Control whether nonadministrators can initiate app installations that require elevation.

Likely causes

• The path, device scope, integer format, or configured value does not match this CSP record.
• The setting is not applicable to the device edition, Windows build, management mode, or hardware.
• Assignment filters, exclusions, stale check-in, or another policy source changed the effective configuration.

Recommended fix

1. Test approved deployment channels such as Intune Company Portal.
2. Coordinate with Windows Installer and App Installer policies.
3. Avoid blocking required self-service workflows without an alternative.

Verify

1. Trigger a device sync, then wait for a new check-in rather than reading the previous report state.
2. Review the per-setting status and compare the profile, assignment, filter evaluation, and conflict details.
3. On Windows, correlate the fresh sync with DMEDP/Admin events and the MDM diagnostic report.
4. Verify the operating-system effect directly; a successful policy report is not always proof of the desired outcome.

Escalate when

• The current Microsoft CSP documentation lists the path/value as applicable but a freshly synced supported device still rejects it.
• Multiple devices fail with the same event or SyncML status after targeting and conflicts are eliminated.
• You can provide the policy JSON, assignments/filters, device build/edition, UTC sync time, per-setting status, and redacted diagnostics.