Skip to content
English
Go to senturo.com
  • There are no suggestions because the search field is empty.

How to Enable Windows Location Services via Intune with Senturo

Ensure Senturo Can Reliably Report Device Locations Across Your Windows Fleet

Overview

Microsoft recently updated how Windows applications access Wi-Fi and related signals that determine device location. Access to these signals is now tied directly to the Windows Location permission — if Location is off or blocked by policy, apps cannot determine device position regardless of hardware capability. For more detail, see Microsoft's documentation on Wi-Fi access and location changes.

For Senturo to accurately and consistently report Windows device locations, two policy settings must be configured in Microsoft Intune:

  1. Let Apps Access Location — forces Windows apps to access location without requiring end-user approval
  2. Turn off location (User) — prevents users from disabling Location Services (recommended)

Both settings are deployed through a single Settings Catalog configuration profile, which can be assigned to device or user groups in your Microsoft Intune environment.

This article applies to Windows 10 (version 1709 and later) and Windows 11 devices managed through Microsoft Intune. If your devices are domain-joined and managed via Active Directory, see How to Enable Windows Location Services via Group Policy and PowerShell.

Steps to Configure Location Services via Microsoft Intune

1. Create a New Configuration Profile

  • Navigate to the Microsoft Intune admin center at intune.microsoft.com.
  • Navigate to Devices > Configuration.
  • Click on + Create > New Policy.
  • Under Platform, select Windows 10 and later.
  • Under Profile type, select Settings catalog.
  • Click on Create.

2. Name the Profile

  • Enter a Name for the profile, for example: Senturo – Enable Location Services.
  • Optionally enter a Description, for example: Forces apps to access location and prevents users from disabling Location Services for reliable Senturo reporting.
  • Click on Next.

3. Add Configuration Settings

  • In Configuration settings, click on + Add settings.
  • Search for and configure the following two settings: Let Apps Access Location
    • Path: Privacy > Let Apps Access Location
    • Set to Enabled, then set Default for all apps to Force allow.
    Turn off location (User) (recommended)
    • Path: Windows Components > Location and Sensors
    • Set to Disabled.
  • Click on Next.

Why both settings matter: "Let Apps Access Location" controls whether apps are permitted to read location data. "Turn off location (User)" prevents the user from overriding this by disabling Location Services from their device settings. Configuring both settings together ensures Senturo can report location consistently, regardless of user action.

4. Assign the Profile

  • (Optional) Add any Scope tags required by your environment, then click on Next.
  • Under Assignments, configure the following:
    • Included groups — add the user or device groups containing Windows endpoints running Senturo.
    • Excluded groups — add any devices where Location Services must remain user-controlled.
  • Click on Next.

5. Review and Create

  • Review your configuration settings and assignments.
  • Click on Create to deploy the profile.

Microsoft Intune will push the profile to assigned devices at their next check-in. In most cases, this takes a few minutes, but can take up to 20 minutes depending on device check-in frequency.

Verify the Policy on a Device

Once the profile has applied, confirm it is working correctly on a target device:

  1. Navigate to Settings > Privacy & security > Location.
  2. Confirm that the banner "Some of these settings are managed by your organization" is displayed.
  3. Confirm that Location services is set to On and Let apps access your location is set to On.

Troubleshooting

Policy is not applying to devices: Verify that the profile is assigned to the correct user or device group and that target devices are members of that group. Navigate to Devices > Configuration in Microsoft Intune, click on the profile, and review the Device and user check-in status tab for errors. Ensure no conflicting Intune profiles or Group Policy Objects (GPOs) are setting a location policy that overrides this profile.

Location remains off after the policy applies: Confirm no other Intune profile or GPO is actively disabling location at the machine level. Check for a DisableLocation registry value set to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors — if present, it indicates a conflicting policy is in effect. A device restart may also be required for the profile to take full effect.

Windows Location Service (lfsvc) is disabled: Some Windows security baselines disable the lfsvc service, which prevents location data from being collected even when the policy is applied correctly. Navigate to Devices > Scripts and remediations in Microsoft Intune and deploy a remediation script to set lfsvc to Automatic and start the service. Alternatively, see How to Enable Windows Location Services via Group Policy and PowerShell for a PowerShell script that handles this automatically.

Senturo is still not reporting location after policy applies: Allow up to 10 minutes for the first location update to appear in the Senturo dashboard after the policy has applied and the device has restarted. If no location data appears after 15 minutes, verify the Senturo application is installed and running on the device.

Conclusion

By configuring these two settings in a single Microsoft Intune Settings Catalog profile, you ensure that Windows Location Services are enabled and enforced across all assigned devices. This removes dependency on individual user settings, aligns with Microsoft's updated Wi-Fi and location API requirements, and ensures Senturo can collect and report accurate device locations consistently at scale.

FAQs

Q: What happens if devices still show Location off after applying the policy? A: Check for conflicting GPOs or other Intune profiles that may be disabling location. Confirm the Windows Location Service (lfsvc) is running on the device. A device restart may also be required for the policy to take full effect.

Q: How long does it take for the policy to apply? A: In most cases, policies apply within a few minutes of the device checking in with Intune. It can take up to 20 minutes depending on the device's check-in frequency.

Q: Why should I also disable the user toggle? A: If a user turns Location off, Senturo cannot collect location data regardless of the app privacy policy. Disabling the user toggle with the "Turn off location (User)" setting ensures uninterrupted location reporting.

Q: Should I assign this profile to users or devices? A: The "Let Apps Access Location" setting is user-scoped, so assigning the profile to user groups is recommended. This ensures the policy follows the signed-in account across devices. If your environment uses device-based assignment, both settings will still apply correctly.

Q: Do I need to do anything else after deploying this profile? A: In most cases, no. If the Windows Location Service (lfsvc) has been explicitly disabled by a security baseline in your environment, you may also need to re-enable that service separately. See the Troubleshooting section above for guidance.