How to run a WinUI 3 singleProject App with less than fullTrust?

[avsteele]

I if just use the "Blank App, Packaged" template I cannot find a way to run it with other than full trust.

The advice given in #3435 and other places https://nicksnettravels.builttoroam.com/winui-appcontainer/ does not appear to work.

I'll note that in the relevant part of Package.appmanifest I see

  <Capabilities>
    <rescap:Capability Name="runFullTrust" />
  </Capabilities>

the rescap line gives a green squiggly error as an invalid element...but if I comment this out I can't run the app, it says need to be deployed before we can debug It says this regardless of whether 'deploy' is checked in config manager so I think the error message is erroneous.

[DarranRowe]

After removing the runFullTrust restricted capability, you need to explicitly set the EntryPoint of the Application element to windows.partialTrustApplication. The specifics of what this means are documented in the Application's documentation.
If it doesn't exist, you also need to add the mp:PhoneIdentity element to the manifest too.

[avsteele]

Thank you for the help! I got hung up when following the advice in the other link and the "uap10:..." entries caused an error.

Per your advice I confirm it works with the manifest below which is only changed form the default in that capabilities is commented out and the value of <Application EntryPoint="..." is changed from $targetentrypoint$ to windows.partialTrustApplication.

Now when it runs Process Explorer shows as its integrity as AppContainer rather than the value of Medium it shows with the defaults.

(some GUID's replaced with ...)

<?xml version="1.0" encoding="utf-8"?>

<Package
  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
  xmlns:mp="http://schemas.microsoft.com/appx/2014/phone/manifest"
  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
  IgnorableNamespaces="uap rescap">

  <Identity
    Name="..."
    Publisher="CN=avste"
    Version="1.0.0.0" />

  <mp:PhoneIdentity PhoneProductId="..." PhonePublisherId="00000000-0000-0000-0000-000000000000"/>

  <Properties>
    <DisplayName>EyeBreak</DisplayName>
    <PublisherDisplayName>avste</PublisherDisplayName>
    <Logo>Assets\StoreLogo.png</Logo>
  </Properties>

  <Dependencies>
    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.19041.0" />
    <TargetDeviceFamily Name="Windows.Universal" MinVersion="10.0.17763.0" MaxVersionTested="10.0.19041.0" />
  </Dependencies>

  <Resources>
    <Resource Language="x-generate"/>
  </Resources>

  <Applications>
    <Application Id="App"
      Executable="$targetnametoken$.exe"
      EntryPoint="windows.partialTrustApplication"
	>
      <uap:VisualElements
        DisplayName="EyeBreak"
        Description="EyeBreak"
        BackgroundColor="transparent"
        Square150x150Logo="Assets\Square150x150Logo.png"
        Square44x44Logo="Assets\Square44x44Logo.png">
        <uap:DefaultTile Wide310x150Logo="Assets\Wide310x150Logo.png" />
        <uap:SplashScreen Image="Assets\SplashScreen.png" />
      </uap:VisualElements>
    </Application>
  </Applications>

  <Capabilities>
    <!--<rescap:Capability Name="runFullTrust" />-->
  </Capabilities>
</Package>