Support sideload MSIX auto-update via AppInstaller in Low Integrity apps

We are currently using a WinUI 3 application packaged and deployed as an MSIX Bundle (.msixbundle) via sideloading, using an AppInstaller file. This approach is working fine in standard integrity levels, and updates are being handled via the AppInstaller auto-update mechanism.

However, in our scenario, the application needs to run in a Low Integrity Level for security isolation purposes. Under this constraint:

• The application cannot initiate or trigger auto-updates.

The AppInstaller service appears to be inaccessible from the low-integrity context.

Manual update attempts also fail silently or are blocked.

🔹 We are specifically using .msixbundle (not .msix) to support multiple architectures in a single deployment.

💡 Feature Request / Concern:

We'd like guidance and/or support for either:

Enabling MSIX Bundle auto-updates via AppInstaller when running in Low Integrity.

Official Microsoft-recommended alternatives to support secure auto-updates for apps in sandboxed or restricted environments.

Questions:

Is there a supported mechanism to initiate or delegate updates from a background service or helper?

Is Microsoft planning support for these scenarios in future versions of Windows or AppInstaller?

Thank you!We are currently using a WinUI 3 application packaged and deployed as an MSIX Bundle (.msixbundle) via sideloading, using an AppInstaller file. This approach is working fine in standard integrity levels, and updates are being handled via the AppInstaller auto-update mechanism.

However, in our scenario, the application needs to run in a Low Integrity Level for security isolation purposes. Under this constraint:

The application cannot initiate or trigger auto-updates.

The AppInstaller service appears to be inaccessible from the low-integrity context.

Manual update attempts also fail silently or are blocked.

🔹 We are specifically using .msixbundle (not .msix) to support multiple architectures in a single deployment.

💡 Feature Request / Concern:

We'd like guidance and/or support for either:

Enabling MSIX Bundle auto-updates via AppInstaller when running in Low Integrity.

Official Microsoft-recommended alternatives to support secure auto-updates for apps in sandboxed or restricted environments.

Questions:

Is there a supported mechanism to initiate or delegate updates from a background service or helper?

Is Microsoft planning support for these scenarios in future versions of Windows or AppInstaller?

Thank you!