Every Windows 11 fleet has the same problem: the Start menu ships with Microsoft's defaults — recommendations, recently added apps, account notifications, and a power button that gives users a full shutdown option on shared devices. If you want to control any of that centrally, you need to know which settings are CSP-deployable through Intune, which are GPO-only and require domain join, and exactly what OMA-URI path, data type, and value to punch in. This post gives you all of it, section by section, with verification commands you can run the moment the policy lands.
CSP vs GPO: The distinction that breaks Intune admins
Before you touch a single setting, you need to understand the deployment boundary. Intune MDM can only deploy policies via Configuration Service Provider (CSP) paths. It cannot deploy Group Policy Object (GPO) settings — those require domain join and a Group Policy engine. They are two completely separate stacks.
This matters because Microsoft's Start menu documentation lists some settings as GPO-only with no CSP equivalent. If you try to recreate one of those via OMA-URI, nothing will happen — no error, no policy conflict, just silence. The setting does not apply.
Everything else in this post is CSP-deployable. The pattern is always:
- Device-scope CSP:
./Device/Vendor/MSFT/Policy/Config/Start/PolicyName - User-scope CSP:
./User/Vendor/MSFT/Policy/Config/Notifications/PolicyName - Data type: Integer (0/1) for most toggles; String for JSON payloads like ConfigureStartPins
Layout tab policies
The Layout tab is where most of the work lives. These policies control what appears on the Start menu surface itself — pinned apps, the recommended section, recently added apps, and the app list.
ConfigureStartPins — pinning apps via JSON
This is the most powerful and most misunderstood policy in the Start menu CSP stack. It replaces the default pinned layout with a JSON payload that specifies exactly which apps appear pinned. Any app not in your JSON is removed from the pinned area.
CSP path: ./Device/Vendor/MSFT/Policy/Config/Start/ConfigureStartPins
Data type: String
Value: JSON payload
Example JSON payload pinning Calculator and Edge:
"pinnedList": [
{ "packagedAppId": "Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" },
{ "packagedAppId": "Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe!App" },
{ "packagedAppId": "Microsoft.CompanyPortal_8wekyb3d8bbwe!App" }
]
}
To find the packagedAppId for any installed app, run this on a reference device:
Get-AppxPackage -AllUsers | Select-Object -Property Name, PackageFamilyName | Sort-Object Name
# For a specific app — e.g. Company Portal
Get-AppxPackage -AllUsers -Name "*CompanyPortal*" | Select-Object PackageFamilyName
The packagedAppId format is PackageFamilyName!AppUserModelId. For most Microsoft apps the AppUserModelId is simply App, but some apps use a different suffix — check with Get-StartApps if you are unsure.
After the policy applies, verify the registry write:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start" -Name "ConfigureStartPins" -ErrorAction SilentlyContinue
# If MDM applied it, you will also see the effective value here:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "LockedStartLayout" -ErrorAction SilentlyContinue
Layout tab — remaining CSP policies
All of the following are Integer data type with values 0 (disabled/not configured) and 1 (enabled/hidden) unless otherwise noted.
Account options tab
These policies control what users see when they click their account tile in the bottom-left of Start — sign out, lock, switch user, change account settings. A critical distinction: these are mostly Device-scope CSPs except DisableAccountNotifications which is User-scope.
Verify the account option policies via registry:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start" | Select-Object HideSignOut, HideSwitchAccount, HideLock, HideUserTile, HideChangeAccountSettings
# Check Fast User Switching (different CSP node)
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsLogon" -Name "HideFastUserSwitching" -ErrorAction SilentlyContinue
# Trigger manual MDM sync if policy has not yet arrived
$session = New-CimSession
Invoke-CimMethod -Namespace "root\cimv2\mdm\dmmap" -ClassName "MDM_Client" -MethodName "TriggerSynchronization" -Arguments @{ RelativeUserPath = "" } -CimSession $session
Pinned folders tab
The Pinned Folders tab controls which Windows shell folders appear as icons next to the power button at the bottom of Start — Documents, Downloads, File Explorer, Music, Network, Personal folder, Pictures, Settings, and Videos. All of these are CSP-only. There is no GPO equivalent for any of them.
All pinned folder policies sit under: ./Device/Vendor/MSFT/Policy/Config/Start/
Value 65535 (0xFFFF) is the "not configured" state — it removes any previously applied enforcement and returns the folder to Windows default visibility. Use 0 to explicitly hide, 1 to explicitly show, and 65535 to undo a prior policy without forcing either state.
Power options tab
Power option policies control what appears in the power button flyout at the bottom-right of Start: hibernate, lock, restart, shut down, and sleep. All are CSP-deployable via Intune except one.
For kiosk devices where users should not be able to shut down or restart the machine via Start, deploy HidePowerButton=1 to hide the entire flyout. For shared workstations where locking is fine but shutdown is not, set HideShutDown=1 and HideRestart=1 while leaving Sleep and Lock available.
Deploying via Intune OMA-URI — step by step
Navigate to the Intune admin center at intune.microsoft.com:
- Set Platform to Windows 10 and later.
- Set Profile type to Custom.
- Give the profile a name — for example Win11 Start Menu — Layout controls.
- Under Configuration settings, click Add for each policy row.
- For each row: enter a descriptive Name, paste the full OMA-URI path, set Data type (Integer or String), and enter the Value.
- Save and assign to a device group. Use device groups for Device-scope CSPs, user groups for User-scope CSPs.
Verifying policy applied — registry and event log
After Intune delivers the policy (allow up to 8 minutes for the MDM sync cycle or trigger manually), verify the settings landed using the MDM policy hive:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Start"
# Check Search CSP (DisableSearch is under Search node, not Start)
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Search" -Name "DisableSearch" -ErrorAction SilentlyContinue
# Check effective GPO-applied Start policies (different hive from MDM)
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -ErrorAction SilentlyContinue
# Query MDM event log for Start policy activity and errors
Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" -MaxEvents 200 |
Where-Object { $_.Message -match "Start" } |
Select-Object TimeCreated, Id, @{N="Msg";E={$_.Message.Substring(0,[Math]::Min(120,$_.Message.Length))}} |
Format-Table -AutoSize
A value of 1 in the MDM hive for any Hide* policy confirms the CSP was received and written. If the property does not exist, the policy has not yet arrived — check the profile assignment status in Intune for that specific device.
Successful application produces events in the 400 range showing the CSP path and value written. The two most common failure codes are:
- 0x87D1041C — device has not yet checked in to receive the policy. Wait for the next sync cycle or trigger manually.
- 0x80070057 — invalid value format. This almost always means a String value was entered as Integer data type, or vice versa. ConfigureStartPins must be String; all Hide* policies must be Integer.
Build order recommendation
If you are building a Start menu policy profile from scratch, apply settings in this order to catch problems early:
- Deploy ConfigureStartPins first on a pilot ring of five devices. This is the highest-impact change — test before broadening.
- Add HideRecommendedSection and HideAppList for a minimal Start experience.
- Layer in Power option policies based on device type: HidePowerButton=1 for kiosks, HideShutDown=1 + HideRestart=1 for shared workstations.
- Add Account option policies last — HideSwitchAccount and HideFastUserSwitching affect session management. Test with helpdesk before fleet-wide rollout.
- Pinned folder policies can go in the same profile as power options — they are low-risk and easy to reverse with value 65535.
References
- Microsoft Learn — Start policy settings (Windows 11)
- Microsoft Learn — Policy CSP: Start (full node reference)
- Microsoft Learn — Policy CSP: Search (DisableSearch node)
- Microsoft Learn — Policy CSP: WindowsLogon (HideFastUserSwitching)
- Microsoft Learn — Use custom settings for Windows 10/11 devices in Intune
- Microsoft Learn — Policy CSP: Notifications (DisableAccountNotifications)
The scripts referenced in this post are published in the Windows-Patching-Scripts repository on GitHub.