Does Windows App SDK package identity affect KeyCredentialManager credential scope?

[rprudchenko]

I am trying to understand how Windows App SDK, MSIX packaging, and package identity interact with Windows Hello / KeyCredentialManager. Context - a Windows desktop application protects high-value local secrets. One unlock mechanism uses Windows Hello through KeyCredentialManager. The application may be packaged with MSIX and may use Windows App SDK.

Observed concern:
A process running under the same Windows user account may be able to open a KeyCredential by name and trigger a Windows Hello prompt. If the user approves, that process can perform credential operations.

Questions:

1. Does Windows App SDK provide any app-level identity boundary for KeyCredentialManager credentials?
2. Does MSIX package identity change how KeyCredentialManager scopes credentials?
3. Are KeyCredentialManager credentials scoped by user or something else?
4. Is there any Windows App SDK API that should be used instead when protecting local high-value secrets?
5. Is AppData isolation from MSIX relevant to KeyCredentialManager credential isolation?
6. Should Windows Hello be treated only as a user presence/convenience factor rather than a sole key-release mechanism?

I am looking for guidance on whether Windows App SDK/MSIX can provide app-bound isolation for Windows Hello credentials, or whether this is controlled entirely by the underlying Windows.Security.Credentials API.

[dongle-the-gadget]

1. KeyCredentialManager is an OS-provided API, it is not specific to Windows App SDK.
2. For packaged apps, KeyCredentialManager is scoped by both user and package identity.
3. (see above)
4. KeyCredentialManager isn't a secure storage API. I'm not aware of any such secure storage API unfortunately, since Windows provides almost zero isolation between programs.
5. AppData isolation is separate from KeyCredentialManager scoping.
6. The purpose of the KeyCredentialManager API is similar to that of website passkeys.

[DrusTheAxe]

Does this help answer your questions?
https://learn.microsoft.com/en-us/answers/questions/5912130/what-is-the-security-boundary-of-windows-hello-key

[riverar]

@DrusTheAxe Is there anything in there that differs from Dongle's direct answers? (Hm I do see a lack of AppContainer mention, which I think is critical.)