Not Monitored
Tag not monitored by Microsoft.
36,170 questions
According to the issue, perhaps the MSIX is not signed from the Store yet and as such it must be sideloaded as a developer tool.
Why won't App Installer install signed MSIX?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 67%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Andrew Schmidt
31
Reputation points
I am developing a WinUI3 MSIX -based application. I have a valid code signing certificate that has signed the MSIX. When I double click the MSIX to install with App Installer, on the first screen it verifies the app as a Trusted App (see first attached screenshot). However, when I click the Install button, the installation fails with the error message "This app package is not supported for installation by App Installer because it uses certain restricted capabilities." (See the second attached screenshot) The install is being attempted on Windows 10 Enterprise 21H1 OS build 19043.1165. - Why won't the App Installer install this MSIX package? I thought the most recent Windows 10 release would install a properly signed MSIX without being denied for using so-called restricted capabilities. - Why does the first App Installer screen verify this package as a trusted app and indicate the package can be installed, only to abort the installation indicating that the package has not been verified? - To add more confusion, the MSIX installs successfully from PowerShell with the command Add-AppxPackage -Path '.\TrustedAccess-WinUI3 (Package)_1.0.0.0_x64.msix'. Why does App Installer fail, while PowerShell Add-AppxPackage succeeds? ![127743-trusted-access-appinstaller-screen-1.png][1] ![127627-trusted-access-appinstaller-screen-2.png][2] [1]: /api/attachments/127743-trusted-access-appinstaller-screen-1.png?platform=QnA [2]: /api/attachments/127627-trusted-access-appinstaller-screen-2.png?platform=QnA
3 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 34%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXY%3C/text%3E%3C/svg%3E)
Xiaopo Yang - MSFT 11,496 Reputation points Microsoft Vendor2021-08-31T01:29:10.497+00:00 -
Andrew Schmidt 31 Reputation points
2021-08-31T23:01:07.843+00:00 But according to Microsoft documentation, sideloading is enabled by default for MSIX apps with a valid code signature. MSIX packages with valid signatures no longer needed to go through the Microsoft Store. This documentation does not mention that MSIX apps with valid code signatures that also have the restricted capability of disabling registry write virtualization are disabled from sideloading. Also it does not explain the very peculiar behavior that while the App Installer fails to install the package, PowerShell
Add-AppxPackagesucceeds. -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 95%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWK%3C/text%3E%3C/svg%3E)
William Kent 6 Reputation points2021-09-11T19:59:36.91+00:00 This is an intentional limitation in the App Installer. The Installer will refuse to install a package that declares the
unvirtualizedResourcescapability. You must install such packages using Add-AppxPackage in PowerShell. This was done to discourage use of that capability. -
Andrew Schmidt 31 Reputation points
2021-09-13T04:36:07.123+00:00 Where does Microsoft document this? This is a major limitation. Especially since the claim "Uses all system resources" implies that this should not be the case.
-
Andrew Schmidt 31 Reputation points
2021-09-13T04:40:55.467+00:00 In fact, this Microsoft document specifically states
Restricted capabilities are intended for very specific scenarios. The use of these capabilities is highly restricted and subject to additional Store onboarding policy and review. Note that you can sideload apps that declare restricted capabilities without needing to receive any approval. Approval is only required when submitting these apps to the Store.
Sign in to comment -
-
Andrew Schmidt 31 Reputation points
2021-08-31T23:27:32.803+00:00 This Microsoft documentation says that app with restricted capabilities can be sideloaded. So the App Installer should be able to install this MSIX package.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2022-03-06T15:12:57.497+00:00 From what I understand, the Desktop App Installer (the application you use when you double-click on an MSIX file) doesn't support installing apps with restrictions, even when signed, even when the PC is in developer mode.
However, you can add it programmatically using the PackageManager WinRT type, as described here: https://learn.microsoft.com/en-us/windows/apps/desktop/modernize/grant-identity-to-nonpackaged-apps#register-your-sparse-package-at-run-time