On a desktop or a tablet: You can install an .appx and any certificate that is needed to run the app with the PowerShell script that is created with the package. Or you can use manual steps to install the certificate and package separately.
On a Windows Phone: You can only sideload apps that have trust for that app on the device. Basically the certificate already needs to be on the device. For example, if you use a common certificate like Symantec that is already installed, or a certificate that has been added to your device by your organization. Your company can use mobile device management to add certificates that have been approved. If the certificate needed for your app is there on your mobile device, you can choose sideload apps for your settings for Windows Phone.
Sideload apps is a more secure option than developer mode because you cannot install apps that are not trusted on the device.
Developer mode
On a desktop or a tablet: You can debug your apps on that device if you choose developer mode. It replaces the Windows 8.1 requirement for a developer license. You can also sideload any apps if you choose developer mode, even ones that you have not developed on the device. You just have to install the .appx with its certificate for sideloading.
On a Windows Phone:You can install any app package (.appx) and run it without needing the certificate. Basically you are putting your phone in testing mode to install and try out an app that you trust. Do not install apps that you do not trust in this mode. You can install any .appx sent to you via email or on an SD card. Click the file to install if you have chosen developer mode for your settings.
Use the WinAppDeployCmd tool to deploy from a Windows 10 machine to any Windows 10 Mobile device that is connected to the same subnet of the network by a wired or wireless connection. The Windows 10 Mobile device can be connected by USB too. WinAppDeployCmd.exe can be used to install apps, but it doesn’t install certificates. Learn more about the WinAppDeployCmd tool.