How to Configure Windows Sandbox APPX and MSIX Sideloading via XML in Windows 11

Modern Windows desktop applications are packaged using MSIX and APPX container formats, offering clean installations, reliable uninstalls, and integrated security sandboxing. However, testing pre-release software builds, self-signed packages, or enterprise line-of-business (LOB) apps on development machines can clutter system stores or require installing unvetted root certificates on production hosts. Windows Sandbox provides a pristine, disposable container for verifying package deployments. By authoring .wsb XML configuration files and PowerShell automation, you can sideload certificates and install MSIX bundles automatically on boot in Windows 11.

Understanding MSIX Sideloading Prerequisites

Installing an MSIX or APPX package outside the Microsoft Store requires two prerequisites:

• Trusted Root Certificate: If the package is signed with an internal code-signing certificate, that public certificate (.cer) must be installed into the container’s LocalMachine\Root or LocalMachine\TrustedPeople store.
• Package Deployment: Packages are installed using the Add-AppxPackage cmdlet within an elevated user session.

Authoring the Automated Package Deployment Script

Create a dedicated host folder (e.g. C:\SandboxPackageTest) containing your app.msix and its public signing certificate signing_cert.cer. In the same folder, save a PowerShell script named InstallPackage.ps1:

# InstallPackage.ps1 - Automated MSIX sideloading inside Windows Sandbox
Write-Host "Initialising package installation pipeline..." -ForegroundColor Cyan

$certPath = "C:PackageSharesigning_cert.cer"
$packagePath = "C:PackageShareapp.msix"

# 1. Install Code-Signing Certificate into Trusted People store
if (Test-Path $certPath) {
    Write-Host "Importing signing certificate..." -ForegroundColor Yellow
    Import-Certificate -FilePath $certPath -CertStoreLocation "Cert:LocalMachineTrustedPeople" | Out-Null
    Write-Host "Certificate installed into TrustedPeople." -ForegroundColor Green
}

# 2. Sideload the MSIX Package
if (Test-Path $packagePath) {
    Write-Host "Deploying MSIX package: $packagePath" -ForegroundColor Yellow
    Add-AppxPackage -Path $packagePath
    Write-Host "MSIX package installed successfully!" -ForegroundColor Green
} else {
    Write-Warning "Target package not found at $packagePath"
}

Constructing the WSB Configuration File

Create an XML configuration file named PackageSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxPackageTest</HostFolder>
      <SandboxFolder>C:PackageShare</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoExit -ExecutionPolicy Bypass -File C:PackageShareInstallPackage.ps1</Command>
  </LogonCommand>
</Configuration>

Launching the Test Session and Verifying Deployment

To run the automated sideloading test:

1. Double-click PackageSandbox.wsb in Windows 11.
2. Windows Sandbox launches and executes InstallPackage.ps1.
3. Verify that the certificate imports cleanly and the package registers without signature errors.
4. Open the Windows Start menu inside the sandbox: observe that your modern application appears in the installed apps list.
5. Launch the app to test lifecycle events, file associations, and performance within the isolated container.