Windows 10: Standard user can install apps from microsoft store without admin permission

Hi,

Win10 Pro computer join to AzureAD and in windows there is one local admin user and one standard user. user login as standard user but can install apps from microsoft store without admin permission. When we run setup file to install application its asking for admin credential but if we install app from Microsoft store its installed and no asking for admin credential.


Could you please explain why this happen and how to restrict to install apps from Microsoft store for standard user.



Thanks,

Rocky

:)

 

Why do apps from the Microsoft store not require admin permission to install?

I noticed today when installing an app from the Microsoft store on my computer running Windows 10 that the app did not need administrator permission to install.

Normally when installing apps/programs from downloaded executables or installers the UAC window pops up to request my admin password before it is allowed to proceed. Even program updates often involve the UAC pop-up. I prefer things this way since my computer is occasionally used by people who I trust enough to use it, but not enough to install things or change important settings.

This question covers how to prevent users from installing apps from the store, but that's not what I'm wondering.

What is different about installing an app from the Microsoft store versus other methods that allows the app to install without admin permission? Is it that the installation process is different for those apps, or does the Store itself has special permissions?

 

Why do apps from the Microsoft store not require admin permission to install?

The group policy that defines this behavior only applies to legacy desktop applications.

This is only true if the process requires permissions the user does not already have. Even installing legacy desktop applications can be granted to a user within the User usergroup.

Universal Windows Programs (UWP) are sandboxed. The permission to install and remove these programs are handled by a different group policy.

The ability to launch Windows Store, install/remove UWP already installed on the system, is indeed its own permission seperate from your ability to install a legacy desktop WIN32 application.

 

microsoft app store

How to run apps that are downloaded from Microsoft app store on multiple PCs without downloading multiple times.