What Is MSIX App Attach?

MSIX is a packaging format that offers many features to improve the application packaging experience for all Windows apps. MSIX app attach is different from regular MSIX because it’s made to work better for Azure Virtual Desktop. MSIX app attach is a way to deliver MSIX applications to both physical and virtual machines. Let’s learn what MSIX app attach is and what it can do for you.

MSIX app attach is the best out of all of these options, as it’s designed for Azure Virtual Desktop, and it provides apps dynamically to users at runtime and allows admins to centrally manage all applications.

What Does MSIX App Attach Do?

In an Azure Virtual Desktop deployment, MSIX app attach can create a separation between user data (profile), the operating system, and apps by using MSIX containers, which means you don’t need any configuration in the profile or operating system to attach specific applications at runtime and detach them once the user session ends. App attach does not require application repackaging when delivering applications dynamically. This option significantly reduces the time it takes for a user to sign in and reduce additional infrastructure costs for the application.

How to Create a Package with the MSIX Packaging Tool?

The MSIX Packaging tool is a Microsoft tool that allows you to repackage your existing desktop applications to the MSIX format. It offers both an interactive UI and a command line for conversions and gives you the ability to convert an application without having the source code. The MSIX Packaging tool is now available from the Microsoft Store, or you can download it from https://www.microsoft.com/p/msix-packaging-tool/9n5lw3jbcxkf. You can run your desktop installers through this tool and obtain an MSIX package that you can install on your machine.

The MSIX Packaging tool enables you to create an MSIX application package from MSI, EXE, ClickOnce, App-V, Script, and a manual installation. The MSIX Packaging tool currently supports App-V 5.1, but if you have a package with App-V 4.x, then you can use the source installer to convert it to MSIX.

Let’s go through the steps to capture the MSIX package using the MSIX Packaging tool. Once you install the MSIX Packaging tool, you will be prompted to provide consent to send telemetry data at first launch. Click “Application package” to create a new package. This tool also provides the ability to modify existing packages. See Figure 9-1.

Select a packaging method on the second screen and click Next. The following are the options you will use in the packaging method:

• If you are already working in a clean environment, select “Create package on this computer.”

• If you want to connect to an existing virtual or remote machine, select “Create package on a remote machine.”

• If you have a local virtual machine on your local VM that you want to convert, select “Create package on a local virtual machine.” Please note that we support only Hyper-V virtual machines; if you want to use another virtualization product, you can connect using the remote machine option. See Figure 9-2.

MSIX will prepare the computer on the next screen. The MSIX Packaging tool driver is required, and the tool will automatically try to enable it, if it is not already enabled. The tool will first check with DISM to see if the driver is installed. Also, it will show some recommendations such as disabling Windows Update or Windows Search, so you can select the checkbox and click “Disable selected.” See Figure 9-3.

You can select an existing installer in case you already have MSI, App-v, EXE, ClickOnce, or script files; otherwise, you can click Next and the MSIX Packaging tool will create the installer file for you, and then you can install the application manually during the installation phase.

If you have any installer arguments, you can enter the desired argument(s) in the “Specify installer arguments” field. This field accepts any string.

I will be using the VLC MSI installer and self-sign certificate for demonstration purposes. See Figure 9-4 .

After you choose to package your application on an existing virtual machine, you must provide information about to the app. The tool will try to autofill these fields based on the information available from the installer. If not, then you must provide all the information on the package information page. See Figure 9-5.

This is the installation phase where the tool is monitoring and capturing the application install operations. The tool will launch the installer in the environment that was specified previously, and you’ll need to go through the installer wizard to install the application. Make sure the installation path matches what was defined earlier in the package information page. See Figure 9-6.

This page shows application executables that the tool captured. It’s recommended to launch the application at least once, to capture any first launch tasks. You can launch the executable by selecting it and then clicking Run. You can also remove any unnecessary entry points by selecting it and then clicking Remove.

Click Next, and you’ll be prompted with a pop-up asking for confirmation that you’re finished with the application installation and managing first-launch tasks. If you’re done, click “Yes, move on.” See Figure 9-7 and Figure 9-8.

The MSIX Packaging tool can convert an installer with services, and it will be visible on the Services report page. If no services were detected, you will still see this page, but it will be empty with a message that “No services were detected” at the top of the page.

In my case, I am using VLC, which does not install any services, so no service was detected. See Figure 9-9.

Provide a location for saving the MSIX package. Click Create to create the MSIX package. See Figure 9-10.

You’ll be presented with a pop-up when the package is created. This pop-up will include the save location, linked to the file location of the newly created package. See Figure 9-11.

The next step is to unpack the MSIX package to a .vhd or .vhdx file so that you can upload the VHD file to a share folder, where it will be accessible from all Azure Virtual Desktop VMs (read permission). The unpack operation can be performed by the MSIXMGR tool, and it can be downloaded from https://aka.ms/msixmgr. See Figure 9-12.

Now that you have created the image, go to the destination folder, and make sure you successfully created the MSIX image (.vhdx). The next step is to upload the .vhdx file to be file share accessible from all Azure Virtual Desktop session hosts with read access.

Once the package is ready in .vhdx and uploaded to a file share, then you can add the MSIX package to the Azure Virtual Desktop by using the Azure portal or PowerShell.

Recommendations to Avoid Issues with MSIX Packaging

Set Up MSIX App Attach with the Azure Portal

Here are the steps to set up an MSIX image in Azure Virtual Desktop.

Add an MSIX image to the host pool. Next you will need to add the MSIX image to your host pool. Go to the Azure portal and browse the host pool on which you want to add the MSIX package. Follow these steps to add the MSIX image .vhdx file:

1. 1.

   Go to the host pool where you want to add the MSIX package.

    
2. 2.

   Select MSIX packages to open the data grid with all the MSIX packages currently added to the host pool.

    
3. 3.

   Select + Add to open the Add MSIX package tab.

    
4. 4.
   In the Add MSIX package tab, enter the following values:

   • For the MSIX image path, enter a valid UNC path pointing to the MSIX image on the file share (for example, \storageaccount.file.core.windows.netmsixshareappfolderMSIXimage.vhd). When you’re done, select Add to interrogate the MSIX container to check if the path is valid.

   • For the MSIX package, select the relevant MSIX package name from the drop-down menu in case multiple packages exist in one image. This menu will be populated only if you’ve entered a valid image path in MSIX image path.

   • For the package applications, make sure the list contains all the MSIX applications you want to make available to users in your MSIX package.

   • Optionally, enter a display name if you want your package to have a more user-friendly name in your user deployments.

   • Make sure the version has the correct version number.

   • Select the registration type you want to use. Which one you use depends on your needs.

   • “On-demand registration” postpones the full registration of the MSIX application until the user starts the application. This is the registration type we recommend you use so that the application will be registered only if the user is going to use it and it will help to improve user performance.

   • “Log on blocking” registers only while the user is signing in. We don’t recommend this type because it can lead to longer sign-in times for users.

    
5. 5.
   For State, select your preferred state.

   • The Active status lets users interact with the package.

   • The Inactive status causes Azure Virtual Desktop to ignore the package and not deliver it to users.

    
6. 6.

   When you’re done, select Add. See Figure 9-13.

    

Publish MSIX apps to an app group. Next, you’ll need to publish the apps to the package. You’ll need to do this for both desktop and remote app application groups. You can publish MSIX app to both fill the desktop and remote-app app group. See Figure 9-14.

Select the full desktop application group and go to Applications. Click the Add button on the Application tab. The pop-up will allow you to select package from the MSIX added to the host pool. Once you add the application, it will be visible for all users assigned on the full desktop application group. See Figure 9-15.

You can log in with a test user account to verify if the application is mounted on the VM. See Figure 9-16.

Select or create the remote app application group. You will be prompted to select the package from the MSIX package while adding the application in the remote-app application group. Once you add the application, it will be visible for all users assigned (under assignment) on the Remote-app application group. See Figure 9-17.

You can log in with a test user on the remote desktop app, and you will be able to see the MSIX application published via the remote app. See Figure 9-18.

As you know, now that we can publish MSIX app on the host pool itself, there are a few other options available through which we can attach the MSIX app image at the time of user login scripts via Group Policy.

You can select the MSIX app attach option based on your requirements and complexity.

Where to Use Application Masking?

Application masking can be used with full desktop pooled Azure Virtual Desktop instances where you need multiple small applications for different groups of users.

For example, let’s consider you have 100 users out of which 50 users want Visual Studio Code, 50 users want Microsoft Office, but all 100 users want the Chrome browser. Now in this case you can create two different host pools, the first one with Visual Studio Code and Chrome for the first 50 users and Microsoft Office and Chrome for another set of 50 users, but you must create two different images, and host pools management will be difficult. Infrastructure costs will be higher, because you must keep a minimum number of VMs running in both pooled host pools.

The alternative is to create a single host pool and install all three applications, and you can add application masking to allow the first 50 users to access Visual Studio Code plus Chrome, and second group of 50 users to access Microsoft Office plus Chrome. By doing that you will be saving infrastructure costs, since there will be a single host pool and fewer VMs will be running during off business hours. Additionally, autoscaling will allow you to stop all VMs if they are not in use.

How to Create Application Masking Rules?

You can apply application masking in the image itself, but you need the FSLogix rule editor to create an application masking rule. FSLogix Rules Editor setup comes with the FSLogix download, so once you download the FSLogix zip file, you can run FSLogixAppsRuleEditorSetup.exe to install the rule editor.

Make sure that the application you want to add in app masking is system centric and not user centric. This applies for all applications you want to install on pooled desktops as if the application is user centric; then the application setup will get stored in user AppData, and other users will not be able to access it.

Once you install the rule editor, you can create app masking rules. Open the FSLogix Rules Editor in elevated mode to create your first rule. Click New from the File menu (or the New button in the top bar). See Figure 9-19.

Now enter a name for the rule and save it in C:Program FilesFSLogixAppsRules. Now select an application from the list in the pop-up and click the Scan button. See Figure 9-20.

FSLogix will find out all the dependencies for the selected application (called hiding rules) and show you them in the rule screen. See Figure 9-21.

Right-click the rule name and click “Apply rules to system.” The rules that are within your rule set will be applied to your system. If your rule was a hiding rule on an application, the application will no longer be visible on the system. See Figure 9-22.

Rule set assignments specify how the rules in the rule set will be applied. To create and manage rule assignments, click File and then Manage Assignments. By default, everyone is set to No, which means everyone is allowed to access the selected application. See Figure 9-23. It’s confusing, but here are the assignment access rules:

Everyone set to No (Not apply): all Allowed

Everyone set to Yes (apply): all deny

The next step is to set everyone to Yes so it will block everyone and add the group that you want to allow access for and set it to NO. Click Add to create a new rule assignment, select : group for better assignment management, and set it to NO (Not Apply). See Figure 9-24.

Create the same kind of rules for all different applications with different users’ groups in the C:Program FilesFSLogixAppsRules folder on all session hosts. If you are creating rules in an image itself, then the rules will be there on all session hosts. Verify if there are two files for each rule, one for the rule and another for the assignment. See Figure 9-25.

How to Install OneDrive in Per-Machine Mode?

The deployment steps are simple; you can download OneDriveSetup.exe from https://www.microsoft.com/en-us/microsoft-365/onedrive/download and then run OneDriveSetup.exe /allusers from a command prompt window (Elevated mode). Alternatively, you can use the Microsoft Endpoint Configuration Manager to do this on an all-session host or VM image. This will install the sync app in the Program Files (x86)Microsoft OneDrive directory. When setup completes, OneDrive will start. See Figure 9-32.

If you are doing the setup on an existing session host, where you have users using the Microsoft 365 suite and accounts were added on that computer, they’ll be migrated automatically.

How to Redirect and Move Windows Known Folders to OneDrive?

There are two primary advantages of moving or redirecting Windows known folders (Desktop, Documents, Pictures, Screenshots, and Camera Roll) to Microsoft OneDrive for the users in your domain; first your users can continue using the folders they’re familiar with. They don’t have to change their daily work habits to save files to OneDrive, and saving files to OneDrive backs up your users’ data in the cloud and gives them access to their files from any device.

Before you redirect known folders, make sure you are using the latest OneDrive build or upgrade to the latest available build before you deploy to decrease deployment issues.

OneDrive policies can be set using Group Policy, using Intune Windows 10 administrative templates, or configuring the Registry settings.

The following policy control the Known Folder Move feature:

• Prompt users to move Windows known folders to OneDrive: Use this setting to give the users a call to action to move their Windows known folders. See Figure 9-33.

If users dismiss the prompt, a reminder notification will appear in the activity center until they move all known folders. If a user has already redirected their known folders to a different OneDrive account, they'll be prompted to direct the folders to the account for your organization (leaving existing files behind).

List of OneDrive Policies You Must Check

Verify Media Optimizations Are Loaded

After installing the WebSocket Service and the Teams desktop app, follow these steps to verify that Teams media optimizations has been loaded (see Figure 9-36):

1. 1.

   Quit and restart the Teams application.

    
2. 2.

   Select your user profile image and then select About.

    
3. 3.

   Select the version.

    

Customize the Group Policies Properties of Your Session Host

It is recommended that you implement the following policy on the session host so that the app privacy allows Teams to use the camera and microphone. Implement the following settings in the GPO and apply it on all pooled session hosts:

RDP Properties for a Host Pool to Enable Video and Audio

How to Create an Application Group?

You can log in to the Azure portal and go to a Azure Virtual Desktop and select the host pool where you want to create the application group. Click the Add button, provide the application group name, and make sure to select the correct application group type (RemoteApp/Desktop); then click the Next button to go to the next tab. See Figure 9-38.

Once you add all the information, click the “Review + create” button to create the application group.

Refer to the RemoteApp section for more details about the RemoteApp application detail and steps.