Windows device settings in Intune for Education

Applies to:

• Windows 10
• Windows 11
• Windows 11 SE

This article lists and describes all Windows device settings in Intune for Education. To view and edit these settings in the portal, click Groups > Settings > Windows Device Settings.

Apply settings

Apply group settings to establish access and security boundaries on the devices in your school. You can assign the same settings across all groups in your school; or you can customize the classroom experience and apply settings to individual groups.

Configuration options

Many settings in Intune for Education are configured to Block or Allow. For some settings, Not configured is an option. When toggled to Not Configured, the device will either:

• Use the default setting.
• Allow the device user (student or teacher) to customize the setting from their device.

Note

User, app, and device settings differ from tenant settings. Tenant settings address the subscription and management settings for your organization.

Accounts and sign-in

Configure how users sign in to school devices.

Setting	What it does
Block adding and signing in with personal Microsoft accounts	Block users from signing in with their Microsoft account.
Block adding and signing in with non-Microsoft accounts	Block users from adding any account other than their Microsoft account. Use this setting if you want to force users to only use their Microsoft accounts for email.
Configure preferred Microsoft Entra tenant domain	Enables users to sign in to Windows without typing the domain name. If you configure this setting, the tenant domain name will prepopulate, but is still editable.

Apps

Configure settings such as how users install and access apps on their devices.

Setting	What it does
Remove built-in Windows 10 apps	Uninstall certain built-in Windows apps. Learn what those apps are below.
Block access to administrative apps	Block students from opening apps that require administrative privileges.
Block installing apps from the Microsoft Store for Education	Block users from installing apps from unauthorized locations.
Require Microsoft Store for Education apps to be installed from the private store	Only allow users to install apps from the Microsoft Store for Education that your organization has set up.
Trusted apps	Allow or block users from installing trusted apps that have signed certificates from Microsoft.
Untrusted apps	Allow or block users from installing apps with certificates that are unsigned, or signed by sources not trusted by Microsoft.
Block installing apps from places other than the Microsoft Store for Education	Block users from installing apps from other sources and app stores.
Block automatic updates for Microsoft Store for Education apps	Block Microsoft Store for Education apps from being updated automatically.
Enable students on shared devices to share app data	Enable students using the same app on the same device to share data.

Enrollment controls

Configure settings related to Intune for Education device enrollment.

Setting	What it does
Block manual unenrollment	Block users from manually unenrolling devices from management.
Enable Autopilot Reset	Enable users with administrative rights to press CTRL+ Win + R on the device lock screen to trigger Autopilot Reset. Autopilot Reset removes all user data–including user-installed apps and personal settings–and keeps the device enrolled in Intune. As a result, the device is kept up-to-date with all of the latest apps, policies, and settings.
Block adding provisioning packages	Block users from adding new provisioning packages that have device settings.
Block removing provisioning packages	Block users from removing provisioning packages that have device settings.

Microsoft Edge

Configure settings that affect the Microsoft Edge browser experience and user data.

Browser customization

Setting	What it does
Configure homepages	Choose what page opens every time someone begins a new Microsoft Edge browser session.
Configure new tab page	Choose what page opens every time someone opens a new tab in Microsoft Edge.
Configure home button behavior	Choose what page appears when users click the home button in Microsoft Edge. You can also hide the home button.
Default search engine	Select Bing, Yahoo, or Google as the default search engine for Microsoft Edge.
Configure blocked URLs list	Define a list of sites that your users can't load.

Browser restrictions

Setting	What it does
Block editing favorites	Block users from adding, importing, sorting, or editing the Favorites list.
Block address bar suggestions	Block Microsoft Edge from suggesting possible search terms or previously visited websites as you type a URL or search term.
Block browser extensions	Block users from using extensions to customize Microsoft Edge with added functionality from Microsoft and other sources.
Block untrusted browser extensions	Block users from sideloading extensions to their Microsoft Edge browser. These extensions are installed from untrusted sources–not the Microsoft Store–and could be malware.
Block search suggestions	Block Microsoft Edge from suggesting possible websites as you type a URL or search term.
Block InPrivate browsing	Block users from using InPrivate browsing, which stops Microsoft Edge from saving data like browsing history and cookies.
Block Developer Tools	Block users from accessing Developer Tools. Microsoft Edge Developer Tools enable users to build and debug webpages
Block printing from Microsoft Edge	Block users from printing browser content.
Block First Run page	Block users from seeing the First Run page. Microsoft Edge First Run page appears when a user opens Microsoft Edge for the first time and after browser updates.
Block pop-ups	Block websites from opening new windows.
Block overriding security warnings	Block users from clicking "Go on to the webpage" on sites that show an SSL/TLS certificate error.
Block password manager	Block users from using the password manager to save passwords.
Block automatically filling form entries	Block saving data entered in a form field online.
Block access to about:flags page	Block access to the about:flags page, which contains experimental settings and features.
Require intranet sites to be viewed in Internet Explorer	When set to Block, internal traffic is sent to Microsoft Edge instead of Internet Explorer.
Block Prelaunch	Microsoft Edge Prelaunch opens Microsoft Edge as a background process during Windows startup. This action helps the performance of Microsoft Edge and minimizes the amount of time required to start it. However, running Microsoft Edge as a background process might make devices appear as not compliant in your secure assessments.

User data

Setting	What it does
Sync Microsoft Edge favorites with Internet Explorer	Sync all favorites from Microsoft Edge to Internet Explorer.
Clear browsing data upon exit	Automatically erase history, cookies, and cached files after closing Microsoft Edge.
Use cookies	Cookies can store website settings or track user’s browsing behavior.

Network and connectivity

Configure network and connectivity settings for:

• Bluetooth
• Internet connectivity restrictions
• Proxy
• Wi-Fi profiles

Bluetooth

Setting	What it does
Block Bluetooth	Block devices from using Bluetooth.
Block Bluetooth discoverability	Block devices from being set as discoverable using Bluetooth.
Block receiving advertisements over Bluetooth	Block devices from receiving marketing messages and advertisements over Bluetooth.
Block Bluetooth Swift Pair notifications	Block users from getting notifications about Bluetooth device pairing. Swift Pair lets users know when Bluetooth devices are nearby and able to connect to Windows 10.

Internet connectivity restrictions

Setting	What it does
Block Internet Connection Sharing	Block users from using Internet Connection Sharing to share the device’s Internet connection with other devices.
Block using Wi-Fi Sense to automatically connect to open hotspots	Choose if you want to block devices from automatically connecting to Wi-Fi hotspots.
Block cellular data while roaming	Block the use of cellular data when device is roaming.

Proxy

Setting	What it does
Block automatic detection of proxy settings	If you've set up a proxy to handle device network traffic, you can choose whether devices automatically detect the proxy settings when connected.
Use proxy script	Enable the use of a proxy script for your devices. If you Allow this setting, you need to provide a Setup script address.
Use manual proxy server configuration	If you've set up a manual proxy, you can define settings for it here. If you Allow this setting, you need to provide the Proxy server address, Port, Proxy exceptions, and whether to Use proxy server for local (intranet) connections.

Wi-Fi profiles

Setting	What it does
Select Windows Wi-Fi profiles to assign them to this group.	A list of Wi-Fi profiles that you've created appear within this section, and are ready to assign. Details visible include the Profile name, Network name (SSID), Security type, and Description.

Note

Configure a WPA-2 Enterprise Wi-Fi network using the full Wi-Fi profile management experience in Intune. You can also use Intune to set up SCEP and PKI integration.

OneDrive and Storage

Configure Microsoft OneDrive and storage settings.

Setting	What it does
Silently move Windows Known Folders to OneDrive	Moves and redirects Windows known folders (Documents, Desktop, and Pictures) to Microsoft OneDrive. The move happens without any user interaction. When enabled, you also have the option to notify users that their files were moved. This setting is automatically enabled on devices running Windows 11 SE.
Silently sign-in users to OneDrive sync	Use to silently configure user accounts when deploying the OneDrive sync app (OneDrive.exe) to Windows computers. Lets users signed in on a PC that's joined to Microsoft Entra ID set up the sync app without entering their account credentials. The primary user of the device is signed in, so this setting works best on devices that are used by a single user.
Prevent users from redirecting their Known Folders to their PC	Forces users to keep their known folders directed to OneDrive.
Use OneDrive files On-Demand	Lets users get to all of their files in OneDrive or SharePoint Online, without having to download it all and use storage space on the device.
Days files remain unopened before file becomes online only (0-365)	Turns on Storage Sense, a silent assistant that works with OneDrive to automatically free up space. Any files not used within the set period of time are set to online-only when the device runs low on free space. When connected to the Internet, users can continue using their online-only files just like any other file.
Block OneDrive file sync	Block the device from syncing files to OneDrive.

Power and sleep

Configure settings that affect when a device powers off or goes to sleep.

Setting	What it does
Turn off device display after	Choose how many minutes of inactivity before device display turns off. Applies to devices plugged in and on battery.
Put device to sleep after	Choose how many minutes of inactivity before device transitions to sleep. Applies to devices plugged in and on battery.
Put device in hibernation after	Choose how many minutes of inactivity before device transitions to hibernate. Applies to devices plugged in and on battery.
Block changing power and sleep settings	Block users from changing power and sleep settings.

Printer

Configure settings to allow printer access from school devices.

Setting	What it does
Printer list	Create a list of printers that you want to make available to student devices. Enter the printer hostname. An example of a formatted hostname is printer1.contososd.edu.
Specify default printer	Make a printer available as the default printer option on devices. Enter the printer hostname as it appears in your Printer list.
Block adding new printers	Block groups from connecting new printers to their devices.

Security

Configure security settings for Windows Defender and Windows SmartScreen.

Windows Defender

Note

Some Windows Defender settings are available only at the tenant level and are not shown in the portal.

Setting	What it does
Block user access to Windows Defender settings	Block users from modifying Windows Defender settings on the device.
Enable real-time monitoring	Enable always-on scanning for malware, spyware, and other threats.
Enable behavior monitoring	Enable Windows Defender to check for certain known patterns of suspicious activity.
Prompt users to submit suspicious files to Microsoft	Choose to automatically send files to Microsoft for further analysis.
Type of system scan to perform	Choose if Windows Defender does a quick scan, a full scan, or no scan of devices.
Daily quick scan time	Choose what hour of the day Windows Defender runs a daily quick scan.
Scan all downloaded files	Automatically scan all downloaded files for malware.
Scan scripts run in Microsoft web browsers	Scan all scripts a website attempts to run in Microsoft Edge and Internet Explorer.
Scan removable drives during full scan	Include removable drives, such as USB sticks, during full scans.
Scan files opened over the network	Scan all files that are opened by users from websites while using the network.
Scan remote folders during full scan	Scan any folders on remote locations during full scans.
Scan archive files	Scan archive files, like .zip or .rar.
Scan incoming emails	Scan all emails received over the network.
Scan for malware when files or programs are opened	Scan for malware when a file or program opens and alert users about suspicious activity.
Day before quarantined malware is deleted	Set the number of days an affected file is saved. After this number of days, the file is deleted. For example, if set to 0, the file is immediately deleted.
Set anti-malware update frequency	Select how frequently Windows Defender should check for and download anti-malware updates.
Potentially unwanted applications protection	Windows Defender alerts the user, and blocks potentially unwanted software that attempts to install itself on devices.
Block suspicious files	If this setting is configured, Windows Defender Antivirus will be more aggressive about identifying suspicious files to block and scan. When not configured, it will block and scan less frequently. You can select Not configured, High, High plus, and Zero tolerance. High aggressively blocks unknown files while minimizing impact to device performance. High plus aggressively blocks unknown files, but may negatively impact device performance. Zero tolerance blocks all unknown files from running.
Enable cloud-delivered protection	Get real-time protection when Windows Defender sends info to Microsoft about potential security threats. This feature works best with Prompt users to submit suspicious files to Microsoft set to automatically send files.
Actions on detected malware threats	Windows Defender automatically quarantines detected malware.
Enable Network Inspection Service	Helps protect devices against network-based exploits. Uses the signatures of known vulnerabilities from the Microsoft Endpoint Protection Center to help detect and block malicious traffic.
Exclude files with these extensions from scans and real-time protection	Define the types of files that users can open without scanning for security threats.
Exclude processes from scans and real-time protection	Define the types of processes that users can run without scanning for security threats.
Exclude directories from scans and real-time protection	Define the file locations that users can access without scanning for security threats.

Windows SmartScreen

Setting	What it does
Block users from overriding SmartScreen warnings about websites	Block users from ignoring and accessing websites blocked by the SmartScreen Filter.
Block users from overriding SmartScreen warnings about downloads from the web	Block students from ignoring and downloading unverified files that SmartScreen Filter warns about.
Enable SmartScreen to check for unrecognized apps and files	Enables SmartScreen to protect devices by checking for unrecognized apps.
Block users from overriding SmartScreen warnings about apps and files	Block students from dismissing SmartScreen warnings about potentially malicious files and apps.

Shared devices

Configure settings that control how teachers and students share devices.

Setting	What it does
Optimize devices for shared use	Configures recommended settings for shared devices, such as power and update management. Allows multiple students or teachers to sign in to the same device.
Block guest users	This option is only available when you enable Optimize devices for shared use. Block guest users from signing in to shared devices. When blocked, only domain users can sign in.
Block access to local storage	This option is only available when you enable Optimize devices for shared use. Block users from saving files to the device. When blocked, users can only save to the cloud.
Block fast user switching	Allow users to quickly switch between user accounts from the Start menu.

Remove built-in apps

When you select to optimize devices for shared use, these apps will be removed from teacher and student computers:

• Mixed Reality Viewer
• Weather
• Desktop App Installer
• Tips
• My Office
• Solitaire Collection
• Mobile Plans
• Windows Feedback Hub
• Xbox
• Groove Music
• Mail
• Calendar
• Skype

Updates and upgrade

Configure how devices receive updates and upgrades.

Updates

Setting	What it does
Branch readiness level	Choose if devices are on Current Branch or Current Branch for Business for Windows updates.
Configure how and when updates are installed	Set the updates and maintenance period for the installation of updates.
Days to defer feature updates after they become available (0-365)	Set how many days to wait to apply a feature update after it becomes available. For example, if set to 0 days, a feature update that's just become available will be immediately applied to your devices.
Days to defer quality updates after they become available (0-30)	Set how many days to wait to apply a quality update after it becomes available. For example, if set to 0 days, a quality update that's just become available will be immediately applied to your devices.
Days before deleting uninstall files (2-60)	After installing feature updates, Windows keeps the files necessary to uninstall the new build and revert to your previous one. Set how many days to wait to uninstall these files.
Block pausing Windows Update	Block user access to the Pause updates feature.
Allow students to see Windows 10 pre-release features	Choose if students can see pre-release features for settings, pre-release features for settings and experimentation, or no pre-release features.
Delivery optimization mode	Select how you want to deliver updates to devices.

Upgrade

Setting	What it does
Windows Edition to upgrade to	Upgrade the devices in this group to a different edition of Windows 10. Select the Edition to upgrade to and enter the Product key. This setting is not supported on devices running Windows 11 SE.
Switch out of S Mode	Previously referred to as Windows 10 S, S Mode is a more secure version of Windows 10. This setting lets users switch their devices out of S Mode. Keep in S Mode prevents them from making the switch. When in S mode, teachers and students can only browse with Microsoft Edge, and download apps from Microsoft Store.

User experience

Configure the user experience settings for:

• Device restrictions
• Lock screen and desktop
• Settings app
• Start menu

Device restrictions

Setting	What it does
Block camera	Block use of the device camera.
Block removable storage	Block the use of removable storage such as USB drives, SD cards, and external hard drives.
Block Cortana	Block Cortana, the digital assistant built into Windows 10 that can answer questions and perform tasks.
Block location services	Block apps from using location services to access the device’s location.
Block ending tasks in Task Manager	Block users from using Task Manager to force a program, process, or task to close.
Configure time zone	Choose what time zone to apply to devices.
Block changing date and time settings	Block users from changing the device date and time settings.
Block changing language settings	Block users from changing the device language.
Block changing device region settings	Block users from changing settings, such as country/region and language.
Send diagnostic data	Define whether to collect and send anonymous usage data to Microsoft to help improve Windows.

Lock screen and desktop

Setting	What it does
Set custom lock screen image	Configure a custom background image on the sign-in screen. You can choose a .jpg or .png less than 20 MB in size.
Set custom desktop image	Configure a custom background image on the desktop. You can choose a .jpg or .png less than 20 MB in size.
Block Windows Spotlight	Block all Windows Spotlight features on these devices.
Block notifications on lock screen	Block notifications from appearing on the screen of a locked device.
Block Cortana on lock screen	Prevent users from accessing Cortana from the lock screen.

Settings app

Setting	What it does
Block access to the Settings app	Block user access to the entire Settings app. To block only parts of the app, select from the other settings in this section.
System settings	Block display, notifications, apps, power settings.
Devices	Block Bluetooth, printers, and more.
Network & Internet	Block Wi-Fi, airplane mode, and VPN.
Personalization	Block background, lock screen, and color modifications.
Accounts	Block user accounts, email, sync, work, and other people.
Time & language	Block size, region, and date.
Ease of Access	Block Narrator, magnifier, and high contrast.
Privacy	Block location and camera.
Update & security	Block Windows Update, recovery, and backup.
Apps	Block uninstall, defaults, and optional features.
Gaming	Block game bar, DVR, broadcasting, and Game Mode.

Start menu

Setting	What it does
Force Start menu size	Define whether to force the Start menu to appear full screen.
Block Jump Lists in Start menu from showing recently opened programs	Block Jump Lists from appearing on Start menu, and disable the corresponding toggle in the Settings app.
Block showing recently added apps in Start menu	Block recently added apps from showing in the Start menu.
Block showing the most used apps in Start menu	Block the most used apps from showing in the Start menu.
Block app list in Start menu	Block the list of all apps on the device from showing in the Start menu.
Block power menu in Start menu	Block the power menu (for example, Restart, Shut down) from showing in the Start menu.
Block user tile in Start menu	Block the current user’s information from being shown in the Start menu.
Block options from appearing on the user tile in Start menu	You can choose Change account settings, Lock, and Sign out.
Choose folders that appear in Start menu	You can choose File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal Folder.
Apply custom Start menu layout	Apply a custom Start menu layout using an XML file. You can upload an .xml file less than 2 MB in size. This setting is not supported on devices running Windows 11 SE. To change the default pinned apps for Windows 11 SE, customize the layout using the ConfigureStartPins policy in Microsoft Intune.
Pin websites as tiles in Start menu	Pin websites as tiles in the Start menu using an XML file. You can upload an .xml file less than 2 MB in size.

Next steps

Configure your group, app, and device settings in the Intune for Education portal. If you haven't yet done it, go to express configuration and set up your school with Microsoft-recommended settings.

Need help with managing devices? Assign group admins in your school to help you manage device settings. You can also find out more about the full Windows 10 settings management experience available in Intune.