Share via


Policy CSP - WindowsAI

Logo of Windows Insider.

Important

This CSP contains some settings that are under development and only applicable for Windows Insider Preview builds. These settings are subject to change and may have dependencies on other features or services in preview.

AllowRecallEnablement

Scope Editions Applicable OS
✅ Device
❌ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later
./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallEnablement

This policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own.

  • If this policy isn't configured, end users will have the Recall component in a disabled state.

  • If this policy is disabled, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they'll be deleted when this policy is disabled. Removing Recall requires a device restart.

  • If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DisableAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users will be able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 1

Allowed values:

Value Description
0 Recall isn't available.
1 (Default) Recall is available.

Group policy mapping:

Name Value
Name AllowRecallEnablement
Friendly Name Allow Recall to be enabled
Location Computer Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name AllowRecallEnablement
ADMX File Name WindowsCopilot.admx

AllowRecallExport

Scope Editions Applicable OS
✅ Device
❌ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows Insider Preview
./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallExport

This policy allows you to determine whether users can export their own Recall and snapshot information. Exporting allows users to share their Recall and snapshot information with trusted apps or websites. Users can export from Settings > Privacy & security > Recall & snapshots > Advanced settings > Export snapshots > Export past snapshots > Export.

Users can also choose to continuously export their snapshots if they turn on the option to Export snapshots from now on from Settings > Privacy & security > Recall & snapshots > Advanced settings > Export snapshots > Export.

Before starting an export, the user must authenticate with Windows Hello and they're notified that their exported snapshots are encrypted since they might contain sensitive information. The user is also notified that they'll need to provide their Recall export code if they want to allow trusted apps or websites access to exported snapshots. The Recall export code is displayed to users during Recall setup even if this policy is set to disabled or not configured. For managed devices:

When you set this policy to enabled, users will be able to export Recall and snapshot information.

If the policy is set to disabled or not configured, users won't be able to export their Recall and snapshot information.

Important

This setting applies to devices in the European Economic Area (EEA) only. Export of Recall and snapshot information is a user-initiated process and is per user. IT admins or other users can't initiate an export on behalf of another.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Deny export of Recall and snapshots information.
1 Allow export of Recall and snapshot information.

Group policy mapping:

Name Value
Name AllowRecallExport
Friendly Name Allow export of Recall and snapshot information
Location Computer Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name AllowRecallExport
ADMX File Name WindowsCopilot.admx

DisableAIDataAnalysis

Scope Editions Applicable OS
✅ Device
✅ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis

This policy setting allows you to determine whether snapshots of the screen can be saved for use with Recall. For managed devices, snapshots for Recall aren't enabled by default. IT administrators can't, on their own, enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent.

  • If the policy isn't configured, snapshots won't be saved for use with Recall.

  • If you enable this policy, snapshots won't be saved for use with Recall. If snapshots were previously saved on the device, they'll be deleted when this policy is enabled.

If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Enable Saving Snapshots for Recall.
1 Disable Saving Snapshots for Recall.

Group policy mapping:

Name Value
Name DisableAIDataAnalysis
Friendly Name Turn off saving snapshots for use with Recall
Location Computer and User Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name DisableAIDataAnalysis
ADMX File Name WindowsCopilot.admx

DisableClickToDo

Scope Editions Applicable OS
✅ Device
✅ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows Insider Preview
./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableClickToDo
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableClickToDo

Click to Do lets people take action on content on their screens. When activated, it takes a screenshot of their screen and analyzes it to present actions. Click to Do ends when they exit it, and it can't take screenshots while closed. Screenshot analysis is always performed locally on their device. By default, Click to Do is enabled for users.

This policy setting allows you to determine whether Click to Do is available for users on their device.

When the policy is enabled, the Click to Do component and entry points won't be available to users.

When the policy is disabled, users will have Click to Do available on their device.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Click to Do is enabled.
1 Click to Do is disabled.

Group policy mapping:

Name Value
Name DisableClickToDo
Friendly Name Disable Click to Do
Location Computer and User Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name DisableClickToDo
ADMX File Name WindowsCopilot.admx

DisableCocreator

Scope Editions Applicable OS
✅ Device
❌ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 22H2 [10.0.22621.4870] and later
✅ Windows 11, version 24H2 [10.0.26100.3360] and later
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableCocreator

This policy setting allows you to control whether Cocreator functionality is disabled in the Windows Paint app.

  • If this policy is enabled, Cocreator functionality won't be accessible in the Paint app.

  • If this policy is disabled or not configured, users will be able to access Cocreator functionality.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Cocreator is enabled.
1 Cocreator is disabled.

Group policy mapping:

Name Value
Name DisableCocreator
Friendly Name Disable Cocreator
Location Computer Configuration
Path Windows Components > Paint
Registry Key Name Software\Microsoft\Windows\CurrentVersion\Policies\Paint
Registry Value Name DisableCocreator
ADMX File Name WindowsCopilot.admx

DisableGenerativeFill

Scope Editions Applicable OS
✅ Device
❌ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 22H2 [10.0.22621.4870] and later
✅ Windows 11, version 24H2 [10.0.26100.3360] and later
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableGenerativeFill

This policy setting allows you to control whether generative fill functionality is disabled in the Windows Paint app.

  • If this policy is enabled, generative fill functionality won't be accessible in the Paint app.

  • If this policy is disabled or not configured, users will be able to access generative fill functionality.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Generative fill is enabled.
1 Generative fill is disabled.

Group policy mapping:

Name Value
Name DisableGenerativeFill
Friendly Name Disable generative fill
Location Computer Configuration
Path Windows Components > Paint
Registry Key Name Software\Microsoft\Windows\CurrentVersion\Policies\Paint
Registry Value Name DisableGenerativeFill
ADMX File Name WindowsCopilot.admx

DisableImageCreator

Scope Editions Applicable OS
✅ Device
❌ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 22H2 [10.0.22621.4870] and later
✅ Windows 11, version 24H2 [10.0.26100.3360] and later
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableImageCreator

This policy setting allows you to control whether Image Creator functionality is disabled in the Windows Paint app.

  • If this policy is enabled, Image Creator functionality won't be accessible in the Paint app.

  • If this policy is disabled or not configured, users will be able to access Image Creator functionality.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Image Creator is enabled.
1 Image Creator is disabled.

Group policy mapping:

Name Value
Name DisableImageCreator
Friendly Name Disable Image Creator
Location Computer Configuration
Path Windows Components > Paint
Registry Key Name Software\Microsoft\Windows\CurrentVersion\Policies\Paint
Registry Value Name DisableImageCreator
ADMX File Name WindowsCopilot.admx

DisableRecallDataProviders

Scope Editions Applicable OS
❌ Device
✅ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows Insider Preview
./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableRecallDataProviders

This policy setting allows you to determine whether Recall data providers are allowed to run on the device.

  • If this policy is enabled (value set to 1), Recall data providers will be disabled.

  • If this policy is disabled or not configured (value 0), Recall data providers will be enabled. This policy is intended for enterprise managed devices only and is available on Enterprise and Education editions.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Recall data providers enabled.
1 Recall data providers disabled.

Group policy mapping:

Name Value
Name DisableRecallDataProviders
Path WindowsAI > AT > WindowsComponents > WindowsAI

DisableSettingsAgent

Scope Editions Applicable OS
✅ Device
❌ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows Insider Preview
./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableSettingsAgent

Settings agentic experience enhances search results within the Settings app by enabling natural language. When activated, it utilizes an AI model to provide intelligent Settings search suggestions.

This policy setting allows you to determine whether Settings agentic search experience is available for users on their device.

When the policy is enabled, the Settings agentic search experience is disabled, limiting search results to statically indexed searches and semantic searches.

When the policy is disabled, users will have Settings agentic search experience available on their device.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Settings Agentic search experience is enabled.
1 Settings Agentic search experience isn't enabled.

Group policy mapping:

Name Value
Name DisableSettingsAgent
Friendly Name Disable Settings agentic search experience
Location Computer Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name DisableSettingsAgent
ADMX File Name WindowsCopilot.admx

SetCopilotHardwareKey

Scope Editions Applicable OS
❌ Device
✅ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 22H2 with KB5044380 [10.0.22621.4391] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetCopilotHardwareKey

This policy setting determines which app opens when the user presses the Copilot key on their keyboard.

  • If the policy is enabled, the specified app will open when the user presses the Copilot key. Users can change the key assignment in Settings.

  • If the policy isn't configured, Copilot will open if it's available in that country or region.

The property value is the Application User Model ID (AUMID) for the target application. For example: the Microsoft 365 Copilot app is Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft.MicrosoftOfficeHub. For more information, see Find the application user model ID of an installed app.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace

Group policy mapping:

Name Value
Name SetCopilotHardwareKey
Friendly Name Set Copilot Hardware Key
Location User Configuration
Path Windows Components > Windows Copilot
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\CopilotKey
ADMX File Name WindowsCopilot.admx

SetDataLossPreventionProvider

Scope Editions Applicable OS
✅ Device
❌ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5065789 [10.0.26100.6725] and later
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDataLossPreventionProvider

This policy allows an admin to specify a DLP provider, which Recall will use if the provider is properly installed. You'll need to get the string for this from your provider. It will look something like 'key:HKEY_LOCAL_MACHINE\Software\Contoso\DLP; value:InstallPath; binary:contosoDLP.dll' (without any quotes in the value).

Important

This setting applies to Enterprise and Education client SKUs only.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace

Group policy mapping:

Name Value
Name SetDataLossPreventionProviderKey
Path WindowsAI > AT > WindowsComponents > WindowsAI

SetDenyAppListForRecall

Scope Editions Applicable OS
✅ Device
✅ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall

This policy allows you to define a list of apps that won't be included in snapshots for Recall.

Users will be able to add additional applications to exclude from snapshots using Recall settings.

The list can include Application User Model IDs (AUMID) or name of the executable file.

Use a semicolon-separated list of apps to define the deny app list for Recall.

For example: code.exe;Microsoft.WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe

Important

This setting applies to Enterprise and Education client SKUs only. When configuring this policy setting, changes won't take effect until the device restarts.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Allowed Values List (Delimiter: ;)

Group policy mapping:

Name Value
Name SetDenyAppListForRecall
Friendly Name Set a list of apps to be filtered from snapshots for Recall
Location Computer and User Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name SetDenyAppListForRecall
ADMX File Name WindowsCopilot.admx

SetDenyUriListForRecall

Scope Editions Applicable OS
✅ Device
✅ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall

This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs.

For example: https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com

Adding https://www.WoodgroveBank.com to the list would also filter https://Account.WoodgroveBank.com and https://www.WoodgroveBank.com/Account.

Important

This setting applies to Enterprise and Education client SKUs only. Changes to this policy take effect after device restart.

Description framework properties:

Property name Property value
Format chr (string)
Access Type Add, Delete, Get, Replace
Allowed Values List (Delimiter: ;)

Group policy mapping:

Name Value
Name SetDenyUriListForRecall
Friendly Name Set a list of URIs to be filtered from snapshots for Recall
Location Computer and User Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name SetDenyUriListForRecall
ADMX File Name WindowsCopilot.admx

SetMaximumStorageDurationForRecallSnapshots

Scope Editions Applicable OS
✅ Device
✅ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots

This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall.

When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days.

When this policy isn't configured, the maximum storage duration is 90 days unless the current user specifies a different value.

If both maximum storage duration and maximum storage space are set for Recall, then snapshots are deleted when the first maximum is reached.

Important

This setting applies to Enterprise and Education client SKUs only.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 90

Allowed values:

Value Description
0 Let the OS define the maximum amount of time the snapshots will be saved.
30 30 days.
60 60 days.
90 (Default) 90 days.
180 180 days.

Group policy mapping:

Name Value
Name SetMaximumStorageDurationForRecallSnapshots
Friendly Name Set maximum duration for storing snapshots used by Recall
Location Computer and User Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name SetMaximumStorageDurationForRecallSnapshots
ADMX File Name WindowsCopilot.admx

SetMaximumStorageSpaceForRecallSnapshots

Scope Editions Applicable OS
✅ Device
✅ User
❌ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 11, version 24H2 with KB5055627 [10.0.26100.3915] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots
./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots

This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall.

You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB.

When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity unless the current user specifies a different value.

25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher.

If both maximum storage duration and maximum storage space are set for Recall, then snapshots are deleted when the first maximum is reached.

Important

This setting applies to Enterprise and Education client SKUs only.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Let the OS define the maximum storage amount based on hard drive storage size.
10240 10GB.
25600 25GB.
51200 50GB.
76800 75GB.
102400 100GB.
153600 150GB.

Group policy mapping:

Name Value
Name SetMaximumStorageSpaceForRecallSnapshots
Friendly Name Set maximum storage for snapshots used by Recall
Location Computer and User Configuration
Path Windows Components > Windows AI
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsAI
Registry Value Name SetMaximumStorageSpaceForRecallSnapshots
ADMX File Name WindowsCopilot.admx

TurnOffWindowsCopilot

Note

This policy is deprecated and may be removed in a future release.

Scope Editions Applicable OS
❌ Device
✅ User
✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC
✅ Windows 10, version 21H2 [10.0.19044.3758] and later
✅ Windows 10, version 22H2 with KB5032278 [10.0.19045.3758] and later
✅ Windows 11, version 22H2 with KB5030310 [10.0.22621.2361] and later
✅ Windows 11, version 23H2 [10.0.22631] and later
./User/Vendor/MSFT/Policy/Config/WindowsAI/TurnOffWindowsCopilot

This policy setting allows you to turn off Windows Copilot.

  • If you enable this policy setting, users won't be able to use Copilot. The Copilot icon won't appear on the taskbar either.

  • If you disable or don't configure this policy setting, users will be able to use Copilot when it's available to them.

Note

  • The TurnOffWindowsCopilot policy isn't for the new Copilot experience that's in some Windows Insider builds and that will be gradually rolling out to Windows 11 and Windows 10 devices.
  • This policy also applies to upgrade scenarios to prevent installation of the Copilot app from an image that would have had the Copilot in Windows pane.

Description framework properties:

Property name Property value
Format int
Access Type Add, Delete, Get, Replace
Default Value 0

Allowed values:

Value Description
0 (Default) Enable Copilot.
1 Disable Copilot.

Group policy mapping:

Name Value
Name TurnOffWindowsCopilot
Friendly Name Turn off Windows Copilot
Location User Configuration
Path Windows Components > Windows Copilot
Registry Key Name SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot
Registry Value Name TurnOffWindowsCopilot
ADMX File Name WindowsCopilot.admx

Policy configuration service provider