Audit Windows 11 app permissions without trusting one switch

A privacy review that only checks the list of individually toggled apps can miss traditional desktop software. Microsoft says the Privacy page does not list every desktop app or control every capability such apps can use. Some Windows controls are broad gates, while a browser also has site-level permissions. An effective audit maps each sensitive capability to the app that needs it, tests a denial, and checks whether an installed app still has a legitimate reason to remain.

Before you start​

List the apps that should use camera, microphone, location, files and notifications. Note any work or accessibility tool that genuinely needs a capability. Use a normal user account for testing, but keep an administrator available to change device-wide controls. Managed devices may lock settings; record the policy rather than circumventing it.

Do it step by step​

1. Open Settings > Privacy & security and review App permissions category by category. For each one, note the device-wide access state, the user-level gate and the Store apps individually allowed.
2. Identify desktop apps separately. Microsoft warns they may not appear as individual switches under the same category. Review each app's own settings, product permissions and whether it still needs to be installed.
3. For camera and microphone, inspect the broader Let desktop apps access control and browser site permissions. A Windows-level grant does not mean every website should receive access.
4. Deny one nonessential permission and test the app's actual task. If its core function breaks, decide whether to grant a narrower permission or replace the app. Avoid flipping every switch at once.
5. Remove unused software through Settings > Apps after checking its data and license, especially software with broad file access. A permission toggle is not a substitute for uninstalling an app you do not trust.
6. Revisit permissions after a major app or Windows update. Keep a short note of exceptions so a future prompt can be judged against your original purpose.

Check the result​

Required apps perform their tasks, unnecessary grants are removed, and you understand which desktop apps fall outside individual Store-app toggles.

If something goes wrong​

A greyed-out control can be administrator or organization policy. If a desktop app still accesses a file after a Store-app switch is off, that can be expected; inspect its own access path. Do not assume a zero in recent activity proves an app never used the sensor.

Know the limit​

Windows privacy controls are layered, not a complete sandbox for all traditional desktop apps. Microsoft documents broad capabilities that Settings cannot individually revoke; installation trust and account permissions still matter. Microsoft app permissions Camera and microphone privacy

Decision checkpoint​

Use a three-column inventory: capability, legitimate app, and test result after denial. This exposes the common case where a capability was granted for a one-time task and forgotten. If the app is a traditional desktop program, verify its publisher and installation source because Windows' per-app Store controls may not constrain it. A separate standard Windows account can reduce the harm of broad app access on a shared computer. Recheck the inventory whenever you install a new camera, microphone or file-management tool.