user access to the Microsoft Store UI.
   • Still allows the Windows Package Manager winget CLI to access the Store.
   • Is explicitly called out as “not the preferred choice to prevent end user access to the Microsoft Store” because it does not fully block Store back‑end usage.

In this scenario, the 0x800704EC error shows that the Store is blocked in a way that prevents some Microsoft Store app (new) packages (like ChatGPT and DisplayLink Manager) from installing, even though Company Portal can still install. Different Store apps can use different Store mechanisms and dependencies; some may be more sensitive to Store‑blocking policies than others.

To keep control of app installation while allowing Microsoft Store app (new) deployments to succeed, use these principles from the documentation:

1. Prefer Turn off the Store application to block user access
   • Use Turn off the Store application (device and/or user) to block the Store UI instead of relying on Require Private Store Only.
   • This setting does not block Intune from installing Microsoft Store apps.
2. Keep Store auto‑update enabled
   • Ensure Turn off Automatic Download and Install of updates is Not configured or Disabled so that UWP apps and built‑in apps can update automatically.
3. Avoid using Require Private Store Only as the primary block
   • The documentation notes that Require Private Store Only is still valid but not the preferred choice to prevent end‑user access, and it can have side effects while still allowing winget access.
   • Relax or remove Require Private Store Only where Microsoft Store app (new) deployments are failing, and rely on Turn off the Store application for UI blocking.
4. Keep using Intune for control
   • Continue assigning Microsoft Store app (new) apps as Required with System install behavior for managed deployment.
   • For Win32 Store apps, Intune will manage updates independently of Store update policies when they are assigned.

A practical adjustment path based on the documentation:

1. Change Require Private Store Only and Require Private Store Only (User) from Only Private store to Not configured (or remove those policies) on a pilot group.
2. Keep Turn off the Store application and Turn off the Store application (User) configured as desired to block the Store UI (Enabled to block, Disabled/Not configured to allow).
3. Confirm that Turn off Automatic Download and Install of updates is not enabled.
4. Re‑sync a test device and retry installing ChatGPT and DisplayLink Manager via Intune.

This approach maintains centralized app control via Intune while avoiding Store‑blocking policies that interfere with Microsoft Store app (new) installations.

---

References:

• Add Microsoft Store Apps to Microsoft Intune
• Using Intune, install Windows App on physical devices