- Platforms
- Windows
- Products
- IntuneMSIX
- Result
- Signed MSIX apps install from Company Portal, isolated in containers, even several versions of the same app
Overview
Repackage an EXE or MSI installer as MSIX with the MSIX Packaging Tool, sign it, and deploy it with Intune as a line-of-business app.
It's been a while since my last post about app management. When you move to modern device management, don't forget modern app formats like MSIX (released in 2018), a package format for almost any Windows app, including apps that ship as MSI or EXE.
MSIX packages must be signed, usually with a code signing certificate (public or private). In 2021 you could also sign them through your Microsoft Entra ID tenant with Device Guard Signing Service v2 (DGSS v2), without your own certificate (see signing preference):
A device installs an MSIX package only if it's signed and trusted, which usually means the root certificate is in the Local Machine store (Trusted Root Certification Authorities). For DGSS v2 that root certificate had to be on every device that gets the package.
In this post I create an MSIX package from an existing installer (EXE or MSI), sign it with DGSS v2 and deploy it with Intune.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 | Licensing |
| Admin role | Application Manager in Intune for the app, and Policy and Profile Manager for the certificate profile | Roles |
| Devices | A clean packaging machine on Windows 10 1809 or later, for example the Hyper-V Quick Create packaging VM | Quick CreateTool |
| PKI | A way to sign the package: Azure Artifact Signing or a code signing certificate (DGSS v2 is retired) | SigningArtifact Signing |
| The signing root certificate trusted on devices (Intune trusted certificate profile) | Trusted cert | |
| App | The Windows installer you want to package (MSI, EXE, ClickOnce, App-V or script) | Create package |
Configuration
The first step shows the retired DGSS v2 setup for reference; steps 2 and 3 still work today.
Register an app in Microsoft Entra ID for DGSS v2
Microsoft's steps were in Sign an MSIX package with Device Guard signing (kept for reference). In the Microsoft Entra admin center, select New registration:
Enter a name (DGSS v2) and under Redirect URI select Public client (mobile & desktop) with https://dgss.microsoft.com:
Under API permissions, add a permission. Under APIs my organization uses, search for Windows Store for Business:
Select Delegated permissions and user_impersonation:
Finally, select Grant admin consent:
Create the MSIX package
On my Windows 10 PC with Hyper-V I created an MSIX Packaging Tool Environment VM with Hyper-V Quick Create, the fastest way to get a clean packaging machine:
Start the VM:
My VM had MSIX Packaging Tool January 2021 (1.2020.1219.0); see the release notes for current versions. Open the tool and select Application package:
Select Create package on this computer. The Prepare computer page then shows:
- MSIX Packaging Tool Driver: required
- Windows Update: turned off during packaging
- Windows Search: turning it off is recommended
Choose the installer to package (EXE, MSI and so on). Under Signing preference I selected Sign with Device Guard signing version 2 and signed in with my Microsoft Entra ID account:
If you forget to select Sign in with Microsoft before Next, the wizard doesn't warn you, but the installation fails on the device:
If the account doesn't have the Device Guard signer role in Microsoft Store for Business, the tool tells you:
Optionally add a time stamp server, any RFC 3161 compliant URL, see Sign an MSIX package. Select Yes, move on to create the package:
The package is created:
Update (October 2026): in the MSIX Packaging Tool, choose to sign with a certificate file (.pfx) or don't sign the package, and sign it afterwards with SignTool and Azure Artifact Signing.
Upload the package to Intune
Upload the package to Intune as a line-of-business app:
The MSIX apps show with type Windows Universal line-of-business app:
Assign the apps to Windows devices that also have the DGSS v2 root certificate (Microsoft Enterprise Identity Verification Root Certificate Authority 2020), deployed with a trusted certificate profile.
User Experience
Finally, install the apps from Company Portal on a Windows device.
When you open the package, App Installer checks whether it's trusted (the root certificate must be on the device):
The user installs three MSIX apps from Company Portal:
- 7-Zip 19.0
- 7-Zip 21.0
- VLC media player 3.0.12.0
MSIX apps run isolated in a container, so you can install several versions of the same app, such as 7-Zip:
All three apps show under Apps & features:
The DGSS v2 root certificate that Intune installed, Microsoft Enterprise Identity Verification Root Certificate Authority 2020:
Without this root certificate the installation fails with this error:
0x800B010A: A certificate chain could not be built to a trusted root authority.