question

JamesEdmonds-7766 avatar image
0 Votes"
JamesEdmonds-7766 asked JamesEdmonds-7766 commented

Ho do I use/manage Microsoft Store for Business?

Hi,

Whilst I know Microsoft Store for Business is coming to an end soon, I'm still keen to play around with it for a couple of years until support ends.
Sadly.......I just don't get it!

I have access to the portal, and we have a private store configured with some apps available for people to download.
Everything else seems to elude me.

How does the store app know that I am using store for business?
Are there group policy settings I need to apply?
Is it determined based on the account that is signed in to the store?
I have disabled shopping in the portal, but the store looks and functions exactly the same even when signed in with a standard user account. Should they have the ability to browse and install apps from the normal store be removed?

Thanks
James

windows-10-generalwindows-active-directorywindows-group-policy
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DonPickard-7259 avatar image
0 Votes"
DonPickard-7259 answered JamesEdmonds-7766 commented

https://docs.microsoft.com/en-us/microsoft-store/acquire-apps-microsoft-store-for-business#allow-users-to-shop


If you are wishing to block any/all store app acquisition, even free apps, this setting is not what you want.
By default, a user can authenticate to the Store using either a work/school account, or their own personal account, and can acquire and install any app. If you want to disallow acquiring/installing Store apps, you can do this a couple of different ways. (we initially did that in our org, but relaxed it later)

How you choose to control the Store experience, depends upon your requirements.
here are some ways: https://docs.microsoft.com/en-us/windows/configuration/stop-employees-from-using-microsoft-store#show-private-store-only-using-group-policy

what we do is block the use of Microsoft accts (consumer accts) - we no longer mind about users getting Store apps

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks, I will check out the group policy settings and see if they are of use.

Thanks
James

0 Votes 0 ·

This group policy settings does exactly what I needed!

Thanks
James

0 Votes 0 ·
DonPickard-7259 avatar image
0 Votes"
DonPickard-7259 answered DonPickard-7259 converted comment to answer

Is it determined based on the account that is signed in to the store?

Yes, exactly this.

WSfB is unrelated to AD/GPO, only related to AAD user identity (work or school account) and is controlled/managed via your AADtenant.

If my Win10 PC is registered/enrolled/joined to my organisation's AAD tenant (eg contoso.onmicrosoft.com) and i authenticate using my contoso AAD user identity, I will see what Contoso allows me to see within the Store.



· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks,

So for my final part of the query:
"I have disabled shopping in the portal, but the store looks and functions exactly the same even when signed in with a standard user account. Should they have the ability to browse and install apps from the normal store be removed?"

What would I expect a user to see in the store if I have turned off the "Allow users to shop" option?
It seems a user can still see all of the store with no restrictions, so I am unclear if this policy is working or even having any effect on an end user.

Thanks
James

0 Votes 0 ·
DonPickard-7259 avatar image
0 Votes"
DonPickard-7259 answered DonPickard-7259 commented

"I have disabled shopping in the portal, but the store looks and functions exactly the same even when signed in with a standard user account. Should they have the ability to browse and install apps from the normal store be removed?"

What would I expect a user to see in the store if I have turned off the "Allow users to shop" option?
It seems a user can still see all of the store with no restrictions, so I am unclear if this policy is working or even having any effect on an end user.

This only affects whether users whom you have authorised to purchase on behalf or your company/org, can purchase or not. (i.e. users to whom you have previously granted the roles, would become blocked)


https://docs.microsoft.com/en-us/microsoft-store/acquire-apps-microsoft-store-for-business#allow-users-to-shop


If you are wishing to block any/all store app acquisition, even free apps, this setting is not what you want.
By default, a user can authenticate to the Store using either a work/school account, or their own personal account, and can acquire and install any app. If you want to disallow acquiring/installing Store apps, you can do this a couple of different ways. (we initially did that in our org, but relaxed it after some time)

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

So to be clear, if I disable the "Ability to shop" option, users logged in with AAD accounts can still browse the store normally, and download and install free apps?
The only thing they won't be able to do, is purchase and install paid apps?

Many thanks
James

0 Votes 0 ·

sorry James, I am struggling with this webtool today :(

the 'ability to shop' setting, only affects who in your org can purchase on behalf of your org, and then only if you have also granted them the Purchaser role.

0 Votes 0 ·

regardless of the 'ability to shop' setting, AAD users (work or school accts), can by default, acquire and install free apps.

0 Votes 0 ·