
However if an on-premise certificate authority is not available then you may need to obtain a code signing certificate from a public certification authority. Symantec Phone certificates and Sideloading License keys are not required. Setting this to allow is all that is needed for devices that already trust the certificate used to sign the appx app.

Intune provides a device config policy called "Trusted app installation". You can unlock a device for sideloading using an enterprise policy.

In Windows 10/11, sideloading is different than in earlier versions of Windows:

For more information, see Windows 8 sideloading. Windows 8.1 Desktop requires either an enterprise policy to enable sideloading or the use of Sideloading Keys (automatically enabled for domain-joined devices).
