MSIX app install reports success but Add-AppxPackage fails for current user when run as Local System

[GrayW]

Fleet versions

• Discovered: 4.84.2
• Reproduced: 4.84.3

Web browser and operating system: Windows

---

💥 Actual behavior

When Fleet installs an MSIX-based Fleet-maintained app (e.g. Claude), the installation script reports Success and the provisioning step (Add-AppxProvisionedPackage) appears to complete, but the subsequent Add-AppxPackage step for the current user (local system) fails with:

Deployment failed with HRESULT: 0x80073CF9, Install failed. Please contact your software vendor.
Deployment Add operation rejected on package <AppName> from: <app>.msix install request because the Local System account is not allowed to perform this operation.

Full response:

Installing software...
Success
Provisioning MSIX for all users...

Path          : 
Online        : True
RestartNeeded : False

Registering MSIX for current user (best-effort)...
Add-AppxPackage skipped or failed (provisioned install may still be valid): Deployment failed with HRESULT: 0x80073CF9, Install failed. Please contact your software vendor. (Exception from HRESULT: 0x80073CF9)
Deployment Add operation rejected on package Claude_1.7196.0.0_x64__pzs8sxrjxfjjc from: Claude.msix install request because the Local System account is not allowed to perform this operation.

NOTE: For additional information, look for [ActivityId] 917743a2-e2c0-0000-8ce8-7891c0e2dc01 in the Event Log or use the command line Get-AppPackageLog -ActivityID 917743a2-e2c0-0000-8ce8-7891c0e2dc01

🛠️ To fix

TODO

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.

1. In Fleet, navigate to Software > App catalog and select an MSIX-based Fleet-maintained app (e.g. Claude).
2. Add the app to a team and assign it to a host via a policy or manual install.
3. Trigger the install on a Windows host via the Fleet agent (running as Local System).
4. Observe the install logs — Success is reported after provisioning, but Add-AppxPackage fails with HRESULT 0x80073CF9 because the Local System account cannot perform per-user package registration.

🕯️ More info (optional)

• The provisioned install (Add-AppxProvisionedPackage) likely succeeds, and the app will be available to users, and is expected to fail when running as Local System.
• The log line Add-AppxPackage skipped or failed (provisioned install may still be valid) suggests the script already attempts to handle this gracefully, but the error is still surfaced in a way that may confuse admins.
• This issue is expected to affect all MSIX-based Fleet-maintained apps using the same install script pattern, not just Claude.
• HRESULT 0x80073CF9 = APPX_E_DEPLOYMENT_FAILED is a Windows error when Local System attempts Add-AppxPackage.
• Detect the Local System context and suppress the error so it is not surfaced as a failure?