Intune Windows 11 25H2 Settings: Block Recall, Bin the Bloatware and Tame Copilot

Published 29 October 2025 · Intune · Last reviewed 4 October 2026

1,052 recorded views?

Intune Windows 11 25H2 settings are the difference between a fleet you control and a fleet that quietly installs Solitaire, asks users about Recall and pins Copilot wherever it can. Every Windows release adds new policy, and the Settings Catalog is where it lands first.

I originally covered this in two separate posts, which meant two half-answers and one confused search engine. This is the merged, updated version. It covers the Windows AI controls (Recall, Click to Do, deny lists), the Copilot app, removing default Store apps, Start pins, widgets, Energy Saver and Windows Backup for Organizations.

Windows 11 26H2 reached general availability on 29 September 2026, so I have framed this as the 25H2-era settings that still apply on 24H2, 25H2 and 26H2. They share one servicing branch, so nothing here expires because a new version number turned up. Put the kettle on, this one has tables.

Never miss a guide: subscribe here and check out my YouTube channel.

The short version (for anyone reading this between two Teams calls)

Recall arrived on Copilot+ PCs with Windows 11 24H2, not 25H2. It is removed by default on managed devices, and Allow Recall Enablement set to “Recall is not available” keeps it that way.
Turn Off Copilot in Windows is deprecated and does not touch the new Copilot app. Use RemoveMicrosoftCopilotApp (Enterprise and Education, 24H2 or later) or AppLocker.
Removing default Microsoft Store apps by policy works on Enterprise, Education and IoT Enterprise only, version 24H2 or later, targeted at devices.
Configure Start Pins takes a JSON layout. applyOnce true sets it once; false resets it at every sign-in.
Windows Backup for Organizations uses Microsoft Entra accounts, not personal Microsoft accounts. Compliance policies report, they do not configure Energy Saver.
Pilot everything with assignment filters on OS version and edition before going tenant-wide.

In this guide

If you prefer watching to reading, I walk through the Recall, Copilot and bloatware settings in my lab here:

What changed for Intune Windows 11 25H2 settings

The Settings Catalog is the one place in the Microsoft Intune admin centre where new Windows policies appear, usually long before anyone updates an ADMX template on a file share. Around the 25H2 release, a batch of new settings landed for Windows AI, Start, widgets, power and backup.

A couple of myths need putting down gently. Recall was not a 25H2 feature: it reached general availability on Copilot+ PCs in April 2025 on Windows 11 24H2. Windows 11 25H2 was delivered as an enablement package on top of 24H2, so most of the “new” features had already arrived through monthly updates.

The same is true of 26H2, which went GA on 29 September 2026 as another enablement package for 24H2 and 25H2 devices. In practice, the Intune Windows 11 25H2 settings below apply across all three versions, with the edition and build caveats in the tables. If you are still planning the upgrade itself, my Windows 11 25H2 guide covers what changed.

Good to know: 26H2 turns on Windows settings backup by default for eligible commercial devices, but existing policies you have configured are still honoured. If you deliberately disabled backup, your policy wins.

Prerequisites and licensing

None of the Intune Windows 11 25H2 settings need an exotic licence, but the Windows edition matters far more than people expect. Half the Windows AI controls simply ignore Windows Pro, and the device report will say “Not applicable” with the calm of someone who knows they are right.

Requirement	Detail
Intune licence	Intune Plan 1, included in Microsoft 365 E3, E5 and Business Premium
Admin role	Intune Administrator, or a custom role that can create and assign device configuration profiles
Windows edition	Enterprise or Education for the storage, deny list, Copilot removal and Store app removal settings. Pro covers the basics such as Allow Recall Enablement
Windows version	Windows 11 24H2 or later for most settings (Recall policies need the April 2025 update, KB5055627, or later)
Hardware	A Copilot+ PC for Recall and Click to Do to exist at all
Join type	Microsoft Entra joined or Microsoft Entra hybrid joined for backup; Microsoft Entra joined for restore at enrolment

Business Premium devices usually run Windows Pro, so check the edition column before you promise anyone that Clipchamp will vanish.

The Intune Windows 11 25H2 settings worth knowing

Here are the 12 settings I would actually look at first, grouped by area. Setting names in the catalog follow the CSP names closely, so searching for the CSP name is the quickest way to find each one.

Windows AI: Recall, Click to Do and Paint

Setting (CSP)	Scope	Editions	What it does
AllowRecallEnablement	Device	Pro, Enterprise, Education	Controls whether Recall is available. Disabling it removes the Recall bits and deletes existing snapshots after a restart
DisableAIDataAnalysis	Device and user	Pro, Enterprise, Education	Turns off saving snapshots for Recall. Admins cannot switch snapshots on for users; that needs user consent
SetMaximumStorageSpaceForRecallSnapshots	Device and user	Enterprise, Education	Caps snapshot storage at 10, 25, 50, 75, 100 or 150 GB
SetMaximumStorageDurationForRecallSnapshots	Device and user	Enterprise, Education	Keeps snapshots for 30, 60, 90 or 180 days
SetDenyAppListForRecall / SetDenyUriListForRecall	Device and user	Enterprise, Education	Semicolon-separated apps or URLs never captured in snapshots. Takes effect after a restart
DisableClickToDo	Device and user	Pro, Enterprise, Education	Removes Click to Do and its entry points
DisableCocreator, DisableGenerativeFill, DisableImageCreator	Device	Pro, Enterprise, Education	Turns off the AI features in Paint

Copilot, apps, Start, power and backup

Setting (CSP)	Scope	Editions	What it does
RemoveMicrosoftCopilotApp	Device and user	Enterprise, Education	Uninstalls the Microsoft Copilot app in a targeted way (conditions below)
SetCopilotHardwareKey	User	Pro, Enterprise, Education	Chooses which app the Copilot key opens, using its AUMID
RemoveDefaultMicrosoftStorePackages	Device	Enterprise, Education, IoT Enterprise	Removes selected preinstalled Store apps and stops them coming back
ConfigureStartPins	Device and user	Pro, Enterprise, Education	Deploys a JSON list of pinned Start apps
AllowNewsAndInterests, DisableWidgetsBoard, DisableWidgetsOnLockScreen	Device	Pro, Enterprise, Education	Turns off widgets entirely, the board, or just the lock screen widgets
EnableEnergySaver	Device	Pro, Enterprise, Education	Sets Energy Saver to always on
EnableWindowsBackup / EnableWindowsRestore	Device	See backup section	Windows Backup for Organizations for settings and Store app lists

How to configure Intune Windows 11 25H2 settings in 7 steps

I build Intune Windows 11 25H2 settings as a handful of small profiles rather than one giant “Windows 11 everything” policy. When something breaks at 4:55pm on a Friday, you want to know which profile to blame without reading 140 settings.

Step 1: Create a Settings Catalog profile

Sign in to the Microsoft Intune admin centre.
Go to Devices > Manage devices > Configuration > Create > New policy.
Choose Windows 10 and later as the platform and Settings catalog as the profile type.
Give it a clear name, for example “WIN-WindowsAI-BlockRecall”.

Create a profile: Windows 10 and later, Settings catalog. The easy bit.

Select Add settings to open the settings picker. Search for a CSP name or a category such as “Windows AI”.

The settings picker, searching for Recall in the Windows AI category.

Step 2: Block Recall with Windows AI settings

On managed devices, Recall is removed by default and users cannot turn it on themselves. Setting the policy explicitly still matters, because it turns an assumption into something you can audit when the head teacher rings asking about “that screenshot thing”. This is the Intune Windows 11 25H2 settings change I would make first.

Add Allow Recall Enablement and set it to “Recall is not available”.
Add Disable AI Data Analysis and enable it, so snapshots are never saved even if Recall is allowed later.
Add Disable Click To Do if you want the screen-analysis shortcut gone too.
Save and assign to a device group.

Allow Recall Enablement set to “Recall is not available”. Dave from accounts will survive.

If you are piloting Recall instead, leave it available and use the storage cap, retention period and deny lists. Banking portals, HR systems and your password manager are sensible first entries on the deny lists.

Gotcha: disabling Allow Recall Enablement removes the Recall component and deletes any snapshots on the device, and the removal needs a restart. Warn your pilot users before you change your mind.

Step 3: Deal with the Copilot app properly

The old Turn Off Copilot in Windows (User) setting, TurnOffWindowsCopilot, is deprecated. Its CSP page says it is not for the new Copilot app experience, so on current builds it does not remove or block the app. If your old profile still has it, that profile is doing roughly as much as a Windows 98 screensaver.

Use one of these instead:

RemoveMicrosoftCopilotApp (Enterprise and Education, 24H2 or later). It uninstalls the Microsoft Copilot app only when Microsoft 365 Copilot is also installed, the user did not install Copilot themselves, and it has not been launched in the last 28 days. Users can reinstall it.
AppLocker, to stop the app installing at all. Microsoft recommends this over the legacy policy, using a packaged app rule for publisher CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US and package name MICROSOFT.COPILOT.
SetCopilotHardwareKey, if you just want the Copilot key on new keyboards to open something useful. The value is the AUMID of the target app.

Tip: Microsoft 365 Copilot in Word and Excel is a separate product with separate controls. Blocking the consumer Copilot app does not touch it, which is usually exactly what you want. For unsanctioned AI tools, see my Shadow AI in Microsoft 365 guide.

Step 4: Remove default Microsoft Store apps

Policy-based removal of preinstalled Store apps is the feature I have wanted since Candy Crush first appeared on a domain-joined laptop. It needs Windows 11 24H2 or later on Enterprise, Education or IoT Enterprise, and it must be assigned to devices, not users.

In a new Settings Catalog profile, go to Administrative Templates > Windows Components > App Package Deployment.
Add the removal setting. Depending on when your tenant picked up the update, it appears as “Remove Default Microsoft Store packages from the system” or “Remove Microsoft Store apps with dynamic list”.
Set each app you want gone to True. The list includes Xbox components, Solitaire, News, Weather, Clipchamp, Microsoft Copilot and more.
Add extra package family names in “Specify additional package family names to remove” if you need to.
Assign to a device group and sync.

App Package Deployment: flick the toggles to True for the apps you never want to see again.

Removal happens at the next user provisioning or sign-in, and removed apps stay blocked while the policy is active. Find a package family name with PowerShell:

Get-AppxPackage *Clipchamp* | Select-Object Name, PackageFamilyName

Gotcha: setting an app back to False does not reinstall it. You have to reprovision it from the Store or as an Intune app. Leave Photos, Calculator, Notepad and Snipping Tool alone unless you enjoy tickets.

Step 5: Set Start pins with JSON

Configure Start Pins (device) and Configure Start Pins (User) take the content of a LayoutModification.json file. Pin your apps on a reference device, then export the layout:

Export-StartLayout -Path "C:\Layouts\LayoutModification.json"

Here is a cut-down example using the documented schema. Paste the JSON text into the setting value; there is no file upload.

{
  "applyOnce": true,
  "pinnedList": [
    { "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" },
    { "packagedAppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" },
    { "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk" },
    { "packagedAppId": "Microsoft.WindowsTerminal_8wekyb3d8bbwe!App" },
    { "packagedAppId": "Microsoft.OutlookForWindows_8wekyb3d8bbwe!Microsoft.OutlookforWindows" }
  ]
}

With applyOnce set to true, the list applies once and users can rearrange it afterwards. With false, it is reapplied at every sign-in and wipes user changes, which suits kiosks, exam rooms and shared devices. The applyOnce property needs Windows 11 24H2 with KB5062660 or later and is ignored on older builds.

Step 6: Widgets, Energy Saver and Windows Backup

These are the quieter Intune Windows 11 25H2 settings, but they save a surprising number of conversations.

Widgets: set Allow widgets (AllowNewsAndInterests) to Not allowed to remove the whole experience, or use Disable Widgets Board and Disable Widgets On Lock Screen for a lighter touch.
Energy Saver: Enable Energy Saver to Always Be On (EnableEnergySaver) in the Power area. The battery threshold settings depend on it being enabled.
Backup: Enable Windows Backup, under Administrative Templates > Windows Components > Sync your settings.
Restore: Devices > Enrollment > Windows > Windows Backup and Restore, then set Show restore page to On. This is tenant-wide and needs the Intune Service Administrator role.

Windows Backup for Organizations works with Microsoft Entra accounts on Microsoft Entra joined and hybrid joined devices, not with personal Microsoft accounts. Restore at enrolment needs Microsoft Entra joined devices and user-driven Autopilot, not self-deploying mode. I go deeper on restore in my Settings Catalog Windows Restore guide.

Step 7: Assign with filters and pilot first

Assign each of your Intune Windows 11 25H2 settings profiles to a pilot group, then add an assignment filter so only supported devices get it. The operatingSystemVersion property is still in preview but handles version comparisons properly:

(device.operatingSystemVersion -ge 10.0.26100.0) and (device.operatingSystemSKU -in ["Enterprise", "Education"])

Build 26100 is 24H2, 26200 is 25H2 and 26300 is 26H2. One filter covers all three, so you do not need to rebuild anything for 26H2. For the upgrade side, see my update rings and feature updates guide and my video on deploying Windows 11 25H2 with Intune update rings.

Prove it worked

A green tick in the portal is nice. A green tick plus evidence from the device is what you want when someone from audit asks. Here is how I check Intune Windows 11 25H2 settings on a real device.

In the admin centre, open the profile and check Device and user check-in status. Look for Succeeded, and treat Not applicable as an edition or build problem.
On a device, open Devices > select the device > Device configuration to see each profile and its state.
On the client, check Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin for policy errors.
For app removal, check AppxDeployment-Server > Operational. Event 606 means removed, 614 means it failed, 762 means a blocked reinstall.

Lab device report: Recall, Store app removal, Copilot and widgets profiles. Succeeded proves the setting landed, not that a deprecated policy still does anything.

A quick PowerShell check on the device, run as administrator:

# Recall component state (Copilot+ PCs only)
Get-WindowsOptionalFeature -Online -FeatureName "Recall" | Select-Object FeatureName, State

# Windows AI policies Intune has written to the device
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsAI" -ErrorAction SilentlyContinue

# Store app removal policy and remaining packages
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackages" -ErrorAction SilentlyContinue
Get-AppxPackage -AllUsers | Select-Object Name, IsPartOfSystem | Sort-Object Name

Tip: if a device is stuck on Pending, use the Sync device action, then make a cup of tea. If you want a scheduled check across the estate, Intune Remediations can run the same commands and report back.

Gotchas

Edition mismatch. Most “Not applicable” results are Windows Pro devices receiving Enterprise-only settings. Check the edition before you check your sanity.

Deprecated Copilot policy. TurnOffWindowsCopilot only applies to the old Copilot in Windows pane. Remove it from your profiles so nobody assumes it is protecting anything.

Restarts. Deny lists for Recall and the removal of the Recall component only take effect after a restart. Users who never restart will keep their old state for a while.

Insider labels. Some CSP reference pages still list newer settings, such as DisableClickToDo, EnableEnergySaver and the widgets controls, against Insider builds. Pilot them on your current build before assuming they apply.

Compliance is not configuration. A compliance policy evaluates and reports device state; it does not switch on Energy Saver or any other setting. Configuration profiles do the configuring.

Intune and Group Policy together. On hybrid joined devices, applying the Store app removal through both Intune and a GPO gives unpredictable results. Pick one source per device.

Stale removal policy schemas. While the dynamic list update rolls out, keep your existing removal profile for older devices and put the new one in a separate profile, split by an OS version filter.

Should you deploy these Intune Windows 11 25H2 settings now?

Yes, for most of the Intune Windows 11 25H2 settings in this guide. Blocking Recall and Click to Do, removing the consumer Copilot app and clearing out preinstalled Store apps are low-risk, high-value changes, especially in schools and regulated organisations.

Start pins and widgets are taste decisions, so agree them with whoever owns the user experience before you deploy. Energy Saver always-on suits laptops more than desktops sitting on a power strip all day.

Do them in small profiles, pilot with filters, and keep the device report open for a week. The settings carry straight through to 26H2, so the work does not go stale when the next version number appears.

Intune Windows 11 25H2 settings FAQs

Is Recall new in Windows 11 25H2?

No. Recall reached general availability on Copilot+ PCs running Windows 11 24H2 in April 2025. It is removed by default on managed devices, and setting Allow Recall Enablement to “Recall is not available” keeps it that way.

Does Turn Off Copilot in Windows still work?

No, not for the current Copilot app. TurnOffWindowsCopilot is deprecated; use RemoveMicrosoftCopilotApp on Enterprise and Education devices running 24H2 or later, or an AppLocker rule to stop installation.

Can I remove default Microsoft Store apps on Windows 11 Pro?

No. Policy-based removal of preinstalled Store apps supports Enterprise, Education and IoT Enterprise on Windows 11 24H2 or later. Pro devices report the policy as Not applicable.

Do these settings still apply after upgrading to Windows 11 26H2?

Yes. Versions 24H2, 25H2 and 26H2 share a servicing branch, and 26H2 installs as an enablement package. Use an OS version filter such as 10.0.26100 or later rather than targeting a single version.

Can a compliance policy enforce Energy Saver?

No. Compliance policies evaluate device state; they do not configure it. Use the EnableEnergySaver setting in a Settings Catalog configuration profile.

Does Windows Backup for Organizations use personal Microsoft accounts?

No. It backs up settings and Store app lists for Microsoft Entra accounts on Microsoft Entra joined or hybrid joined devices. Restore during enrolment needs Microsoft Entra joined devices.