Desktop App Installer

Enable App Installer Allowed Zones for MSIX Packages

ComputerNeeds changes for IntuneEnableMsixAllowedZones

Supported on SUPPORTED_Windows_10_0_RS5 (defined in the Windows templates)

1.29.380

What it does

This policy controls whether App Installer allows installing packages originating from specific URL Zones. A package's origin is determined by its URI and whether a Mart-of-the-Web (MotW) is present. If multiple URIs are involved, all of them are considered; for example, when using a .appinstaller file that involves redirection. If you enable this policy, users will be able to install MSIX packages according to the configuration for each zone. If you disable or do not configure this policy, users will be able to install MSIX packages from any zone except for Untrusted.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: Software\Policies\Microsoft\Windows\AppInstaller
Value name: EnableMsixAllowedZones
When enabled: DWORD 1
When disabled: DWORD 0

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

Options

Option	Type	Registry value	Allowed values
Local MachineDefault: Allow	Drop-down list	`Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZonesLocalMachine`	Block`0` Allow`1`
IntranetDefault: Allow	Drop-down list	`Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZonesIntranet`	Block`0` Allow`1`
Trusted SitesDefault: Allow	Drop-down list	`Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZonesTrustedSites`	Block`0` Allow`1`
InternetDefault: Allow	Drop-down list	`Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZonesInternet`	Block`0` Allow`1`
Untrusted SitesDefault: Block	Drop-down list	`Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZonesUntrustedSites`	Block`0` Allow`1`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller]
"EnableMsixAllowedZones"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones]
"Internet"=dword:00000001
"Intranet"=dword:00000001
"LocalMachine"=dword:00000001
"TrustedSites"=dword:00000001
"UntrustedSites"=dword:00000000

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Enable App Installer Allowed Zones for MSIX Packages
# Name: EnableMsixAllowedZones
# Scope: Machine
# State: Enabled
# Source: DesktopAppInstaller.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller' -Name 'EnableMsixAllowedZones' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'LocalMachine' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'Intranet' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'TrustedSites' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'Internet' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'UntrustedSites' -PropertyType 'DWord' -Value 0

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_DesktopAppInstaller/EnableMsixAllowedZones

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_DesktopAppInstaller/EnableMsixAllowedZones</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="LocalMachine" value="1"/&gt;
&lt;data id="Intranet" value="1"/&gt;
&lt;data id="TrustedSites" value="1"/&gt;
&lt;data id="Internet" value="1"/&gt;
&lt;data id="UntrustedSites" value="0"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Enable App Installer Allowed Zones for MSIX Packages
# Name: EnableMsixAllowedZones
# Scope: Machine
# State: Enabled
# Source: DesktopAppInstaller.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller' -Name 'EnableMsixAllowedZones' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\EnableMsixAllowedZones') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'LocalMachine' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones\LocalMachine') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'Intranet' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones\Intranet') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'TrustedSites' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones\TrustedSites') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'Internet' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones\Internet') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'UntrustedSites' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones\UntrustedSites') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Enable App Installer Allowed Zones for MSIX Packages
# Name: EnableMsixAllowedZones
# Scope: Machine
# State: Enabled
# Source: DesktopAppInstaller.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller' -Name 'EnableMsixAllowedZones' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'LocalMachine' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'Intranet' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'TrustedSites' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'Internet' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones' -Name 'UntrustedSites' -PropertyType 'DWord' -Value 0

History 24 retained releases

1.10.32024 Feb 2025
- Translations changed; choose a language above to compare its wording.
1.9.2518028 Oct 2024
- Added in this release.

14 later releases left it unchanged.

Template

Internal name: EnableMsixAllowedZones
Namespace: Microsoft.Policies.AppInstaller
Template file: DesktopAppInstaller.admx
Release: WinGet 1.29.380 · file set 11a1c20074c1ef1d…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.EnableMsixAllowedZones)" explainText="$(string.EnableMsixAllowedZonesExplanation)" key="Software\Policies\Microsoft\Windows\AppInstaller" name="EnableMsixAllowedZones" presentation="$(presentation.MsixAllowedZones)" valueName="EnableMsixAllowedZones" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.AppInstaller:AppInstaller" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows_10_0_RS5" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
      <elements>
        <enum id="LocalMachine" key="Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones" required="false" valueName="LocalMachine">
          <item displayName="$(string.ZoneBlocked)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.ZoneAllowed)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
        <enum id="Intranet" key="Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones" valueName="Intranet">
          <item displayName="$(string.ZoneBlocked)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.ZoneAllowed)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
        <enum id="TrustedSites" key="Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones" valueName="TrustedSites">
          <item displayName="$(string.ZoneBlocked)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.ZoneAllowed)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
        <enum id="Internet" key="Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones" valueName="Internet">
          <item displayName="$(string.ZoneBlocked)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.ZoneAllowed)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
        <enum id="UntrustedSites" key="Software\Policies\Microsoft\Windows\AppInstaller\MsixAllowedZones" valueName="UntrustedSites">
          <item displayName="$(string.ZoneBlocked)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.ZoneAllowed)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="MsixAllowedZones" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="1" noSort="true" refId="LocalMachine">Local Machine</dropdownList>
        <dropdownList defaultItem="1" noSort="true" refId="Intranet">Intranet</dropdownList>
        <dropdownList defaultItem="1" noSort="true" refId="TrustedSites">Trusted Sites</dropdownList>
        <dropdownList defaultItem="1" noSort="true" refId="Internet">Internet</dropdownList>
        <dropdownList defaultItem="0" noSort="true" refId="UntrustedSites">Untrusted Sites</dropdownList>
      </presentation>

Supported platforms and category

Microsoft.Policies.AppInstaller:category:AppInstaller
<category displayName="$(string.AppInstaller)" name="AppInstaller" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.AppInstaller:unresolved:Microsoft.Policies.Windows:SUPPORTED_Windows_10_0_RS5
<unresolved reference="Microsoft.Policies.Windows:SUPPORTED_Windows_10_0_RS5" />
Microsoft.Policies.AppInstaller:unresolved:Microsoft.Policies.Windows:WindowsComponents
<unresolved reference="Microsoft.Policies.Windows:WindowsComponents" />
Microsoft.Policies.AppInstaller:category:AppInstaller
<category displayName="$(string.AppInstaller)" name="AppInstaller" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.AppInstaller:AppInstaller">Desktop App Installer</string></strings>