Deploying recommended “good practice” configuration profiles to manage the Windows 10 Start menu
Aim: Be aware of “good practice” guidance when deploying a Start menu layout to Windows 10 devices using Intune.
The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout.
Deploy a full Start layout so users cannot pin, unpin or uninstall apps from Start. Users can view and open all apps in the All Apps view but they cannot pin any apps to Start.
Deploy a partial Start layout to specify tile groups that cannot be changed, while allowing users to move those groups and also create and customize their own groups.
Example: let’s consider how to deploy Start menu settings for 1:1 student devices running Windows 10:
- Navigate to create a new configuration profile from the Endpoint Manager admin center, navigating to Devices > Configuration Profiles > (Add > Windows 10 and later > Templates >) Device restrictions to expand the settings related to Start
- Simply upload the .XML that was exported from an existing Windows 10 device
- Consider blocking “Fast user switching”
- Consider blocking “Switch Account“
Tip: When assigning the profile, you can add further “applicability rules” so if you have a mix of Windows 10 and Windows 11 devices in the same group, you can filter by OS version (currently 10.0.19046.0 and lower for Windows 10)
Related:
- https://learn.microsoft.com/en-us/windows/configuration/customize-and-export-start-layout
- https://learn.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management
OMA-URI reference (Windows 10 only):