Let Windows apps access cellular data

Verified with Windows 11 25H2 — updated on July 30, 2026

Supported on: At least Windows Server 2016, Windows 10 Version 1703

Path in the GPO console

Computer Configuration\Administrative Templates\Network\WWAN Service\Cellular Data Access

Description

This policy setting specifies whether Windows apps can access cellular data. You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting. If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.

Registry

HKLM Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess

More options available

Options

Default for all apps:

LetAppsAccessCellularData enum

User is in control -> 0 (default)
Force Allow -> 1
Force Deny -> 2

LetAppsAccessCellularData_UserInControlOfTheseApps multiText

LetAppsAccessCellularData_ForceAllowTheseApps multiText

LetAppsAccessCellularData_ForceDenyTheseApps multiText

MDM / Intune (CSP)

./Device/Vendor/MSFT/Policy/Config/Cellular/LetAppsAccessCellularData

Device Since Windows 10, version 1709 [10.0.16299] and later Official mapping (Microsoft Learn)

Multiple CSP matches are possible; the first one was selected.

Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)

CSP values

0 (Default) - User is in control.
1 - Force Allow.
2 - Force Deny.

Export Builder

BETA

Configure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.

These exports write the registry — this is not a managed GPO. ⓘ

Not configured Enabled Disabled

Default for all apps:

LetAppsAccessCellularData_UserInControlOfTheseApps

LetAppsAccessCellularData_ForceAllowTheseApps

LetAppsAccessCellularData_ForceDenyTheseApps

.reg file

Windows Registry Editor Version 5.00

; Exported from gporais.com
; Policy: Let Windows apps access cellular data
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10 Version 1703

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess]
"LetAppsAccessCellularData"=dword:00000000
"LetAppsAccessCellularData_UserInControlOfTheseApps"=hex(7):00,00
; REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
"LetAppsAccessCellularData_ForceAllowTheseApps"=hex(7):00,00
; REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
"LetAppsAccessCellularData_ForceDenyTheseApps"=hex(7):00,00
; REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.

More formats (PowerShell, Intune, SCCM)

PowerShell

# Exported from gporais.com
# Policy: Let Windows apps access cellular data
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703

$path = 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_UserInControlOfTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_ForceAllowTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_ForceDenyTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.

Intune XML

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Cellular/LetAppsAccessCellularData
Data type: String
Value:
<enabled/>
<data id="LetAppsAccessCellularData_Enum" value="0"/>
<!-- LetAppsAccessCellularData_UserInControlOfTheseApps_List: enter one value per line before copying this XML payload. -->
<!-- LetAppsAccessCellularData_ForceAllowTheseApps_List: enter one value per line before copying this XML payload. -->
<!-- LetAppsAccessCellularData_ForceDenyTheseApps_List: enter one value per line before copying this XML payload. -->

Intune Remediation

# === Detection script ===
# Exported from gporais.com
# Policy: Let Windows apps access cellular data
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData_UserInControlOfTheseApps' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData_ForceAllowTheseApps' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData_ForceDenyTheseApps' -Expected @() -Kind MultiString)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Let Windows apps access cellular data
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703

$path = 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_UserInControlOfTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_ForceAllowTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_ForceDenyTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.

SCCM scripts

# Exported from gporais.com
# Policy: Let Windows apps access cellular data
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.

# === Detection script ===
# Exported from gporais.com
# Policy: Let Windows apps access cellular data
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData_UserInControlOfTheseApps' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData_ForceAllowTheseApps' -Expected @() -Kind MultiString)
  (Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess' -Name 'LetAppsAccessCellularData_ForceDenyTheseApps' -Expected @() -Kind MultiString)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Let Windows apps access cellular data
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1703

$path = 'HKLM:\Software\Policies\Microsoft\Windows\WwanSvc\CellularDataAccess'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_UserInControlOfTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_ForceAllowTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.
Set-ItemProperty -Path $path -Name 'LetAppsAccessCellularData_ForceDenyTheseApps' -Value @() -Type MultiString
# REG_MULTI_SZ: one string per input line; edit in regedit if you need richer formatting.

Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.

Open the Builder

Search GPORais