Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
This CSP contains some settings that are under development and only applicable for Windows Insider Preview builds. These settings are subject to change and may have dependencies on other features or services in preview.
AllowRecallEnablement
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later ✅ Windows Insider Preview |
./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallEnablement
This policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.
If this policy isn't configured, end users will have the Recall component in a disabled state.
If this policy is disabled, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they'll be deleted when this policy is disabled. Removing Recall requires a device restart.
If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DisableAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users will be able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
Allowed values:
| Value | Description |
|---|---|
| 0 | Recall isn't available. |
| 1 (Default) | Recall is available. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | AllowRecallEnablement |
| Friendly Name | Allow Recall to be enabled |
| Location | Computer Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | AllowRecallEnablement |
| ADMX File Name | WindowsCopilot.admx |
AllowRecallExport
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows Insider Preview |
./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallExport
This policy allows you to determine whether users can export their own Recall and snapshot information. Exporting allows users to share their Recall and snapshot information with trusted apps or websites. Users can export from Settings > Privacy & security > Recall & snapshots > Advanced settings > Export snapshots > Export past snapshots > Export.
Users can also choose to continuously export their snapshots if they turn on the option to Export snapshots from now on from Settings > Privacy & security > Recall & snapshots > Advanced settings > Export snapshots > Export.
Before starting an export, the user must authenticate with Windows Hello and they're notified that their exported snapshots are encrypted since they might contain sensitive information. The user is also notified that they'll need to provide their Recall export code if they want to allow apps or websites access to exported snapshots. The Recall export code is displayed to users during Recall setup even if this policy is set to disabled or not configured. For managed devices:
- When you set this policy to enabled, users will be able to export Recall and snapshot information.
- If the policy is set to disabled or not configured, users won't be able to export their Recall and snapshot information.
Important
- This setting applies to devices in the European Economic Area (EEA) only. Export of Recall and snapshot information is a user-initiated process and is per user. IT admins or other users can't initiate an export on behalf of another.
- Changes to this policy take effect after device restart.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Deny export of Recall and snapshots information. |
| 1 | Allow export of Recall and snapshot information. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | AllowRecallExport |
| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
DisableAIDataAnalysis
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later ✅ Windows Insider Preview |
./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis
This policy setting allows you to determine whether snapshots of the screen can be saved for use with Recall. By default, snapshots for Recall aren't enabled. IT administrators can't, on their own, enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.
If the policy isn't configured, snapshots won't be saved for use with Recall.
If you enable this policy, snapshots won't be saved for use with Recall. If snapshots were previously saved on the device, they'll be deleted when this policy is enabled.
If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Enable Saving Snapshots for Windows. |
| 1 | Disable Saving Snapshots for Windows. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | DisableAIDataAnalysis |
| Friendly Name | Turn off saving snapshots for use with Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | DisableAIDataAnalysis |
| ADMX File Name | WindowsCopilot.admx |
DisableClickToDo
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows Insider Preview |
./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableClickToDo
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableClickToDo
Click to Do lets people take action on content on their screens. When activated, it takes a screenshot of their screen and analyzes it to present actions. Click to Do ends when they exit it, and it can't take screenshots while closed. Screenshot analysis is always performed locally on their device. By default, Click to Do is enabled for users. This policy setting allows you to determine whether Click to Do is available for users on their device. When the policy is enabled, the Click to Do component and entry points won't be available to users. When the policy is disabled, users will have Click to Do available on their device.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Click to Do is enabled. |
| 1 | Click to Do is disabled. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | DisableClickToDo |
| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
DisableCocreator
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 22H2 [10.0.22621.4870] and later ✅ Windows 11, version 24H2 [10.0.26100.3360] and later ✅ Windows Insider Preview |
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableCocreator
This policy setting allows you to control whether Cocreator functionality is disabled in the Windows Paint app.
If this policy is enabled, Cocreator functionality won't be accessible in the Paint app.
If this policy is disabled or not configured, users will be able to access Cocreator functionality.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Cocreator is enabled. |
| 1 | Cocreator is disabled. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | DisableCocreator |
| Path | WindowsAI > AT > WindowsComponents > Paint |
DisableGenerativeFill
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 22H2 [10.0.22621.4870] and later ✅ Windows 11, version 24H2 [10.0.26100.3360] and later ✅ Windows Insider Preview |
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableGenerativeFill
This policy setting allows you to control whether generative fill functionality is disabled in the Windows Paint app.
If this policy is enabled, generative fill functionality won't be accessible in the Paint app.
If this policy is disabled or not configured, users will be able to access generative fill functionality.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Generative fill is enabled. |
| 1 | Generative fill is disabled. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | DisableGenerativeFill |
| Path | WindowsAI > AT > WindowsComponents > Paint |
DisableImageCreator
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 22H2 [10.0.22621.4870] and later ✅ Windows 11, version 24H2 [10.0.26100.3360] and later ✅ Windows Insider Preview |
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableImageCreator
This policy setting allows you to control whether Image Creator functionality is disabled in the Windows Paint app.
If this policy is enabled, Image Creator functionality won't be accessible in the Paint app.
If this policy is disabled or not configured, users will be able to access Image Creator functionality.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Image Creator is enabled. |
| 1 | Image Creator is disabled. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | DisableImageCreator |
| Path | WindowsAI > AT > WindowsComponents > Paint |
DisableSettingsAgent
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User |
❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows Insider Preview |
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableSettingsAgent
This policy setting allows you to determine whether Settings Agentic search experience is available for users on their device. When the policy is enabled, the agentic experience won't be available, limiting search results to statically indexed searches and semantic searches. When the policy is disabled, users will have Settings Agent search experience available on their device.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Settings Agentic search experience is enabled. |
| 1 | Settings Agentic search experience isn't enabled. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | DisableSettingsAgent |
| Path | WindowsAI > AT > WindowsComponents > WindowsAI |
SetCopilotHardwareKey
| Scope | Editions | Applicable OS |
|---|---|---|
| ❌ Device ✅ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 22H2 with KB5044380 [10.0.22621.4391] and later |
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetCopilotHardwareKey
This policy setting determines which app opens when the user presses the Copilot key on their keyboard.
If the policy is enabled, the specified app will open when the user presses the Copilot key. Users can change the key assignment in Settings.
If the policy isn't configured, Copilot will open if it's available in that country or region.
The property value is the Application User Model ID (AUMID) for the target application. For example: the Microsoft 365 Copilot app is Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft.MicrosoftOfficeHub. For more information, see Find the application user model ID of an installed app.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
Group policy mapping:
| Name | Value |
|---|---|
| Name | SetCopilotHardwareKey |
| Friendly Name | Set Copilot Hardware Key |
| Location | User Configuration |
| Path | Windows Components > Windows Copilot |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CopilotKey |
| ADMX File Name | WindowsCopilot.admx |
SetDenyAppListForRecall
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User |
❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later ✅ Windows Insider Preview |
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall
This policy allows you to define a list of apps that won't be included in snapshots for Recall.
Users will be able to add additional applications to exclude from snapshots using Recall settings.
The list can include Application User Model IDs (AUMID) or name of the executable file.
Use a semicolon-separated list of apps to define the deny app list for Recall.
For example: code.exe;Microsoft.WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe
Important
When configuring this policy setting, changes won't take effect until the device restarts.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | List (Delimiter: ;) |
Group policy mapping:
| Name | Value |
|---|---|
| Name | SetDenyAppListForRecall |
| Friendly Name | Set a list of apps to be filtered from snapshots for Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | SetDenyAppListForRecall |
| ADMX File Name | WindowsCopilot.admx |
SetDenyUriListForRecall
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User |
❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later ✅ Windows Insider Preview |
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall
This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs.
For example: https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com
Adding https://www.WoodgroveBank.com to the list would also filter https://Account.WoodgroveBank.com and https://www.WoodgroveBank.com/Account.
Important
Changes to this policy take effect after device restart.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | List (Delimiter: ;) |
Group policy mapping:
| Name | Value |
|---|---|
| Name | SetDenyUriListForRecall |
| Friendly Name | Set a list of URIs to be filtered from snapshots for Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | SetDenyUriListForRecall |
| ADMX File Name | WindowsCopilot.admx |
SetMaximumStorageDurationForRecallSnapshots
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User |
❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later ✅ Windows Insider Preview |
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots
This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall.
When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days.
When this policy isn't configured, a time frame isn't set for deleting snapshots.
Snapshots aren't deleted until the maximum storage allocation for Recall is reached, and then the oldest snapshots are deleted first.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Let the OS define the maximum amount of time the snapshots will be saved. |
| 30 | 30 days. |
| 60 | 60 days. |
| 90 | 90 days. |
| 180 | 180 days. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | SetMaximumStorageDurationForRecallSnapshots |
| Friendly Name | Set maximum duration for storing snapshots used by Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | SetMaximumStorageDurationForRecallSnapshots |
| ADMX File Name | WindowsCopilot.admx |
SetMaximumStorageSpaceForRecallSnapshots
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User |
❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later ✅ Windows Insider Preview |
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots
This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall.
You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB.
When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity.
25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Let the OS define the maximum storage amount based on hard drive storage size. |
| 10240 | 10GB. |
| 25600 | 25GB. |
| 51200 | 50GB. |
| 76800 | 75GB. |
| 102400 | 100GB. |
| 153600 | 150GB. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | SetMaximumStorageSpaceForRecallSnapshots |
| Friendly Name | Set maximum storage for snapshots used by Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | SetMaximumStorageSpaceForRecallSnapshots |
| ADMX File Name | WindowsCopilot.admx |
TurnOffWindowsCopilot
Note
This policy is deprecated and may be removed in a future release.
| Scope | Editions | Applicable OS |
|---|---|---|
| ❌ Device ✅ User |
✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC |
✅ Windows 10, version 21H2 [10.0.19044.3758] and later ✅ Windows 10, version 22H2 with KB5032278 [10.0.19045.3758] and later ✅ Windows 11, version 22H2 with KB5030310 [10.0.22621.2361] and later ✅ Windows 11, version 23H2 [10.0.22631] and later |
./User/Vendor/MSFT/Policy/Config/WindowsAI/TurnOffWindowsCopilot
This policy setting allows you to turn off Windows Copilot.
If you enable this policy setting, users won't be able to use Copilot. The Copilot icon won't appear on the taskbar either.
If you disable or don't configure this policy setting, users will be able to use Copilot when it's available to them.
Note
- The TurnOffWindowsCopilot policy isn't for the new Copilot experience that's in some Windows Insider builds and that will be gradually rolling out to Windows 11 and Windows 10 devices.
- This policy also applies to upgrade scenarios to prevent installation of the Copilot app from an image that would have had the Copilot in Windows pane.
Description framework properties:
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 0 |
Allowed values:
| Value | Description |
|---|---|
| 0 (Default) | Enable Copilot. |
| 1 | Disable Copilot. |
Group policy mapping:
| Name | Value |
|---|---|
| Name | TurnOffWindowsCopilot |
| Friendly Name | Turn off Windows Copilot |
| Location | User Configuration |
| Path | Windows Components > Windows Copilot |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot |
| Registry Value Name | TurnOffWindowsCopilot |
| ADMX File Name | WindowsCopilot.admx |