Sideloading UWP Apps

Analogy categoryAnalogies

What Sideloading Means and When It's Enabled

Sideloading is the act of installing a UWP/MSIX app directly onto a Windows 10 device without going through the Microsoft Store, typically used during development, internal enterprise (line-of-business) distribution, or testing pre-release builds. Windows 10 enables sideloading by default for developers once Developer Mode is turned on in Settings > Update & Security > For developers; on domain-joined or Azure AD-joined enterprise machines, sideloading can also be enabled centrally via Group Policy ('Allow all trusted apps to install') or an MDM policy, without exposing a full Developer Mode toggle to end users.

🏏

Cricket analogy: Sideloading is like a domestic net session where a player tries out a new bat before it's officially sanctioned by the ICC for international play, useful for testing before wider approval.

Installing a Package with PowerShell

The core sideload mechanism is the Add-AppxPackage PowerShell cmdlet, which installs a .msix, .msixbundle, or .appx package directly from a local path or UNC share. For packages that declare external dependencies (framework packages) not already on the machine, the -DependencyPath parameter must list those framework .msix files explicitly, or the install fails with a dependency-not-found error. Before Add-AppxPackage will succeed, the signing certificate used on the package must already be trusted; this is commonly done with Import-Certificate targeting the Cert:\LocalMachine\TrustedPeople store for self-signed development certificates.

🏏

Cricket analogy: Add-AppxPackage installing directly from a local path is like a domestic league directly fielding a player from a local club trial rather than through the full national selection pipeline.

powershell

# Trust a self-signed development certificate for sideloading
Import-Certificate -FilePath "ContosoNotes.cer" `
  -CertStoreLocation Cert:\LocalMachine\TrustedPeople

# Install the package, including any framework dependencies
Add-AppxPackage -Path "C:\Builds\ContosoNotes_3.2.0.0_x64.msix" `
  -DependencyPath "C:\Builds\Microsoft.WindowsAppRuntime.1.4_x64.msix"

# Verify the installed package
Get-AppxPackage -Name "Contoso.NotesApp" | Select-Object Name, Version, PackageFullName

Enterprise Distribution with .appinstaller and MDM

For repeatable enterprise distribution beyond a single PowerShell install, developers publish an .appinstaller XML file to an internal web server or file share; users (or an MDM policy) install the app by referencing that .appinstaller URI, which points to the current package plus any dependencies and, as covered separately in update handling, can enable self-updating. Microsoft Intune supports LOB (line-of-business) app deployment natively by uploading the .msix or .msixbundle directly, targeting device or user groups, and setting install intent (Required vs Available), which pushes and silently installs the app without any end-user PowerShell interaction at all.

🏏

Cricket analogy: Publishing an .appinstaller to an internal server is like a domestic cricket board hosting the official squad list on their website that all teams reference for the season, one source of truth.

When using Intune for MSIX LOB deployment, Intune automatically manages the trusted certificate for you if the app is signed with a certificate uploaded to the Intune Certificate Connector — avoiding the manual Import-Certificate step required for ad hoc PowerShell sideloading.

On non-domain-joined consumer PCs, Developer Mode must be explicitly enabled (Settings > Update & Security > For developers > Developer Mode) before Add-AppxPackage will work at all; without it, attempting to sideload returns error 0x800B0100 or a policy-blocked message, since sideloading is off by default outside development or managed environments.

Sideloading installs UWP/MSIX apps outside the Microsoft Store, for development, testing, or enterprise LOB distribution.
Developer Mode (or a Group Policy/MDM equivalent) must be enabled before sideloading is allowed on a device.
Add-AppxPackage is the core PowerShell cmdlet for local sideload installs, with -DependencyPath for framework packages.
Self-signed development certificates must be imported into Cert:\LocalMachine\TrustedPeople before install succeeds.
An .appinstaller file enables repeatable, URI-based distribution with optional self-updating.
Intune supports native LOB deployment of MSIX packages with Required/Available install intent targeting device or user groups.
Attempting to sideload without Developer Mode enabled fails with a policy-blocked error.