Close Menu
Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Facebook X (Twitter) Instagram
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    • Home
    • Intune
    • Windows
      • Modern Workplace
    • macOS
    • Android
    • iOS
    • Automation
      • Logic Apps
      • Intune Monitoring
      • GitHub
    • Security
      • Passwordless
      • Security
    • Speaking
    • About me
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Home»Intune»Control Windows 10 privacy settings with Intune [UPDATED]
    Intune

    Control Windows 10 privacy settings with Intune [UPDATED]

    Peter KlapwijkBy Peter KlapwijkNovember 10, 2017Updated:December 3, 201914 Mins Read

    Since the first day Microsoft released Windows 10 there is a lot to do about the data Microsoft is collecting from you when using this OS. A lot of those apps connect to the internet and you have no idea what data is collected
    In this blog I will show you how you can use Microsoft Intune to take control of the privacy settings on the company managed devices.

    Setting up Intune policies

    To block apps from accessing you information with Microsoft Intune we need to use CSP policies which you can find on docs.microsoft.com. We will first disable the Advertising ID. Look up for the right policy under Privacy. On the below screen you see Privacy/DisableAdvertisingId, this is part of the OMA-URI you need to set in the Intune configuration Profile. And you can see there are three options which you can set by providing one of the three corresponding numbers in the Intune policy.

    Now open the Azure portal and open the Intune tab. Choose Device configuration, Profiles and click on Create profile.
    Give the policy your preferred name, choose Windows 10 and later as platform en policy type is Custom. Next to OMA-URI settings click Add.

    Give the Row a name, as OMA-URI you see a complete OMA-URI (part of that we found on docs.microsoft.com), Data type is Integer and add the value 1 to Enable the setting.
    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Privacy/DisableAdvertisingID
    Data type: Integer
    Value: 1

    Now perform a sync with Intune on a managed Windows 10 device and switch over to Settings, Privacy, General. Let apps use advertising is switched off and greyed out. You also see a message some settings are managed by your organization.

    The next example is to block apps from accessing your location. On docs.microsoft.com you can find the policy and options you can set.
    Add an extra Row in your Intune policy and use these settings:
    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessLocation
    Data type: Integer
    Value: 2

    After syncing the setting from Intune, switch over to Location. Location service is switched off and greyed out.

    The third example is to stop apps from accessing the diagnostics information. Look up the policy we need for this; Privacy/LetAppsGetDiagnosticsInfo

    Add an extra Row in your Intune policy and use these settings:
    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsGetDiagnosticsInfo
    Data type: Integer
    Value: 2

    Perform a sync again and this is the result for Diagnostics.

    With these examples you are able to completely turn these privacy settings on or off. There are also policies to force allow or force deny an specific app access for example your Contacts. To Deny apps access to contacts you need to provide these apps Package Family Names, semi-colon separated.

    To get the Package Family Name for the Maps app, open PowerShell Get-AppxPackage -Name *maps*

    Use the PackageFamilyName in your Intune policy.
    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Privacy/LetAppsAccessContacts_ForceDenyTheseApps
    Data type: String
    Value: Microsoft.WindowsMaps_8wekyb3d8bbwe;Microsoft.Windows.Photos_8wekyb3d8bbwe

    When we now go to the Contacts tab you see the overall setting is not greyed out. The two apps are force denied, all other apps can be turn on/ off by the user.

    With these examples you should be able to take control over most of the Windows 10 privacy settings using Microsoft Intune.

    Update November 17th:

    Today I was setting up a Windows 10 configuration policy for one of our customers and I noticed two tabs under Device Restrictions one called Privacy and the other one Per-app privacy exceptions. I really have no idea since when these tabs are there, maybe they are completely new, maybe I just haven`t noticed them for weeks, but this makes life much easier when setting Windows 10 Privacy settings :).
    Below you can see almost all the privacy settings discussed before in this blog. On this tab you can set an Allow or Block for the mentioned app.

    When we open the second tab we can add separate apps by row and we can set an exception for every app.
    Again we need the Package Family Name you can query with PowerShell and the App name. Then you can choose per app if you want to Allow or Block the app, or Leave the user in control.

    EMS Intune Microsoft 365 Microsoft Endpoint Manager Security Windows 10
    Share. Facebook Twitter LinkedIn Email WhatsApp
    Peter Klapwijk
    • Website
    • X (Twitter)
    • LinkedIn

    Peter is a Security (Intune) MVP since 2020 and is working as Modern Workplace Engineer at Wortell in The Netherlands. He has more than 15 years of experience in IT, with a strong focus on Microsoft technologies like Microsoft Intune, Windows, and (low-code) automation.

    Related Posts

    Enable passwordless authentication to Windows 10 with Feitian security keys

    November 30, 2019

    Setup a Windows 10 kiosk device using Intune and AutoPilot

    May 4, 2019

    Deploy Heimdal Security with Microsoft Intune

    December 22, 2017
    View 1 Comment

    1 Comment

    1. Joshua Niland on September 10, 2022 11:11

      You have LetAppsGetDiagnosticsInfo rather than LetAppsGetDiagnosticInfo

      Reply
    Leave A Reply Cancel Reply

    Peter Klapwijk

    Hi! Welcome to my blog post.
    I hope you enjoy reading my articles.

    Hit the About Me button to get in contact with me or leave a comment.

    Awards
    Sponsor
    Latest Posts

    Create deployment ring groups for Microsoft Intune

    June 27, 2025

    Update Windows Defender during Windows Autopilot enrollments

    May 16, 2025

    Hide the “Turn on an ad privacy feature” pop-up in Chrome with Microsoft Intune

    April 19, 2025

    How to set Google as default search provider with Microsoft Intune

    April 18, 2025
    follow me
    • Twitter 4.8K
    • LinkedIn 6.1K
    • YouTube
    • Bluesky 1.5K
    Tags
    Administrative Templates Android Automation Autopilot Azure Azure AD Browser Conditional Access Edge EMS Exchange Online Feitian FIDO2 Flow Google Chrome Graph Graph API Identity Management Intune Intune Monitoring iOS KIOSK Logic Apps macOS MEM MEMMonitoring Microsoft 365 Microsoft Edge Microsoft Endpoint Manager Modern Workplace Office 365 OneDrive for Business Outlook Passwordless PowerApps Power Automate Security SharePoint Online Teams Windows Windows 10 Windows10 Windows 11 Windows Autopilot Windows Update
    Copy right

    This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors, or In The Cloud 24-7.

     

    Copyright © 2025 by In The Cloud 24-7/ Peter Klapwijk. All rights reserved, No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

    Shorthand; Don’t pass off my work as yours, it’s not nice.

    Recent Comments
    • Parth Savjadiya on Using Visual Studio with Microsoft Endpoint Privilege Management, some notes
    • Chris Johnson on Assign Deny Local Log On user right to an (Azure) AD group by using Microsoft Intune
    • Northernsky on Automatically wipe a Windows 10 device after a number of authentication failures
    • Henrik on Intune Driver update for Windows – Get applicable devices
    • Adam on Get notified on expiring Azure App Registration client secrets
    most popular

    Application installation issues; Download pending

    October 1, 2024

    Restrict which users can logon into a Windows 10 device with Microsoft Intune

    April 11, 2020

    How to change the Windows 11 language with Intune

    November 11, 2022

    Update Microsoft Edge during Windows Autopilot enrollments

    July 9, 2024
    Peter Klapwijk – In The Cloud 24-7
    X (Twitter) LinkedIn YouTube RSS Bluesky
    © 2025 ThemeSphere. Designed by ThemeSphere.

    Type above and press Enter to search. Press Esc to cancel.

    Manage Cookie Consent
    To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
    Functional Always active
    The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
    Preferences
    The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
    Statistics
    The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
    Marketing
    The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
    Manage options Manage services Manage {vendor_count} vendors Read more about these purposes
    View preferences
    {title} {title} {title}