Windows Store submitted app behaviour

Question

Hi,

We have submitted an uwp app to windows store 1.0.0 and from partner center we got the preinstallkit and we wrapped that and create a msi.

This Msi is installed in a enterprise environment where windows store app is blocked. Now we release another version 1.1.0 to store and its public but 1.1.0 Msi is not released yet. but in the enterprise environment all the machines 1.1.0 is auto upgraded. The machines needed to be upgraded using MSI 1.1.0 only.

How to block this auto upgrade, even tough windows store app is disabled? why app is autoupgraded.

Answer 1

Hi @Raja Shanmugam ,

Thanks for setting out the deployment chain so clearly.

Blocking the Microsoft Store app doesn't, by itself, block automatic UWP app updates. Microsoft notes explicitly that Store apps keep updating by default even when access to the Store app is blocked: Configure access to the Microsoft Store app – Considerations. Since your package comes from the Partner Center preinstall kit, it's still a Store-serviced package, so wrapping it in an MSI doesn't stop it from being updated outside that MSI. To stop the automatic update, configure the update policy itself (not just the Store-access policy), through whichever method manages these devices:

• Group Policy: enable Turn off Automatic Download and Install of updates under Computer Configuration > Administrative Templates > Windows Components > Store.
• Intune/MDM: set ApplicationManagement/AllowAppStoreAutoUpdate to 0 at the device scope. Microsoft documents the CSP values and Group Policy mapping in ApplicationManagement Policy CSP – AllowAppStoreAutoUpdate.

These are two paths to the same control — use whichever matches your management setup, and if both apply to a device, check for conflicts.

One thing to plan for: this is a device-wide Store automatic-update policy, not a restriction for your app alone. Plan how other affected apps, including built-in apps, will remain updated. It does not block every update mechanism: Microsoft specifically notes that Win32 Store apps with an active Intune assignment can still update. That exception should not be generalized to your UWP app. See Add Microsoft Store apps to Intune – Common Store policy settings.

To verify it's working:

1. Use an isolated test device or VM that still has 1.0.0 installed. Apply the policy before allowing normal background Store update servicing to run, and confirm it actually applied through GPO results or Intune profile status.
2. For the Group Policy configuration, check AutoDownload under HKLM\SOFTWARE\Policies\Microsoft\WindowsStore. The expected value is REG_DWORD = 2, displayed as 0x2 when you run:

      reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v AutoDownload
   

   This mapping is documented in Group Policy and packaged apps – Turn off Automatic Download and Install of updates. The registry value 2 and CSP value 0 are different representations; do not interchange them. For MDM, also verify the device's policy status rather than relying on the registry value alone.
3. Monitor the UWP package version during normal background update servicing and check that it remains at 1.0.0 without deploying a newer MSI. Do not use a manual update action to test automatic-update blocking. A device already at 1.1.0 remaining unchanged would not demonstrate that the policy blocked the 1.0.0 → 1.1.0 update. Once your MSI 1.1.0 is available, confirm that deploying it upgrades the package as intended.

Let me know how it goes on a test device, or if you'd rather explore a longer-term packaging change so this app is fully decoupled from Store servicing.

If you found my explanation above was truly helpful or informative to you, I would greatly appreciate it if you could follow this guidance so others with the same issue could benefit as well.

Thank you.

Answer 2

The app is auto-upgrading because Store-serviced packaged apps can still receive updates through Microsoft Store servicing, and blocking the Microsoft Store app UI does not necessarily stop app update servicing in all cases. For packaged apps, Store updates are controlled by Store update policy, not by whether the Store app is visible to users.

To prevent the automatic upgrade, use Store update controls on the managed devices:

1. Disable automatic app updates with policy:
   • Group Policy: Computer Configuration\Administrative Templates\Windows Components\Store
   • Policy: Turn off Automatic Download and Install of updates
   • Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore
   • Value: AutoDownload (REG_DWORD)
     • 2 = apps will not be updated
     • 4 = apps will be automatically updated
2. If needed, also review the policy that blocks the Store app:
   • Policy: Turn off Store application
   • If configured in the computer context, this policy turns off app updates.
3. For Windows IoT Enterprise scenarios, Store app updates are also governed by device management settings such as:
   • ApplicationManagement/AllowStore
   • ApplicationManagement/AllowAppStoreAutoUpdate

Important points for the deployment model:

• A Store-published packaged app can be updated through Store servicing independently of an MSI wrapper.
• If the requirement is that updates must happen only when a new MSI is deployed, Store servicing conflicts with that requirement.
• MSI/setup deployments must provide or integrate their own update mechanism. Store packages are updated through Microsoft Store servicing, subject to Store and organizational settings.

If strict MSI-only upgrade control is required, use a deployment model where the app is distributed outside Microsoft Store servicing, or ensure Store auto-update servicing is disabled by policy across the enterprise.

Risk note: changing Store update policy affects updates for other Store apps on the device, including first-party apps.

---

References:

• Group Policy and packaged apps
• Windows App Development Frequently Asked Questions
• Application Updates