Microsoft Connected Cache is now generally available

July 24, 2025

MSSQL Extension for VS Code: Agent Mode Updates, Colored Connections, and Schema Designer updates

July 24, 2025

Published by Travis Roberts on July 24, 2025

Introduction

If you’re working with Azure Virtual Desktop (AVD) and planning to use App Attach, you may need to convert existing applications into an MSIX format. MSIX is Microsoft’s modern packaging format, designed to simplify app deployment while improving security and reliability. Whether you’re packaging legacy applications for testing or preparing for enterprise deployment, the MSIX Packaging Tool can help.

In this blog post, we walk through creating MSIX packages from both ‘.msi’ and ‘.exe’ installers using Microsoft’s MSIX Packaging Tool. We’ll also show how to create and apply a self-signed certificate, modify the MSIX manifest to prevent runtime errors, and test your packages in a clean environment.

Step 1: Create a Self-Signed Certificate

MSIX packages must be signed with a valid code-signing certificate. If you don’t have a certificate from a trusted authority or internal PKI, you can create a self-signed certificate for testing.

The ‘.cer’ version of the certificate used to sign a package must be added to the Trusted Root Certification Authorities on each computer that runs the MSIX package. Self-signed certificates are useful for testing. A signing certificate from a trusted authority or internal PKI scales better in production.

A link to the code is listed below.

Steps:
1. Open PowerShell on the packaging computer.
2. Run the following script to create a self-signed code signing certificate. Update the ‘Subject’ and ‘FriendlyName’ sections to reflect your organization’s information.

# Create a self-signed certificate for signing MSIX packages
$certParams = @{
    Type              = 'Custom'
    KeyUsage          = 'DigitalSignature'
    CertStoreLocation = 'Cert:CurrentUserMy'
    TextExtension     = @(
        '2.5.29.37={text}1.3.6.1.5.5.7.3.3'
        '2.5.29.19={text}'
    )
    Subject           = 'CN=, O=, C='
    FriendlyName      = 'Code Signing Cert'
}
$cert = New-SelfSignedCertificate @certParams

2. View the certificates in the user’s certificate store:

# View the certificate
Set-Location Cert:CurrentUserMy
Get-ChildItem | Format-Table Subject, FriendlyName, Thumbprint

3. Export the certificate as a ‘.pfx’ file. This is used for signing code:

# Export the package signing certificate to a file with a password
$certPath = 'C:UsersDocumentsMSIXCodeCert.pfx'
$certPassword = ConvertTo-SecureString -String '' -AsPlainText -Force
Export-PfxCertificate -Cert $cert -FilePath $certPath -Password $certPassword

5. Import the ‘.pfx’ into the packaging computers Trusted People store:

# Import the certificate into the TrustedPeople store
Import-PfxCertificate -FilePath $certPath -CertStoreLocation 'Cert:CurrentUserTrustedPeople' -Password $certPassword

4. Export it again as a ‘.cer’ file. This certificate must be added to the trusted Root Certification Authorities on all computers that use the MSIX package.

# Export the public key to a .cer file
$publicKeyPath = 'C:UsersDocumentsCodeCert.cer'
Export-Certificate -Cert $cert -FilePath $publicKeyPath

Step 2: Install the MSIX Packaging Tool

The MSIX Packaging Tool can be installed directly from the Microsoft Store or via WinGet.

To install from the Microsoft Store:

1. Open the Microsoft Store on your packaging VM.
2. Search for MSIX Packaging Tool.
3. Click Install.

Tip: Consider rebuilding your packaging VM between builds to reduce unexpected behavior. Always back up certificates and packaged files. Be sure to save the certificates, application packages, and application installation files between rebuilds.

Step 3: Create an MSIX Package from an MSI Installer

This example will use the PuTTY MSI installation file as an example of converting an MSI installer to an MSIX Package.

Steps:

1. Open the MSIX Packaging Tool and select ‘Create package on this computer’.

2. Check the Packaging Tool Driver and disable Windows Search if needed. It may take a few minutes for the driver to install. A reboot may also be required before continuing.

3. Select the MSI installer and specify silent install parameters if needed.

4. Sign the package with your .pfx certificate and add a timestamp URL. The Time Stamp URL is: http://timestamp.acs.microsoft.com

5. Update package details and complete installation steps.

6. Run the app to complete first-run setup and save the package (do not create it yet).

Step 4: Remove Problematic Dependencies from the MSIX Manifest

In the version of the MSIX Packaging Tool used for this video, a dependency on WindowsAppRuntime.1.4 was added and caused errors when the MSIX package is added to a client. The WindowsAppRuntime must be added with another tool or the dependency removed for the MSIX package to run. Follow the directions below to remove the dependency.

Fix:

1. Use the Package Editor to open the manifest file.

2. Remove the WindowsAppRuntime 4.1 package dependency from the ‘Dependencies’ section.

3. Remove the ‘desktop7’ entries from the ‘Extensions’ section.

4. Save and close the manifest file, then create the package.

Step 5: Create an MSIX Package from an EXE Installer

Repeat the process using .exe installer. This example uses VLC Player as the example.

Steps:

Launch the Packaging Tool and select ‘Create package on this computer’.
Select the VLC .exe installer and enter package details manually. The .exe installation file does not include application information.
Launch and close the app after install.
Open the manifest and remove dependency lines as outlined in Step 4.
Save and create the MSIX package.

Step 6: Test the MSIX Packages on a Separate Computer

Follow the steps below to validate the packages. The OS on the computer used to validate the packages should be as close to the packaging computer as possible.

Use a second VM with the same base image, or as similar as possible, as the packaging computer.
Copy the MSIX files and .cer certificate to the test computer.
Install the certificate to Trusted Root Certification Authorities.
1. Double click on the .cer certificate to install the certificate on the local computer.
1. Select the ‘Local Machine’ and place the certificate in the ‘Trusted Root Certification Authorities’ store.

Use PowerShell to install and verify the app:

Add-AppxPackage -Path "C:PathToYourApp.msix"

Use Get-AppxPackage to view the packages on added to the local computer.
- Pass in the -name parameter with the name of the package to return a specific package.
- Use the asterisk ‘*’ as a wildcard in the search.

Get-AppxPackage -name *vlc*

Use Remove-AppxPackage to remove an app.
- Provide the -package parameter with the full package name to remove the package.

Remove-AppxPackage -package

Summary

Creating an MSIX package from an existing installation can be a complex process. Before you begin, consult the software manufacturer to determine if an official MSIX package is available. Also consider engaging third-party vendors who specializes in application packaging before developing a custom solution. They may have already done the work.

The examples provided in this post and accompanying video cover relatively straightforward installations. When converting more complex applications with multiple dependencies to an MSIX package, it may be more effective to use advanced third-party packaging tools designed for such scenarios.

It is important to note that not all applications are compatible with conversion to the MSIX format. Before attempting to convert any application, thoroughly assess its compatibility and requirements.