How to Completely Disable ‘Contacts’ Access via Group Policy in Windows 11

Windows 11 includes a unified privacy framework that governs how universal Windows Platform (UWP) applications and desktop programs access sensitive user data, including the localized Address Book and Contacts database. By default, applications (such as email clients, messaging apps, and social media integrations) can prompt the user for permission to read and extract contact information. In a strict enterprise, military, or zero-trust environment, permitting arbitrary applications to access the corporate directory or local contact lists creates a massive data exfiltration vulnerability. Malicious or overly aggressive applications can harvest contact databases for phishing campaigns, social engineering attacks, or unauthorized data monetization.

This guide explains how to completely disable ‘Contacts’ access system-wide via Group Policy in Windows 11, enforcing a strict zero-trust model where all unauthorized applications are cryptographically blocked from reading the local address book.

Disable Contacts Access via Group Policy

To enforce a strict block that disables contact access globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > App Privacy

5. In the right-hand pane, locate the policy named Let Windows apps access contacts.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled. (Note: We must enable the policy in order to manually configure the restriction parameters).
8. Under the “Options” section, locate the “Default for all apps” drop-down menu.
9. Select Force Deny from the list. (By explicitly forcing a denial, we instruct the Windows kernel to permanently block all API calls requesting read access to the Contacts database, overriding any individual user preferences).
10. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting the Windows Privacy framework require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, open the main Settings app and navigate to Privacy & security > Contacts. The master toggle switch granting apps access to contacts will be forced to the “Off” position, greyed out, and explicitly marked with a banner stating, “Some of these settings are hidden or managed by your organization.” The Windows 11 kernel is now cryptographically bound to protect the address book, completely mitigating the risk of unauthorized contact harvesting.