You can sideload line-of-business (LOB) Windows apps to a WindowsВ 10 by using PowerShell or Deployment Image Servicing and Management (DISM). Windows apps include:
Universal Windows apps devices: Windows apps built upon the Universal Windows app platform, targeting the universal device family.
Universal WindowsВ 8 apps: Windows apps that target Windows 8.x.
Typically, Windows apps are available only through the Microsoft Store. You can submit LOB Windows apps to the Microsoft Store and make them available outside of your enterprise. However, you can also develop Windows apps for use only within your enterprise and add them to Windows devices you manage through a process we call sideloading. Sideloaded apps do not have to be certified by or installed through the Microsoft Store.
Here’s what you’ll need to know in order to sideload apps:
How to?
Description
Introduces some basic concepts you’ll need to know about sideloading apps.
Shows the requirements to be met in order to sideload apps on devices running different Windows Editions. Includes how to use Group Policy to configure your enterprise PCs for sideloading apps.
Shows you how to configure your PC to have a developer license that does not expire. The PC can be used to develop Microsoft Store apps or enterprise apps that will be added to your enterprise devices.
Shows you how to sideload apps that you develop.
Shows you how to prepare a multi-lingual image, sign-in to the image, install any desired app resource packs (including language) and then use Copy Profile to capture the image.
Shows you how to list the LOB apps installed on the devices in your enterprise or in an offline Windows image.
Shows you how to remove individual instances of an app or remove the provisioning setting of an app.
Understand Sideloading Concepts
Windows apps differ from Windows desktop applications in their design and in the way users can interact with them. To learn more about Windows apps , see what is a Microsoft Store App?.
You cannot sideload an app that has been downloaded from the Microsoft Store. To install Windows apps that are not part of your business line, you must use the Microsoft Store. To learn more, see Managing Client Access to the Microsoft Store.
LOB Windows apps that are not signed by the Microsoft Store can be sideloaded or added to a PC in the enterprise through scripts at runtime on a per-user basis. They can also be provisioned in an image by the enterprise so that the app is registered to each new user profile that’s created on the PC. The requirements to sideload the app per-user or in the image are the same, but the Windows PowerShell cmdlets you use to add, get, and remove the apps are different. This topic provides steps for both methods.
Before you can sideload LOB Windows apps that are not signed by the Microsoft Store, you will need to configure the PC, see Configure PCs for Sideloading Requirements.
When You’re Developing LOB Windows apps for Your Enterprise
LOB Windows apps that are not signed by the Microsoft Store must be cryptographically signed. The apps can only be installed on a computer that trusts the signing certificate.
For more information about how to sign an app and using certificates, see App Packaging Tools.
However, you can use a developer license to add apps that are in development to your PC. For more information about testing apps that are in development, see Get a Developer License.
You can use Group Policy to configure your domain-joined PCs to have a developer license that does not expire to support app development. Once the PCs are configured, you won’t need to connect to the Internet to obtain or renew a license. See Configure PCs for Developing Microsoft Store Apps for more information.
Configure PCs for Sideloading Requirements
Until the device meets all of the sideloading requirements, app tiles on the Start menu will show an «X» in the bottom-right corner to indicate that a problem is preventing the app from running.
In some cases, part of those requirements includes using a sideloading product key. This key provides use rights needed to deploy Windows 8, or Windows 8.1 apps directly to devices without having to install them through the public Microsoft Store.
Before you can add and run sideloaded LOB Windows apps that are not signed by the Microsoft Store you must configure your device based on the following conditions:
For those devices that are joined to a workgroup, you must:
Activate the sideloading product key on the device.
And enable the Allow all trusted applications to install Group Policy setting. See Use Group Policy to configure your enterprise PCs for sideloading apps.
This applies to:
WindowsВ 10 Enterprise
WindowsВ 8.1В Enterprise
WindowsВ 8В Enterprise
Windows EmbeddedВ 8.1В Industry Enterprise
WindowsВ 8.1В Pro Update
For those devices that will be joined to an Active Directory domain, you must:
Join the device to an Active Directory domain.
And enable the Allow all trusted applications to install Group Policy setting. See Use Group Policy to configure your enterprise PCs for sideloading apps.
This applies to:
WindowsВ 10 Enterprise
WindowsВ 8.1В Enterprise
WindowsВ 8В Enterprise
Windows EmbeddedВ 8.1В Industry Enterprise
WindowsВ 8.1В Pro Update
Windows ServerВ 2016 Technical Preview
Windows ServerВ 2012В R2 Update
Windows ServerВ 2012
For those devices that will require a sideloading product key, whether the device is domain-joined or a member of a workgroup, you must:
Activate the sideloading product key on the device.
And enable the Allow all trusted applications to install Group Policy setting. See Use Group Policy to configure your enterprise PCs for sideloading apps.
This applies to:
WindowsВ 10 Pro
WindowsВ RTВ 8.1
WindowsВ 8.1В Pro
WindowsВ RT
WindowsВ 8В Pro
Windows EmbeddedВ 8.1В Industry Pro
For certain Windows EmbeddedВ 8 Industry devices, you no longer need a sideloading product key whether the device is domain-joined or a member of a workgroup. In this case, you must:
Enable the Allow all trusted applications to install Group Policy setting on the device.
This applies to:
Windows EmbeddedВ 8.1В Industry Pro Update
Windows EmbeddedВ 8.1В Industry Enterprise Update
Use Group Policy to configure your enterprise PCs for sideloading apps
Open the Group Policy Management Editor for a domain—based Group Policy Object (GPO) to which you will be applying the group policy setting, as specified below, to your selected PCs.
Note  The steps provided in this procedure assume you understand the basics of Group Policy design and operations. To administer domain—based Group Policy on a Windows 8.1 PC, you will need to install the Group Policy Management Console which is installed with the Remote Server Administration Tools for Windows 8.1. For more information about Group Policy, see Group Policy for Beginners and the Group Policy Techcenter.
Click to expand Computer Configuration, Administrative Templates, Windows Components, and then App Package Deployment.
Double-click the Allow all trusted apps to install setting.
In the Allow all trusted apps to install window, click Enabled and then click OK.
Setting the Group Policy to allow trusted applications updates the following registry setting: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowAllTrustedApps = 1
To activate a sideloading product key
Open a command prompt with administrator privileges and type the following to add the sideloading product key:
Where is the 25 digit key to enable sideloading on the computer.
Activate the sideloading key by typing:
NoteВ В The activation GUID is not the same as the sideloading product key. The activation GUID will always be ec67814b-30e6-4a50-bf7b-d55daf729d1e.
For more information about sideloading product keys, see the Windows 8 Licensing Guide.
Configure PCs for Developing Windows apps
You can configure your PCs to have a developer license that does not expire. Once the PCs are configured, you won’t need to connect to the Internet to obtain or renew a license. Your computer must be a member of a domain and be running either of the following operating systems:
WindowsВ 10 Enterprise
WindowsВ 8.1В Enterprise
WindowsВ 8В Pro
NoteВ В To enable sideloading on WindowsВ 8В Pro device, you must use a sideloading product activation key. For more information see, Configure PCs for Sideloading Requirements
To configure your enterprise PCs with a developer license
Open the Group Policy Management Editor for a domain—based Group Policy Object (GPO) to which you will be applying the group policy settings, as specified below, to your selected PCs.
Note  The steps provided in this procedure assume you understand the basics of Group Policy design and operations. To administer domain—based Group Policy on a Windows 8.1 PC, you will need to install the Group Policy Management Console which is installed with the Remote Server Administration Tools for Windows 8.1. For more information about Group Policy, see Group Policy for Beginners and the Group Policy Techcenter.
Click to expand Computer Configuration, Administrative Templates, Windows Components, and then App Package Deployment.
Double-click the Allow development of Windows apps without installing a developer license setting.
In the Allow development of Windows apps without installing a developer license window, click Enabled and then click OK.
Double-click the Allow all trusted apps to install setting.
In the Allow all trusted apps to install window, click Enabled and then click OK.
Setting the Group Policy to allow development of Windows apps without installing a developer license updates the following registry setting: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense = 1
Setting the Group Policy to allow trusted applications updates the following registry setting: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx\AllowAllTrustedApps = 1
Add Apps
There are two ways to add apps. A user can add an app package, which will make the app available to just that user. Or the app can be installed in the Windows image, which will make the app available to every user of the Windows image at first logon or at the next logon, if the user account is already created. This second case is referred to as provisioning an app package.
Add an App Package
You can install an app package (.appx or .appxbundle) on a per-user basis by using the add-appxpackage PowerShell cmdlet. There is no limit to the number of LOB apps you can add for each user.
Add a LOB app to a user account
At the Windows PowerShell prompt on a WindowsВ 8 or Windows ServerВ 2012 computer, add an .appx (or .appxbundle) file package. Include any required dependency app packages when you add the app. For example, type:
Add a provisioned LOB app to a Windows image
Apps that are installed in the Windows image are called provisioned apps. Provisioned apps are staged in the image and are scheduled to be installed for every user of the Windows image at first logon or at the next logon, if the user account is already created.
You can add these apps to a Windows image when you boot into audit mode before you deploy the image by using the DISM app provisioning commands. For more information about audit mode, see Audit Mode Overview.
Provisioned apps are specific to the PC and will not roam with the user. You can only install 24 provisioned apps in an image.
On a Windows image that has already been deployed, you should instead use the Add-AppxPackage cmdlet in PowerShell. If you do use the DISM app provisioning commands on a deployed Windows image with active users, you should log all users off of the image, so that you are the only user logged on, before you run the command.
NoteВ В On WindowsВ 8, to update a provisioned app, you must first remove the provisioned app and then deploy the new version of the app. The update will then be applied the next time each user logs in.
On WindowsВ 8.1 and newer, you no longer need to remove the provisioned app prior to deploying the new version of the provisioned app.
Add a provisioned LOB app to a Windows image
Use the Deployment Image Servicing and Management (DISM) command-line tool or PowerShell cmdlets to add the LOB app without a Microsoft Store license. For example, at an elevated command prompt, type:
Or, at a Windows PowerShell prompt, type:
NoteВ В The computer does not have to be joined to a domain or have an activated sideloading product key before you install provisioned LOB apps. However, the apps will not run until the computer meets this sideloading requirement. For more information, see Customize the Start Screen.
Update a provisioned LOB app once it is has been added to a Windows image
On WindowsВ 8, to update a provisioned app, you must first remove the provisioned app and then deploy the new version of the app. The update will then be applied the next time each user logs in.
On WindowsВ 8.1 and newer, to update a provisioned app, you will need to update the app for each user that has signed on to the Windows image provisioned with the app:
Update a provisioned LOB app to a Windows image
Use the PowerShell to update the LOB app without a Microsoft Store license. This must be done for each user that has signed in to the PC running the Windows image. For example, if you have installed the original version of the app, 1.0.0.0, that now needs to be updated to version 1.0.0.1, then at a PowerShell session, type:
Where c:\appx\WinJS.appx is the path to the dependency package.
Once you have updated your app, you can verify the version of the updated app. From a PowerShell session, type:
Add Multiple Languages for Apps
To prepare a multi-lingual image, sign-in to the image, install any desired app resource packs (including language) and then use Copy Profile to capture the image.
Preparing a multi-lingual image for an app
Create an unattend.xml with the following contents to c:\unattend.xml:
NoteВ В See Change the language used in apps for information about setting the language and installing updates from the Microsoft Store.
Sign-in to a local administrator user account from OOBE on clean image.
ImportantВ В When adding a specific language to a Windows app, you would also want to Add Language Packs to Windows for the same languages as you did for the Windows app.
Add the desired languages to the current user’s language preference list.
Install app updates using a Microsoft Store account (MSA account)
Sign-in to the Microsoft Store with an MSA account.
Note  Microsoft Store only. Don’t convert the local account to MSA.
If you do not have an MSA account, you can update apps without a Microsoft Store account.
Check for updates and install new language resource packs.
Sign out of the Microsoft Store and remove the MSA account.
Open an elevated command prompt and type:
Then press enter.
You should see the PC boot to OOBE. Any languages that you have added prior to Copy Profile should be present at this point.
Install app updates without using a Microsoft Store account (MSA account)
After the PC has finished installing, open an elevated command prompt.
Type Start ms-windows-store:Updates
You will see the Microsoft Store Updates page. You should see the pending updates displayed.
Tap Install to install the updates.
Inventory Apps
You can list the LOB apps installed in on offline or online Windows image and get additional information about the packages.
List LOB Apps per user account
You can get a list of the Windows apps installed for a specific user account on the computer. You must open PowerShell with administrator privileges to list the packages for a user other than the current user. For example, at the PowerShell prompt, type:
You can get a list of packages installed for a specific user. You must open PowerShell with administrator privileges to list the packages for a user other than the current user. For example, at the PowerShell prompt, type:
You can also get the manifest of an app package (.appx) which includes information such as the package ID. For example, at the PowerShell prompt, type:
You can use the pipeline to get the manifest for an app package (.appx) if you don’t know the full name of the package. For example, at the PowerShell prompt, type:
List LOB apps that are provisioned in a Windows image
You can get a list of the packages that are provisioned in a Windows image that will be installed for each new user by using Dism.exe or PowerShell. For example, at a PowerShell prompt, type:
Or, at a command prompt, type:
Remove Apps
You can remove individual instances of an app, or remove the provisioning setting of an app.
Remove LOB apps per user account
You can remove a single app for the current user only. For example, at a command prompt, type:
Remove provisioned LOB apps in a Windows image
When you remove a provisioned app, the app will not be installed for new user accounts. For the currently logged in user and other user accounts that are active on the computer, the app will not be removed from those accounts. The app will need to be uninstalled for those existing apps.
For example, to remove a provisioned LOB app, MyAppxPkg, from a Windows image, at an elevated PowerShell prompt, type:
