(191) Microsoft Intune - Multi-App Kiosk to Allow Store Apps to Run

My colleague had some issues around this persona build for a customer, my colleauge reached out to me to have a look. I enrolled a physical device and all checked out, when clicking on 'Photos' and 'Paint' on the start menu - it would try to load but never worked.

My colleague confirmed that he had whitelisted the XML to:

<App AppUserModelId="Microsoft.Paint_8wekyb3d8bbwe!App" />
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />

Which didn't work, till I did some digging through event viewer, in the logs it said:

Microsoft.Windows.Photos was allowed to be installed which was showing up in (51) Events Microsoft-Windows-AppLocker_Packaged_app-Deployment Events.evtx

Then I went to look at (52) Events Microsoft-Windows-AppLocker_Packaged_app-Execution Events.evtx, and the start has 'Calculator' on the start menu which worked.

Then I thought maybe my colleague didn't whitelist those paths, by default all 'Microsoft Store apps' are stored in C:\Program Files\WindowsApps once installed. I updated the XML with the following changes:

<App DesktopAppPath="C:\Program Files\WindowsApps\*" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2025.11110.18001.0_x64__8wekyb3d8bbwe\*" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2025.11110.18001.0_x64__8wekyb3d8bbwe\Photos.exe" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2025.11110.18001.0_x64__8wekyb3d8bbwe\Photos.AutoPlay.exe" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.Paint_11.2503.381.0_x64__8wekyb3d8bbwe\*" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.Paint_11.2503.381.0_x64__8wekyb3d8bbwe\PaintApp\*" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.Paint_11.2503.381.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.ZuneMusic_11.2510.7.0_x64__8wekyb3d8bbwe\*" />

<App DesktopAppPath="C:\Program Files\WindowsApps\Microsoft.ZuneMusic_11.2510.7.0_x64__8wekyb3d8bbwe\Microsoft.Media.Player.exe" />

After updating the changes to the Intune profile, restarted and logged back in. Photos and Paint was accessible on the multi-app kiosk