How to Disable Click to Do on Windows 11 Using Microsoft Intune

Open a browser and go to https://intune.microsoft.com. Sign in with an account that holds the Intune Administrator role (or a role with rights to create and assign device configuration profiles).

Alternatively, you can reach Intune from the Microsoft 365 admin center at https://admin.microsoft.com by selecting Show all and then the Endpoint Manager / Intune entry.

Once signed in, confirm the left navigation shows the core management areas you'll use in this guide.

Bookmark https://intune.microsoft.com for faster access. If sign-in fails or menu items are missing, your account likely lacks the required Intune role — ask a Global or Intune Administrator to grant access.

In the left navigation pane, select Devices, then Configuration (labeled Configuration profiles in some tenants).

Click + Create > New Policy (or + Create profile). In the wizard, set:

• Platform: Windows 10 and later
• Profile type: Settings catalog

Click Create to open the profile builder.

Settings catalog is the recommended method for managing Windows AI features. The exact button labels (Create vs. Create profile) vary slightly by tenant UI version.

On the Basics page, enter identifying details:

• Name: Disable Click to Do - Windows AI Policy
• Description: Disables the Click to Do feature on targeted Windows 11 devices via Windows AI policy settings. Prevents users from enabling AI-powered click actions.

Using an Action - Feature - Technology naming convention keeps policies sortable in large environments. Click Next to move to the Configuration settings page.

Keep names consistent across your Intune estate so related policies group together alphabetically.

On the Configuration settings page, click + Add settings to open the settings picker.

In the search box, type Click to Do or Windows AI to filter the catalog. Expand the Windows category, then Windows AI, and locate the Click to Do setting. Depending on your tenant's catalog version, it may appear as Disable Click to Do, Allow Click to Do, or Turn off Click to Do.

Select the checkbox next to the setting, then close the picker with the X in the upper-right corner. Note the exact name your tenant shows — you'll need it in the next step.

If no Windows AI or Click to Do settings appear, your tenant may not yet have the catalog entry, or the search term differs. Confirm you are managing Windows 11 devices that support the feature and check back after Intune service updates.

In the profile's configuration area, find the Windows AI section that now holds your Click to Do setting, and set the value according to its name:

• If named Disable Click to Do — set it to Enabled (this turns on the restriction).
• If named Allow Click to Do — set it to Disabled (this blocks the feature).

This follows standard Windows policy logic: 'Disable' policies are set to Enabled to enforce the block, while 'Allow' policies are set to Disabled to prevent the action. Once the value is set, click Next to reach the Assignments page.

Choosing the wrong value can leave the feature available. Re-read the setting name carefully — a 'Disable' setting left as Disabled does not enforce anything.

On the Assignments page, under Included groups, click + Add groups and select one or more Azure AD security groups.

For a device-level restriction like this, device groups (for example, Prod-Win11-Workstations) are generally preferred so the policy applies regardless of who signs in. User groups also work if you want the policy to follow specific users.

Select your groups and click Select. Optionally, add exclusion groups under the Exclude section. Click Next to continue to review.

Start with a small pilot group (for example, IT-Test-Devices) to validate behavior before assigning to your whole fleet. You can broaden the assignment later.

On the Review + create page, confirm each detail:

• Platform: Windows 10 and later
• Profile type: Settings catalog
• Name: Disable Click to Do - Windows AI Policy
• Configuration: Click to Do setting set to the correct value from the previous step
• Assignments: the intended Azure AD groups

When everything is correct, click Create. To change anything, use Previous to step back. Deployment to assigned devices begins immediately after creation.

Once you click Create, the policy starts deploying right away — double-check assignments first. Devices typically receive and apply the policy within 15-30 minutes on the automatic cycle.

Trigger a manual sync using any of these methods:

From the Intune admin center: Go to Devices > Windows, select a target device, click the ... (More actions) button, and choose Sync.

From the Windows device: Open Settings > Accounts > Access work or school, select the organization account, click Info, then click Sync.

From Company Portal: Open the Company Portal app, go to Settings, and click Sync; wait for the Last sync timestamp to update.

If a sync appears stuck, wait a few minutes and retry. Manual sync only speeds up delivery; the policy still applies on its own within the normal 15-30 minute window.

On the Windows 11 device: Press Windows + I to open Settings, go to Privacy & security, and look for Click to Do. When enforced, its toggle is Off and grayed out, a message notes the setting is managed by your organization, or the option no longer appears.

In the Intune admin center: Go to Devices > Windows, select a target device, open Device configuration (or Configuration profiles), find your Disable Click to Do policy, and confirm the Status column shows Succeeded.

Optionally, from an elevated command prompt on the device, query the Windows AI policy registry key to inspect the applied value.

Run the registry query as Administrator. If the policy shows Pending, wait 15-30 minutes and refresh, or trigger another manual sync. Exact registry values may differ by Windows build and catalog version.