Every screen your users see can now become a permanent, searchable record, unless you tell Windows otherwise.
Windows Recall is a built-in AI capability that periodically captures snapshots of on-screen activity to help users search their past actions. It is powerful for productivity, but it was never designed to distinguish between a shopping list and a payroll spreadsheet.
Without guardrails, Recall can silently capture finance dashboards, HR records, legal documents, or privileged admin consoles, storing them locally where a compromised account or stolen device could expose months of sensitive context in seconds.
The SetDenyAppListForRecall setting lets administrators define a deny list of applications that Windows must exclude from Recall snapshots, based on executable name or Application User Model ID (AUMID).
Enforcing this exclusion list through Microsoft Intune ensures every managed endpoint applies the same deny list, regardless of user preference, department, or device configuration drift.
The result is an environment where Recall remains a useful productivity feature for general activity, while sensitive line-of-business applications are never captured or retained as snapshots.
Why This Policy Matters
Attackers increasingly target locally cached data, because it bypasses network-level defenses entirely. Recall snapshots stored on disk are exactly the kind of artifact that post-compromise data mining thrives on.
This setting closes that gap at the source, stopping sensitive application windows from ever entering the Recall snapshot pipeline in the first place.
Without this policy:
- Finance, HR, or legal application screens can be captured and stored as searchable snapshots on the local disk
- A stolen or compromised device can expose months of confidential business activity through Recall history
- Users have no consistent way to know which apps are silently excluded, leading to inconsistent trust in the feature
- Sensitive files can be reconstructed from screenshots with no record of when or how the exposure occurred
With this setting enforced through Intune:
- Designated sensitive applications are automatically excluded from every Recall snapshot cycle
- Data retention at the OS level is reduced for high-risk business applications
- The deny list is applied uniformly across all managed devices without relying on user action
- Users can still add personal exclusions on top of the enforced baseline, without weakening it
This configuration aligns with modern security principles such as defense in depth, endpoint hardening, proactive threat detection, and Zero Trust architecture.
Security Governance
Security governance ensures that hardening controls are consistently applied, monitored, and aligned with organizational standards.
Without centralized governance, settings such as this one can drift across devices, leaving blind spots that attackers can exploit.
Managing the Set Deny App List For Recall setting through Microsoft Intune brings several governance benefits:
- Centralized enforcement of the control across all managed Windows endpoints
- Consistent configuration aligned with corporate security baselines
- Clear visibility into deployment status and configuration compliance
- Defined ownership and accountability through scope tags and role-based administration
- An auditable policy lifecycle from creation to enforcement and validation
This level of governance ensures that the control is handled in a controlled and transparent manner, reinforcing compliance with internal security policies and regulatory frameworks.
Windows CSP Overview
This section explains how the setting is exposed at the operating system level and how Microsoft Intune interacts with it. The configuration is powered by the Windows Policy Configuration Service Provider (CSP) framework, specifically the WindowsAI area.
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ✅ User | ❌ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later |
This policy allows you to define a list of apps that won't be included in snapshots for Recall.
Users will be able to add additional applications to exclude from snapshots using Recall settings.
The list can include Application User Model IDs (AUMID) or name of the executable file.
Use a semicolon-separated list of apps to define the deny app list for Recall.
For example: code.exe;Microsoft.WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe
This setting applies to Enterprise and Education client SKUs only. When configuring this policy setting, changes won't take effect until the device restarts.
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework.
| Property name | Property value |
|---|---|
| Format | chr (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | List (Delimiter: ;) |
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
| Name | Value |
|---|---|
| Name | SetDenyAppListForRecall |
| Friendly Name | Set a list of apps to be filtered from snapshots for Recall |
| Location | Computer and User Configuration |
| Path | Windows Components > Windows AI |
| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI |
| Registry Value Name | SetDenyAppListForRecall |
| ADMX File Name | WindowsCopilot.admx |
Security Considerations
Before enabling this policy, administrators should understand how it behaves and plan for its impact.
- The list must be built and maintained carefully, using the correct AUMID or executable name for each application, otherwise the exclusion silently fails to match
- Adding a large number of applications does not measurably affect Recall performance, but it does require periodic review as line-of-business apps are added, renamed, or retired
- This setting is only enforced on Windows 11 24H2 and later with the required cumulative update, and only on Enterprise and Education editions, so coverage should be validated against your device inventory
- A restart is required for the exclusion list to take effect, so plan the rollout with a maintenance window or expect a delay in enforcement
A phased, pilot-first deployment is recommended to validate the behavior in a controlled group and avoid unexpected impact before rolling the setting out across production devices.
How to Configure Set Deny App List For Recall Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that sensitive applications are consistently excluded from Recall snapshots across all managed Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshots.
Create the Configuration Profile
In the Microsoft Intune admin center:
- Navigate to Devices › Windows › Configuration
- Select + Create policy
In the Create a profile pane:
- Platform: Windows 10 and later
- Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that excludes sensitive applications from Recall snapshots.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future. As shown in the screenshot, configure the fields as follows.
The Platform field is already pre-selected as Windows, so no changes are required. Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows setting you want to enforce. To open the Settings picker panel, click Add settings.
By default, this setting is not configured, meaning Windows applies no application exclusions and Recall may capture activity from any running application, including sensitive line-of-business tools.
In the search field at the top of the Settings picker, type Set Deny App List For Recall, and then click Search to filter the results.
From the returned results, select the category Windows AI, and then choose the setting Set Deny App List For Recall. Once selected, the setting is automatically added to the configuration profile. Back on the configuration page, change the value from its default state to onenote.exe;quicken.exe;Contoso.HRPortal_8wekyb3d8bbwe!App.
When enabled, Windows checks every application against the deny list before capturing a Recall snapshot, and skips the capture entirely whenever a match is found. This ensures that:
- Finance, HR, and legal applications listed in the value are never included in Recall snapshots
- Sensitive on-screen activity is excluded from local storage, reducing the exposure surface if a device is lost or compromised
- The organization retains evidence of intentional data protection controls, supporting audit and compliance reviews
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
- Restrict policy visibility to specific IT roles or teams
- Enforce administrative separation of duties
- Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Windows Recall App Exclusions
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group: GRP – MS365Education – Test Computers.
Once the group is selected, verify the following:
- The group appears under Included groups
- The group status is Active
- No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening objective.
Pay special attention to the following items:
- Policy name and description: confirm that the policy clearly reflects its purpose, excluding sensitive applications from Windows Recall snapshots
- Configuration settings: verify that Set Deny App List For Recall is set to onenote.exe;quicken.exe;Contoso.HRPortal_8wekyb3d8bbwe!App, under Windows AI
- Scope tags: ensure the correct scope tag is assigned. In this example, the Default scope tag is used
- Assignments: confirm the policy is assigned to the intended group, GRP – MS365Education – Test Computers, and that no unintended exclusions are configured
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Windows Recall App Exclusions configuration profile, the next step is to verify its deployment status. This validation confirms that the policy has been successfully applied and that sensitive applications are excluded from Recall snapshots on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
- Triggering a manual device sync from the Company Portal
- Initiating a sync directly from the Microsoft Intune admin center
Intune provides clear indicators to evaluate the policy deployment status: Succeeded (devices have applied the policy), In progress (devices are still processing), Error (the policy failed and requires investigation), and Not applicable (the device does not support the configuration).
When devices report Succeeded, it confirms that the deny app list is active on the endpoint, ensuring that designated sensitive applications are no longer captured in Recall snapshots.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the policy was successfully applied. Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
- Open Event Viewer on the target device
- Navigate to Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin
- Select Filter Current Log
- Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
- Open the event details and confirm that the WindowsAI setting was applied
For deeper validation, you can confirm the effective setting directly on the device. Open the registry path HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI and inspect the SetDenyAppListForRecall value, confirming it matches the semicolon-separated list configured in Intune. Alternatively, open Recall settings from Windows Settings and verify that the excluded applications appear under the app exclusion list.
Remember that the device requires a restart before the updated deny list takes effect, so validate enforcement only after the target device has rebooted following the sync.
Why This Matters for Endpoint Security
AI-driven capabilities like Windows Recall reshape the attack surface of the endpoint itself, turning ordinary screen activity into a persistent, locally stored data source.
Without app-level exclusions, the blind spot is total: any application on screen, including confidential finance dashboards or HR case management tools, can end up embedded in a snapshot that outlives the session that created it.
By enforcing Set Deny App List For Recall through Microsoft Intune and validating the configuration locally, organizations ensure that:
- Sensitive line-of-business applications never generate Recall snapshots, regardless of user behavior
- Local data retention is minimized in alignment with data protection and compliance requirements
- The control operates consistently across the entire managed fleet, not on a per-device or per-user basis
- Recall remains available as a productivity feature without becoming a liability for regulated or confidential workloads
This configuration provides strong security value without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
AI features that persist activity locally must be scoped as carefully as any other data protection control, not treated as an afterthought.
Enforcing Set Deny App List For Recall through Microsoft Intune guarantees that sensitive applications are excluded from Recall snapshots on every managed device, without depending on individual user configuration.
Combined with centralized deployment and client-side validation, the organization gains a documented, auditable control over exactly what Recall is and is not allowed to remember.
And in modern security architecture, controlling what an AI feature is permitted to capture is not optional, it is essential.
More Information
For additional technical details, refer to the official Microsoft documentation below:
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#setdenyapplistforrecall
- https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you for reading!
🖥️ Ricardo Barbosa
🏆️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect | 💼 Technology Director at Altelix.com
💬 Follow me for more Windows endpoint hardening and Intune content.