How to publish a Tauri app to the Microsoft Store

Which route should you pick?

The certificate and hosting rows come from Microsoft's package requirements and Store policy 10.2.9, which also says an EXE or MSI installer has to install silently, can't download anything while it runs, and can't change after you submit its URL.

How to publish a Tauri app as an MSIX

1. 1

   Reserve the name

   In Partner Center, click New product, choose MSIX or PWA app and reserve your app's name. A reservation lasts three months if you don't use it. Then open Product identity under Product management and copy Package/Identity/Name, Package/Identity/Publisher and PublisherDisplayName.

2. 2

   Write the manifest

   Build your app for Windows with Tauri and put the .exe and the files it needs in a folder, with your logos in an images folder. Add an AppxManifest.xml based on Microsoft's manual packaging template. The identity values are case-sensitive, and the last number of the version must be 0.

   <?xml version="1.0" encoding="utf-8"?>
   <Package
     xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
     xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
     xmlns:uap10="http://schemas.microsoft.com/appx/manifest/uap/windows10/10"
     xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities">
     <Identity Name="(Package/Identity/Name from Partner Center)"
               Publisher="(Package/Identity/Publisher from Partner Center)"
               Version="1.4.0.0" ProcessorArchitecture="x64" />
     <Properties>
       <DisplayName>My App</DisplayName>
       <PublisherDisplayName>(PublisherDisplayName from Partner Center)</PublisherDisplayName>
       <Logo>images\StoreLogo.png</Logo>
     </Properties>
     <Resources>
       <Resource Language="en-us" />
     </Resources>
     <Dependencies>
       <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.19041.0" MaxVersionTested="10.0.26100.0" />
     </Dependencies>
     <Capabilities>
       <rescap:Capability Name="runFullTrust" />
     </Capabilities>
     <Applications>
       <Application Id="MyApp" Executable="MyApp.exe"
         uap10:RuntimeBehavior="packagedClassicApp" uap10:TrustLevel="mediumIL">
         <uap:VisualElements DisplayName="My App" Description="My App"
           Square150x150Logo="images\Square150x150Logo.png"
           Square44x44Logo="images\Square44x44Logo.png" BackgroundColor="#464646" />
       </Application>
     </Applications>
   </Package>

   The uap10 attributes need Windows 10 version 2004 (build 19041) or later, which is why MinVersion is 10.0.19041.0. For older versions, Microsoft's template uses an EntryPoint attribute instead. A full-trust desktop app like this one has to declare runFullTrust.

3. 3

   Pack and test it

   Before packing, you can register the folder to try the app without signing it. MakeAppx comes with the Windows SDK and packs the folder into an .msix. Then run the Windows App Certification Kit on the package.

   # try it from the folder, before packing
   Add-AppxPackage -Register staging\AppxManifest.xml
   
   MakeAppx pack /d staging /p MyApp_1.4.0.0_x64.msix
   
   # from an admin prompt, in the App Certification Kit folder
   appcert.exe reset
   appcert.exe test -appxpackagepath C:\path\MyApp_1.4.0.0_x64.msix -reportoutputpath C:\path\report.xml

4. 4

   Make the first submission

   Start a submission in Partner Center and fill in pricing and availability, properties, age ratings, the package and the Store listing. Microsoft's policies say Win32 products must always have a privacy policy, so enter its URL. Because the package declares runFullTrust, a restricted capability, the Submission options page asks you to explain why the app needs it. Then submit for certification, which Microsoft says can take up to three business days.

5. 5

   Publish updates

   For each new version, build, raise the version and pack a new .msix. You can upload it in a new Partner Center submission, or drop it on your app's page in StoreFast, which checks the name and version, translates What's new into every listing language and submits it.

From CI, add the StoreFast action after the step that runs MakeAppx. This is the shape the action's README shows for a Tauri app built on a Windows runner.

- name: Publish to the Microsoft Store
  if: matrix.os == 'windows' && hashFiles('MyApp_*_x64.msix') != ''
  uses: legendaryspy/storefast-publish@v1
  with:
    api-key: ${{ secrets.STOREFAST_API_KEY }}
    app: 9PJWF4W8V4WG
    package: MyApp_${{ needs.create-release.outputs.version }}_x64.msix

If your changelog covers macOS too, the action's exclude-lines-matching input drops lines that only concern other platforms before the notes are written. The GitHub Actions guide covers the rest.

How to publish Tauri's EXE or MSI instead

• In Partner Center, create the product as an EXE or MSI app and reserve the name, as Tauri's guide describes.
• Set WebView2 to the offline installer for the Store build. Tauri suggests a separate config file, like tauri.microsoftstore.conf.json, with bundle.windows.webviewInstallMode set to offlineInstaller.
• Sign the installer with a certificate from a CA in the Microsoft Trusted Root Program, upload it to a versioned HTTPS URL and enter that URL in Partner Center. For an NSIS installer, Tauri says the silent install argument is /S.
• Tauri also notes that your publisher name can't be the same as the product name. Set bundle.publisher if they clash.

Each update means a new installer at a new versioned URL. StoreFast doesn't publish EXE and MSI apps yet, and Microsoft's msstore CLI does.

Who it's for

Questions

Does Tauri build MSIX packages?

Not today. Tauri's Microsoft Store guide says Tauri only generates EXE and MSI installers. For an MSIX, you write a package manifest and run MakeAppx from the Windows SDK on your built app.

Do I need a code signing certificate for the Microsoft Store?

Not for an MSIX. Microsoft re-signs MSIX packages with its own certificate when they're published. An EXE or MSI installer submitted by URL is different, and you sign it yourself with a certificate from a CA in the Microsoft Trusted Root Program.

What about WebView2?

Microsoft says the Evergreen WebView2 Runtime is part of Windows 11 and that the vast majority of Windows 10 devices already have it, while a small number don't. Tauri's guide asks for its offline WebView2 installer when you submit its EXE or MSI. With an MSIX, Tauri's installer doesn't run, so handle a missing runtime the way Microsoft's WebView2 docs describe.

Can StoreFast publish my Tauri app?

If you ship it as an MSIX, yes, from the second release on. You make the first submission in Partner Center, then publish updates from the dashboard, a coding agent or the GitHub Action. EXE and MSI apps aren't supported yet.