Disabling App Installer breaks Intune-delivered Store Apps

[SkipToTheEndpoint]

Brief description of your issue

As of Intune 2304, management policies are available via the DesktopAppInstaller CSP, and all of the settings are Device scoped, thus written into HKLM.
Setting "EnableAppInstaller" to "Disabled" blocks Intune-delivered Store applications from installing.
This does not seem to impact app updates, and if the Store is user-accessible, application installs can still be triggered.

Steps to reproduce

Deploy the EnableAppInstaller setting configured to Disabled to a device via Intune, and attempt to install a Store application via the Company Portal.

Expected behavior

I would expect a System-context install to work correctly, but user-context to be blocked.
Ideally the CSP would support user-level scoping so as to have more granularity over the configuration.

Actual behavior

Any Store app delivered via Intune and regardless of installation context is met with a failure.

Environment

Windows: Windows.Desktop vl0.0.22621.3296
System Architecture: X64
Package: Microsoft.DesktopAppInstaller vl.22.10861.0

[tenent007963]

Just wondering if this issue has been rectified or not.

As of 2 Dec 2025, devices that has been configured with EnableAppInstaller:Disabled will have status

Client error occurred. (0x87D300CA)

when pushing client apps from Intune.

Is there no proper way to configure blocking user's install while allowing Intune's remote installation aside from enabling this CSP?

[gzick]

Guessing this has not been fixed yet as we are seeing the same thing. Doesn't appear to affect every app deployed by Intune but was trying to deploy the "Windows App" and it was giving us the "Client error occurred 0x87D300CA" error until we re-enabled the Desktop App Installer and then the app installed normally.