How to Only Allow Apps From the Microsoft Store in Windows 10 and 11

To only allow apps from the Microsoft Store, open Settings > Apps > Advanced app settings in Windows 11 (or Settings > Apps > Apps & features in Windows 10), open the Choose where to get apps menu, and select The Microsoft Store only (Recommended). The change takes effect right away, with no Save button or restart.

These steps are for current Windows 11 releases (including 24H2, 25H2 and 26H2) and Windows 10 version 22H2, and they follow Microsoft’s app recommendation settings guide. The setting is the same in both versions; only its location in Settings differs. You need to be signed in with an administrator account to change it.

It’s an easy way to keep a family or shared PC from picking up random downloads, because the Store reviews apps before listing them.

Only Allow Microsoft Store Apps in Windows 11

1. Press Windows key + I to open Settings.
2. Click Apps in the left pane.
3. Click Advanced app settings.
4. Click the menu next to Choose where to get apps.
5. Select The Microsoft Store only (Recommended).

The menu now shows the Store-only option. Close Settings and reopen the page if you want to confirm the choice stuck.

Only Allow Microsoft Store Apps in Windows 10

1. Press Windows key + I to open Settings.
2. Click Apps. The Apps & features page opens.
3. At the top of the page, find Choose where to get apps and click its menu.
4. Select The Microsoft Store only (Recommended). Older Windows 10 builds show this under Installing apps and call it Allow apps from the Store only.

Microsoft ended free security updates for Windows 10 on October 14, 2025. This setting is still useful, but it doesn’t replace security updates, so check whether your PC is covered by Extended Security Updates or can move to Windows 11.

Check That It Worked

Download the installer for a free program you trust from its maker’s website, then double-click it. With Store-only on, the Microsoft-verified message appears instead of the setup wizard. Click the Store button in the message to look for the same app in the Microsoft Store, or close the message.

With Store-only turned on, Windows blocks the normal installation of apps you download from websites. If you open a downloaded installer, such as an .exe or .msi file, Windows shows a message saying the app you’re trying to install isn’t a Microsoft-verified app. The message has a button to open the Store and a link back to this setting.

What the Four Options Mean

The Choose where to get apps menu has four choices. Read them carefully, because three of them start with “Anywhere.”

Option	What happens when you open a downloaded installer
Anywhere	The app installs normally with no Store message.
Anywhere, but let me know if there’s a comparable app in the Microsoft Store	Windows suggests a Store app if there’s a similar one, but you can still install.
Anywhere, but warn me before installing an app that’s not from the Microsoft Store	Windows shows a warning, and you can choose to install anyway.
The Microsoft Store only (Recommended)	Windows blocks the install and sends you to the Store.

Only the last option actually blocks non-Store apps. If you want a reminder without a hard block, the warning option is a good middle ground for your own PC.

What Store-Only Does and Doesn’t Do

• It doesn’t remove apps you already have. Programs you installed from websites keep working. To review them, use the steps for finding installed programs in Windows 11.
• It doesn’t mean Microsoft apps only. The Store has apps from many companies, including Spotify, Zoom, WhatsApp, and Adobe Acrobat Reader.
• It doesn’t stop downloads. A person can still download a file. Windows just won’t install it as a normal app.
• It applies to the whole PC. Every account on the computer gets the same rule, so you can’t set it for one person only.
• It isn’t a complete lockdown. Portable programs that run without installing and some scripts aren’t covered. Keep Windows Security turned on, and use a standard (non-administrator) account for children so they can’t change the setting back. The steps for creating a local account in Windows 11 set one up, and new local accounts are standard by default.

Before you switch a shared PC to Store-only, check that the apps its users need are in the Store. Search for them by opening Start, typing Microsoft Store, and searching inside the app. If the Store itself is missing, follow the steps for getting the Microsoft Store on Windows 11.

Microsoft’s own free apps are listed there too, including the one you install to enable Copilot in Windows 11.

Windows 11 has a related protection called Smart App Control, found in Windows Security > App & browser control. It blocks apps that are malicious or untrusted rather than judging them by where they came from. Microsoft explains how it works in What is Smart App Control.

For Pro, Education and Enterprise PCs: Use Group Policy

On a PC you manage, you can set the same rule with Microsoft’s Configure App Install Control policy, so it can’t be changed in Settings by other users. The policy is available for Pro, Enterprise, Education and IoT Enterprise editions. Windows Home doesn’t include the Local Group Policy Editor.

1. Sign in with an administrator account, press Windows key + R, type gpedit.msc, and press Enter.
2. Go to Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer.
3. Double-click Configure App Install Control.
4. Select Enabled, choose the Store-only option in the list, and click OK.

Microsoft’s SmartScreen policy reference notes that this policy blocks installs only while the PC is online, and lists two more SmartScreen policies to turn on if you also need to block offline installs. To undo it, set the policy back to Not Configured.

Store-Only vs. S Mode

Windows in S mode also only runs Store apps, but it’s a different, stricter feature. You can switch the Choose where to get apps setting back and forth whenever you like. Switching out of S mode is free but permanent, according to Microsoft’s S mode FAQ.

If your PC is already in S mode, the Choose where to get apps menu isn’t something you can use to allow other apps. The steps for exiting S mode in Windows 11 explain the switch and what you give up.

If the Setting Is Missing or Grayed Out

• You’re on the wrong page. In Windows 11, the menu is under Apps > Advanced app settings, not Installed apps. In Windows 10, it’s at the top of Apps & features.
• Your PC is in S mode. Check Settings > System > Activation in Windows 11 or Settings > Update & Security > Activation in Windows 10. If it mentions S mode, see the section above.
• Your PC is managed by work or school. If you see “Some of these settings are managed by your organization,” an administrator controls app installation, often with the policy above. Contact your IT team instead of trying to bypass the policy.
• You’re not an administrator. Standard accounts can’t change this setting. Sign in with an administrator account.

How to Allow Apps From Anywhere Again

1. Go back to Settings > Apps > Advanced app settings (Windows 11) or Settings > Apps > Apps & features (Windows 10). The link in the blocked-install message opens the same page.
2. Open Choose where to get apps.
3. Select Anywhere or one of the other Anywhere options.

Then run the installer again. Windows doesn’t automatically retry an install it blocked earlier.

Frequently Asked Questions