Controlling Cocreator Access in Windows Paint using Microsoft Intune

Controlling Cocreator Access in Windows Paint using Microsoft Intune

by

Key Takeaways

  • Enabled policy – Cocreator is turned OFF and hidden
  • Disabled / not configured – Cocreator stays available for users
  • Helps organizations control or restrict AI-based image generation features
  • Useful for maintaining a simpler, non-AI version of Microsoft Paint

Hey, let’s discuss about Controlling Cocreator Access in Windows Paint using Microsoft Intune. This policy setting allows you to control whether theCocreator functionality in the Windows Paint app is disabled. When the policy is enabled, the Cocreator feature will not be accessible within the Paint application. If the policy is disabled or not configured, users will still be able to access and use the Cocreator functionality in the Paint app without any restrictions.

Table of Contents

Controlling Cocreator Access in Windows Paint using Microsoft Intune

The Disable Cocreator policy in Microsoft Paint allows admins to turn off the AI Cocreator feature. When enabled, it hides Cocreator and blocks users from using AI-based image generation or editing. It can be applied through Group Policy or a registry setting, and is mainly used to restrict AI features or keep Paint in a simpler, classic mode.

Create a Profile

To start deploying a policy in Intune, sign in to the Microsoft Intune Admin Center. Then, go to Devices > Configuration profiles > Create New Policy. Select Platform as Windows 10 and later, and profile is Settings catalog.

How to Control Diagnostic Log Collection on Your Devices using Intune - Fig.1
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.1

Basic Step

To begin configuring a policy in Intune, start with the Basics step. Here, we can add the name(Disable Cocreator) of the policy, give a brief description(not mandatory) and platform is Windows. Click Next to continue.

Patch My PC
Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.2
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.2

Configure Cocreator Policy

On the Configuration settings page, the Settings picker is used to search for the required policy. In the search bar, policy name(Cocreator) is entered. Select the Windows AI as category and setting as Disable Cocreator.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.3
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.3

Enable Cocreator Policy

After closing the Settings Picker, you will see it on the Configuration Settings page. Here we have only two settings: Enable or Disable. By default, it will be set to enabled. If you continue with enable the option, click Next to continue.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.4
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.4

Disable Cocreator Policy

If we Disable this policy, you can block the by clicking the drop down menu and select cocreator disabled. Then, you can click the Next button to continue.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.5
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.5

What is Scope Tag

A Scope Tag in Intune is used to control visibility and access to Intune resources based on administrative roles. Scope tags are not mandatory. You can add the scope tag using the Select scope tags button.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.5
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.5

Assignments Tab

To assign the policy to specific groups, you can use the Assignment Tab. Here I click, +Add groups option under Included groups. I choose a group from the list of groups and click on the Select button. Again, I click on the Next button to continue.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.7
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.7

Review + Create Tab

Before completing the policy creation, you can review each tab to avoid misconfiguration or policy failure. After verifying all the details, click on the Create Button. After creating the policy, you will get a success message(Disabled Cocreator created successfully).

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.8
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.8

Monitoring Status

The Monitoring Status page shows whether the policy has succeeded or not. To quickly configure the policy and take advantage of the policy sync the assigned device on Company Portal. Open the Intune Portal. Go to Devices > Configuration > Search for the Policy. Here, the policy shows as successful.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.9
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.9

Client-Side Verification

To confirm if a policy has been applied, use the Event Viewer on the client device. Go to Applications and Services Logs > Microsoft >Windows >Device Management > Enterprise Diagnostic Provider > Admin. From the list of policies, use the Filter Current Log option and search for Intune event 813.

MDM PolicyManager: Set policy int, Policy (DisableCocreator), Area: (WindowsAI), EnrollmentID
requesting merge: (EB427D85-802F-46D9-A3E2-D5B41458/F63), Current User: (Device), Int: (0x1),
Enrollment Type: (0x6), Scope: (0x0).

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.10
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.10

Configuration Service Provider (CSP)

The Policy Configuration Service Provider (CSP) is a feature used by organisations to manage and control settings on Windows 10 and 11 devices. It explains what each policy does, what settings or values can be used, and how it connects to older Group Policy settings (Group Policy Mapping details).

Description framework properties:

Property NameProperty Value
Formatint
Access TypeAdd, Delete, Get, Replace
Default Value0
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Table.1

Assigned Values:

  • 0(Default) – Cocreator is enabled
  • 1 – Cocreator id disabled

Group policy mapping:

NameValue
NameDisableCocreator
Friendly NameDisable Cocreator
LocationComputer Configuration
PathWindows Components > Paint
Registry Key NameSoftware\Microsoft\Windows\CurrentVersion\Policies\Paint
Registry Value NameDisableCocreator
ADMX File NameWindowsCopilot.admx
How to Set Maximum Storage Duration for Recall Snapshots on Windows 11 – Table.2
Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.11
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.11

How to Remove an Assigned Group from this Policy

If you need to remove a group from a policy assignment for security updates. Open the policy from the configuration tab and click on the edit button. Then, click on the Remove button. Click Review + Save after making the changes.

For detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.12
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.12

How to Delete this Policy from Intune Portal

If you want to delete this policy for any reason, you can do it easily. First, search for the policy name in the configuration section. When you find the policy name, click the 3-dot menu next to it and tap the Delete option.

For more information, you can refer to our previous post – How to Delete Allow Clipboard History Policy in Intune Step by Step Guide.

Controlling Cocreator Access in Windows Paint using Microsoft Intune - Fig.13
Controlling Cocreator Access in Windows Paint using Microsoft Intune – Fig.13

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community  and WhatsApp Channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Author

Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM,  Windows,  Cloud PC,  Windows, Entra, Microsoft Security, Career, etc.

Leave a Comment