MSIX and ConfigMgr: Freedom from Package Paralysis

MSIX is a new Microsoft packaging technology. It takes the best features from setup.exe, MSI, Windows ClickOne, App-V and script.vbs, and puts them to use. This is the first packaging product from Microsoft in 10 years. MSIX is aimed at being a common packaging tool for both Universal Windows Platform (UWP) and Win 32apps.

The intention is to remove packaging paralysis. More specifically, it's to stop the vicious cycle of receiving an application, packaging it for deployment, updating the Windows OS, updating the app for the new OS, creating a new package for the updated OS, updating the Windows OS again, and so on.

MSIX will preserve the functionality of existing application packages. This allows you to reuse and convert while adding new modern packaging and deployment features to that package, such as:

Microsoft has released a packaging tool to allow IT Pros to create an MSIX package for any Windows app. Since the release of ConfigMgr 1806, it has been possible to add in the MSIX format when creating an application for deployment.

With the release of ConfigMgr 1810, the ability to convert existing MSI based applications, directly from within the console, has been introduced. There are some caveats and pre-requisites. Let’s explore what these are:

Caveat

The ability to code sign the application directly within the console has not made it into the 1810 ConfigMgr release. Therefore, the application must be signed independently after it has been created. This is achieved using the Signtool utility from the Windows 10 SDK.

Prerequisites

To kick-start building your first MSIX application, you will need to obtain a code signing certificate. This can be either a publicly issued code signing certificate or one from an internal certificate authority (CA). Microsoft has a great blog post about the process of creating a code signing certificate.

There are some important things to note in this blog. Ensure that you have your security permissions set up correctly, so that you are able to enroll the certificate later. Allow the private key to be exported. On the reference Windows 10 device, load MMC as the current user and make a note of the Common Name you set for the certificate. You will need this when converting your application to MSIX. Finally, if you are using an internal CA, make sure you have the trusted root certificate deployed to devices that need it.

With everything in place, you will be ready to convert your existing MSI applications in the ConfigMgr console. Head on over to Software Library>Overview>Application Management>Applications and find an MSI-based application to convert. I’ve selected to convert the ConfigMgr 2012 Toolkit MSI. If you right-click the application there is an option to Convert to .MSIX. If the application is not of the correct type, then Convert to .MSIX will be greyed out. You will also see the Convert to .MSIX option is available in the console ribbon.

The .MSIX conversion wizard will appear. If the pre-requisites have not been met, then you will be warned at this stage.

There’s a check box to enable diagnostic data about the packaging tool to be sent to Microsoft. It might be worth leaving this switched on to help improve the service.

On the next screen, you will need to enter the subject name of the certificate. This is the Common Name entered earlier when enrolling the certificate; make sure this matches what was entered previously. Also at this stage, you need to enter a location to which the outputted MSIX file can be saved.

Since the signing of the application did not make it into the ConfigMgr 1810 release, then we need to use the signtool utility from the Windows 10 SDK. With the SDK installed navigate to the C:Program Files (x86)Windows Kits10bin10.0.17763.0x64 folder as an administrator in CMD.

The full details on Signtool and its parameters are documented here,  but the command syntax we need to run is:

signtool sign /fd  /a /f .pfx /p  .MSIX

You will be notified of a successful signing.

The application is now in a state where it is ready for deployment. For this demonstration, I am going to manually install the MSIX, but, as stated, this could be consumed in ConfigMgr and pushed out via the Software Center.

First up, though, we need to ensure that sideloading of MSIX apps is allowed on your Windows 10 devices.

This can be switched on manually in Settings>Update & Security>For developers or you can use group policy to achieve this across your environment. The policy to use is Computer Configuration>Administrative Templates>Windows Components>App Package Deployment>Allow all trusted apps to install.

OK, let’s install that first MSIX application. When you double-click the MSIX file, you will be presented with an Install MSIX window. Here you can set to launch the application directly after completion and an Install button.

This addition to the console is a neat way to quickly and efficiently convert your existing MSI files to the new format.

If you want to delve deeper into MSIX packaging, then you can use the packaging tool independently to the ConfigMgr console. The packaging tool allows you to define launch tasks; it also allows you to create a modification package.

A modification package is a special MSIX package that has a dependency from the main package and can’t be installed independently. You could use this to customize an application. Each time the customizations need to change, then only the modification package needs to be altered. Or you could package add-ons or plug-ins as modification packages. Hopefully, over time this flexibility will be added into the ConfigMgr console so we can use it as a one-stop shop for our packaging and deployment needs.

Since you have read this far, I’m going to venture a guess that you are a ConfigMgr admin working with Windows 10. If that’s true, you might be interested in a webinar I’m presenting with Maurice Daly on Feb. 12. In addition to presenting in-depth demos/discussion of key ConfigMgr+Windows 10+Security topics, we’ll have live Q&A. More information is below:

Webinar
Feb. 12 9 a.m. PST / 12 p.m. EST / 5 p.m. GMT
Wrangling Windows 10 Security with ConfigMgr

Happy packaging!

Paul Winstanley is a Microsoft MVP and ConfigMgr certified consultant. Based out of London, Paul has 20 years of IT experience. He has spent a decade specializing in deploying ConfigMgr and advising clients how to use it effectively. He relentlessly contributes to the ConfigMgr and Intune community. Follow him on LinkedIn and Twitter, and check out his blog at SCCMentor.