Hey Dean - Thanks for taking the time to post this content! Question... Is it possible to publish these apps to the "Full desktop" via WVD uniquely for specific users? Like if 2 users connect to the desktop but only the apps they have access to attach - so we don't have to use FSLogix Masking Rules to control the apps visible from the desktop?
Hmm... it seems perhaps MSIX applications attach in the full desktop even when they're deployed as Remote Apps in Remote App groups. If this is by design... flawless!
Yes, FSLogix masking rules are not required. Understand that there are 2 sides to app attach The attaching part on the VM The assigning the user part So the apps will attach and be available but only those users who are assigned can see it and use it
another excellent video. i've been holding off on using msix attached apps until it's GA but it looks like this is what MS is going to be transitioning to as its "offical" way of modern app deployment and it's just freaking cool.
HI Dean, now the NTFS permissions don't seem to be necessary anymore, just get the file share connected to domain and check if you can access it from the acc who had smb azure permissions, place the mxix package and ur done
Hi Dean! As always, great video. I'd love to see one on maintaining an MSIX/VHDX. IE: If we were to use Acrobat or Quickbooks in MSIX form, what's the most effective way to patch it, etc?
Thanks Seth...Not sure if there is a full video here...but you have 2 choices 1. Create an updated package and have the original package as a prerequisite 2. Create a new package from the new full install version of the app. How you would do this would be different for each app
Yes I will cover how to create MSIX packages, convert the package into a hard drive and setup MSIX AppAttach in the portal...as well as the future of managing WVD with AppAttach...please share the video with everyone 😎
@@AzureAcademy To be honest, you already have quite a lot of video's which I need, so I don't want to ask you for something you already made. When I find something you don't already have covered, I will suggest it. Thank you for replying!
Hi Dean having much fun following along with this video - could i ask a quick question? All is good up to the point where i am adding the computer object group to the share, troubleshooting this it seems the group i created has synced across to AAD but not the members (computer objects) LOL, is this normal behavior for AAD connect not to sync computer objects? By the way just want to shout out the massive amount of work you must have done to get put your video's together, im sure it takes a lot of trial and error to get 20 mins of gold contents - excellent work sir. Also kudos to MS - that packaging tool is awesome
Thanks Mark, it takes a long time to create each video…6-12 hours depending if I have to learn the feature too ☺️ as for the computers not syncing…check the sync logs Also that computers are in an OU that is syncing Check any sync rules for exclusions that may be blocking the computers
@@AzureAcademy After doing some digging it seems the userCertificate attribute on the computer object needs to be populated. Mine were not. I built up a CA and the computers were issues certificate. This populated the attribute and now the computer objects have synced. I wouldn't have come across this problem in prod as we have a CA infrastructure setup but in the lab i didnt. Anyway, interesting point to note if anybody else gets this issue - hopefully may help.
Hi Dean, what should be the DNSName and Subject in Cert Generation script. Is Code.MSAzureAcademy.com the DNS server of your domain? Sorry to ask this silly question~
In my example of a self signed cert it can be anything and doesn’t matter, but when dealing with a cert from a real certificate authority the subject name is the name of the cert The DNSName is Fully qualified name
Hi Dean - Wow- mind blown. we are migrating apps running on an old citrix farm to remote app via AVD, we have some old proprietary apps installed nobody has the software for and the original admin has long since left the building- im sure you know the scenario LOL. I'm wondering if i can run MSIX packager on the server they are installed on and package them up into a msix app? is this possible without the original software? Cheers Mark T - keep up the great content!!
Thanks Mark! To package you need the installer and it is recommended to package on a clean VM that is basically identical to the VM you want to run the app on
@@AzureAcademy Hi Dean - thank you so much for clarifying. We dont have the installer so msix appattach is probably not the solution for this app but very useful for others we have to deliver as part of our project so many thanks for giving us the knowledge to proceed down this road. About time these old 90's apps were retired anyways LOL thanks again, Mark.
I have run into complex applications even ones that I “would not” try to package...like the entire office suite. visual studio complexity depends on how you install it. One tool I would suggest for complex, troublesome apps is PSFTOOLING
@10:47, I don't understand what you mean by "local machine"? My management PC? The machine running as my AVD? Why does the local machine need the self signed cert installed on it?
Just watched @10:47 again…I don’t talk about local machine here? Each session host requires the certificate so that it can open the MSIX app attached package
This is good, but what if we have setup files which requires some more files except .exe to run, how can we package that and attach as msix app attach??
No matter what the installer is or the install process, the MSIX packaging tool watches your system for changes, and pours them into the package. .bat, .cmd, .msi, .exe etc.
Is it possible to deploy optional packages with AppAttach in this manner, or does this only work with a single standalone MSIX package? I'm thinking of things like optional packages in a related set with an MSIXBUNDLE file, or modification packages to apply configuration. EDIT: I'm not sure related sets will work at all, since it looks like you have to extract the MSIX from the MSIXBUNDLE which means you lose the related set metadata (only present in the MSIXBUNDLE). I'd still be interested to know if you have any thoughts on deploying modification packages in this way?
Hi Dean, thanks for this great video! How can I achieve this using Azure AD DS? + We don't have On-Prem AD, this is a full cloud environment, we use Azure AD DS. + I've created a group in Azure AD then I was trying to add the already joined WVD Session Hosts to this group but I can't because of insufficient permissions (I think because of the Azure ADDS service Read-Only). Thank you!
Hi, Dean. I hope you can help me out. I have the MSIX packages attached to the host pool and have created an application group and assigned it to users. However, after logging in with any of the users, the applications still don't show up. I ensured the users and the VMs have SMB Contributor Role assigned. Any ideas why the apps aren't showing up?
The users only need read only access. The VMs need more permissions. Check out this trouble shooting guide for more ideas - github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
I am trying to add the MSIX package to a host pool. However, when adding the path to my file share I get the error: No MSIX packages could be retirieved from the path. I know that the VM in the host pool must have read-only access on this path. I have the administrator role and still cannot put the vms into groups as shown in 8:04. Any possible solutions?
Hello sir one more query currently I am working on Azure service so users are facing teams call issue voice is lagging echo is there and when we are adding any affected user in the fslogix exclusion list it is working fine I have checked the logs but unable to find any solution till now
Thanks, Because the docs say so 🤦♂️🤣😉 Honestly there are multiple layers to authentication. The Session Hosts need the SMB Share Contributor at least according to the docs today. But if you do a test for us all and try it with SMB share reader...and it work, you can mount and open the apps...I will go back to the Product Team and get the docs updated. 😉
This works great for ADDS hosts that sync to AAD by way of Azure AD Connect, but how do I authenticate hosts that are connected to AADDS (Azure Active Directory Domain Services)? the computer accounts for hosts joined to AADDS are obviously not present in AAD - Is there a way around this or is it just not possible with AADDS joined hosts. Or is there a way of syncing AADDS host to AAD that I'm not aware of Thanks
You can’t ☹️ MSIX App Attach is NOT supported in Azure AD Domain Services today. I think it has to do with the give the NTFS side file share permissions…which you can grant in AADDS because you don’t have any rights in that domain more info here 👉 ruclips.net/video/OWGVoJMdIRc/видео.html
Hi Dean Just wondering why when i launch a remote notepad session (packaged with msxi and published in its own app group) it displays the documents folder of user on the session host and not the app? no errors or anything? Bit of a worry for prod as i can browse through all the folders on the session host. Doesn't make sense why it would display that folder and not just bomb out if there was an issue - have you come across this before Dean?
That is a known issue here are 2 things to check 1. Verify that application has been assigned to the app group 2. Confirm application dependencies are present
@@AzureAcademy Hi Dean thank you for explaining - i had checked all the config prior to posting and couldn't understand why it would display explorer LOL Anyway the bottom line is i just gave it time (about 18 hours) and it just started working!! I can only assume it takes some time in the background to register things with the actual rds pool behind the scenes. Maybe the service was so busy with folks following along with your videos LOL - Keep up the great work sir its much appreciated.
the AVD session host agents do scans over time to detect me packages or changes in existing file shares / packages...so maybe you hit one of those scan cycles
just in Public Preview now...there is no specific timeframe to go GA. Depends on any issues, customer feedback, number of customers using the service etc. Get everyone you know to watch my video and start using this feature. The more data we can get the faster we get to GA 😎
@@AzureAcademy The main area of focus is wvd as we are moving from our on premises citrix vdi solution to wvd, nearly 4500 user movement. Apart from that i like your Devops series as we would like to implement automation as much as possible in our environment both during our intial build n steady state.
In general, no FSLogix doesn’t support non AD joined storage…but I put out this other video that gets around the problem…but I haven’t tried it with app attach…let me know how it goes! 👉 ruclips.net/video/yJqTJh2Tgxo/видео.html
Like everytime you are very helpfully... But this time about this I have a lot of question for you Dean 😂... For now... Do you know about some store with msix packages? I know that not all the apps support msix...maybe only apps that support remote desktop enviroment? And the last one... What about updates? I mean if there is new version of vlc you deploy a new package or is better to upgrade this one? Sorry for all of this question. But msix app attach is very important for the new era of wvd ❤️
Thanks Alessandro! No worries on all the questions. An easy place for MSIX packages is the Microsoft store...everything is MSIX ☺️ I am not aware of any app that is not compatible with MSIX...can you give me an example? In WVD all apps are “normal apps”. So not sure what you mean there? For updates to apps...you have some options. 1. Create an update to the package...which means you need the original and the new one... 2. Take that VLC version 4 app you downloaded and create a new package from it...and a new VHD. But now you have multiple versions of the app you are supporting...but whatever works for you
@@AzureAcademy yeah... Thanks.... anyway I'm talking about programs that are need a lot of configurations and personalization ... For example IBM client for AS400 or some "not standard" software... Don't know how to explain better 😭. Something that you cannot find on the store... Let me tell some not standard software...
I think you are talking about apps that have an installation...but have a separate configuration file beyond the installation files. This depends on HOW that config is setup. Is it 1 config per machine or per user? Ideally the config would be inside the MSIX package so everything is always right...but Per user is easy...like I called out VSCode in the video, it will be stored in the users profile. If it is per machine, then you can store that config file on the network or the local machine.
What…NO! Not an advertisement at all! Did you watch the entire video? 1st I tell you What the App Attach feature is 2nd I show you step by step how to set it up and use it
Hello Dean, I am trying to use MSIX App Attach for Siemens NX1899 CAD Application. I have implemented MSIX App attach for NX, however when I try to launch the NX application using WVD Client, instead of NX, 'Simcenter 3D' gets launched.
I am not familiar with Siemens NX1899 CAD Application. But it sounds like the wrong application was shared out...or there are specific commands or switches you need to set to get the proper app to launch.
Hi Dean, thank you for the video. Do you know if we are able to do this using Azure ADDS? Is this only available for a Hybrid On-Prem AD Sync? We are looking for a way to store our VHDX on a Storage Account and having it mount through WVD. We are able to do this on the VM, we've just had some struggles getting it to call from a Storage Account.
{"code":"400","message":"ActivityId: hjg012gjf-1c97-4bf0-9a9c-a9ef5a8ee83d Error: The MSIX Application metadata expand request failed on all Session Hosts that it was sent to. Session Host: vm-1, Error: Error accessing virtual disk at ≤\\\\mystorafgaccount.file.core.windows.net\\msixapp\ otte\ otte.vhdx≥."}
Technically yes you can, and sometimes I will do this for testing but I would not do it for production. To do so would be to have a single point of failure
Hello sir, I am trying to deploy Chrome application with msix app attach it is done but when I am trying to access file explorer is opening and some time is working fine what trouble shooting can be done for this please guide
So you packaged the app successfully Converted to a drive Image Mounted the image but you don’t see the all in windows? Did you add a cert to the app image Is that cert installed in the proper location on all the hosts
@AzureAcademy yes sir it's installed and the issue is intermittent sometimes its directing to the application nd sometimes when clicking on Chrome its re-directing to file explorer
Have you tried capturing an app that includes a service? I was trialling this out, but when clicking the app from the start menu it refuses to load (unlike other apps). Could it be related to service permissions somehow? I'm a little unsure how to troubleshoot this issue.
I have packaged apps that had services How is the service permissioned By a service account or by system Also is the service ACTUALLY in the app package? So if you deploy the app on another pc do you get the service as well?
Thank you. Are all the vendors that build setup.exe or MSI files for Windows support MSIX format as well? I can convert the setup files to MSIX format using the tool you demoed, but, will the vendor support such conversion?
Hi Dean, Thanks for the video I have a issue while adding it to the application group. Portal says failed to retrieve MSIX packages even tho i can see it there. Unable to save the setting tho. Any clue? Appreciate your Reply Regards Moin
All the hosts need the certificate in the right store, so I would double check that Then look at this guide - github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
sounds great, but how does it handle Applications which updates often like Adobe Creative Cloud, etc. Does i always have to generate new MSIX Versions for that?
You must disable application updates. Reason why is the .vhd is read only, which is a security feature of MSIX AppAttach. You would create new packages or update packages and convert to .vhd or .cim
@@AzureAcademy all right thanks for the answer :) so each 6 months or so, creating new Versions MSIX. I wasn't sure, but you make everything easy. So thanks for that!
Ah...good question, however, if you watch my video on WVD optimization you would see that you should NOT put the optimizations inside your image anyway ☺️ So the way you do this is with a VM script extension when you are building the VM
@@AzureAcademy I'm not very big fun of CSE :) BTW, can I use MSIX app attach for offline MS store for business apps? eg. MS Whiteboard, It made me a lot of pain to get it working in the image
Love the video. I have a question about you using on-prem AD to add the computer objects into a group, and then giving them access to the file share. My pooled session hosts are created alongside the WVD Host Pool in Azure. How do I add these session hosts into a security group in Azure? Do i have to create a Windows Server > Connect to my Azure domain > Put them into a group? Or can I do this in Azure? Might be a silly question, but I dont know to give my VMs access to the File Share.
Since your computers are synced objects from your on prem AD, the AD computer objects need to go into a normal AD group...then synced to Azure AD. Once they are synced the computers will have to reboot to get the group memberships updated as well Now that they are in the right group that is synced...now assign permissions in Azure files...then assign permissions in NTFS
@@AzureAcademy Hello again and thank you. I perfectly understood this part of the video. The issue is, from my understanding, that my computer objects are not synced from any on-prem AD. I dont have any sort of on-prem solution in my Azure environment as we speak. The computers I created was created at the same time as the WVD host pool, and they are not coming from any on-prem server. Therefore my question was, is there something I dont understand, or do I have to connect a Windows Server to my already existing Azure AD, or can I give my Azure WVD VMs access to the file share in any other way?
@@AzureAcademy This is the error message I get when trying to add a MSIX package btw; i.imgur.com/O3IR1SH.png. I have got the confirmation that my subscription can access MSIX from the Microsoft form.
This happens because your session host does not have the right permissions to the file share. On the Azure Files share the Session host needs to have the rights of ASMB share contributor On NTFS permissions of the share where you keep the vhd you need read and execute permissions In both places users need read only
I have got the same issue, see my post up page. You are right but this is big misunderstanding, Why it doesn't work ? I can set proper rights to Hosts on NTFS security of Storage Account but I can't add Hosts group to Storage File Data SMB Share Contributor, because its not visible ! Host group object is alocated within Azure ADDS, not inside Onpremise ADDS ! This is the key of our issue ! Without this feature whole deployment doesn't work and We can throw them into the garbage...
I've packaged apps that are in .exe format and are available as a stand-alone. Now I need to package Office 2016 that has a range of files with different extensions. MSIX Packaging Tool is asking to choose the installer I want to package. What should I actually package? Similarly, I also want to package Visual Studio 2019 using MSIX Packaging tool. Please assist.
If you are new to packaging and .MSIX packaging Honestly I would not try to package all of office. There is a reason why there isn’t a .MSIX package of office available today. IT IS HUGE. It’s a lot of code and there are a lot of things that can go wrong. Start simpler with a stand alone office app like Visio or another app.
@@AzureAcademy Thanks for replying. I just became aware of MSIX concept two weeks ago and within 4 days I was able to sign certificates, create and unzip packages, it's pretty easy for stand-alone apps using MSIX Packaging tool, and have already packaged around 35 apps, deployed, tested, monitored, all good. My next big thing is Office or Visual Studio, that's where I'm stuck.
Wow...great job!!! You are stuck on 2 of the largest and most complex apps that there are! As I said there is a reason why Microsoft has not created office as a MSIX file yet
Hi Dean! All these videos have been so helpful, great work! Unfortunately, I couldn't get this working: "Error: Virtual disk not found at" "Code : 400". The session host is Azure AD joined, the package is on the same Azure Files SMB share as FSLogix user profiles (which work fine, had AD connected permissions). I guessed some sort of computer object permission issue, but the cloud security group the hosts are a member of has the SMB contributor role. I've also used AD Connect to writeback the same group to on-premise AD, with that handy new feature. That's enabled me to grant the NTFS permissions on the folders. Still no luck! I gave a VM file share a test as well, to no avail. The AAD environment does have kerberos to on-prem AD setup from one of your other videos. Any ideas much appreciated please?
Azure AD Join doesn’t support MSIX because we need to grant NTFS permissions to the session hosts on the file share…you need hybrid join or domain join so the computer object can be given Permissions. They are also working on Azure AD Kerberos auth for this but I don’t think it is ready yet
@@AzureAcademy Thanks for the prompt reply! That's a shame, I thought I'd cracked it with group or device writebacks via AD Connect - but neither prevailed. Our situation sees for example; some users with Adobe reader (no license) and others with DC pro (licensed). Not sure the best solution for such situations, any thoughts? We wouldn't want additional pools due to the variances and to keep costs down. Might also be worthwhile a video on AAD vs hybrid/ joined session host benefits, I admit I didn't know which to go with or why...
Hi Dean! I just try to use msix app attach because now i can see the menu in the gui. I want to start with msix without scripts then now is the moment :)... anyway i have the problem with permission. When i try to put the path share give me error code 400 that cannot access to this fileshare. I'm using the same azure file share that i use for fslogix. The file share is already joined on domain (for fslogix). I try to create the group of wvd computers but when ad connect sync it on azure ad i don't see the members. After that i try to configure with an file share on prem with computer permission but i have the same error code 400... i don't know what is wrong with this :(... i try also with ready vhdx published by Stefan with the same error
MSIX AppAttach is still in preview. And you gave to register for it. IF you already registered then fill out the request form again and ask them to unregistered and reregister you. Also here is a troubleshooting guide github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
...right I know you got access but error 400 means you don’t have access in that subscription. If you have another subscription try that...otherwise reach out to them again so they can fix your registration with the preview
Hello Dean, Thanks for the Video. I need to understand if I can keep the MSIX app attach VHD in the traditional domain controller joined file server and add msix package from the WVD Hostpool, will it resolve or does it need to have Azure files or Azure Netapp files only
Citrix has nothing to do with it. AppAttach is ability that is enabled by the right version of windows MSIX files will run on server 2019. But I have not run AppAttach on windows server...but running the PowerShell scripts will tell you if it works...now as far as being SUPPORTED I doubt it. I have NOT seen a support statement on using AppAttach outside of Azure.
I assume that you have also tested your MSIX package before you tried to use AppAttach...and I worked, right? If there were no errors or issues when you setup MSIX AppAttach Be sure that you have added the needed permissions for user and session host
hi could you please share any document with permission details cause i did this lab many times and faced the same issue which is VHDX doesn't appear in Disk Management , Remote DeskTop and also didn't installed . thank you for your support i appreciate that
Here are all the docs docs.microsoft.com/en-us/azure/virtual-desktop/what-is-app-attach docs.microsoft.com/en-us/azure/virtual-desktop/app-attach-image-prep docs.microsoft.com/en-us/azure/virtual-desktop/app-attach-azure-portal
The WVD session host will update automatically so I assume that you are asking about the end user client YES the client can be updated remotely or by the users...but with no one clicking to allow an update or someone deploying an update package...no
Hello, I wonder what you can say about my scenario ? I have an issue adding Storage Account permissions by IAM to Azure ADDS hostpool group, why ? Because, ADDS objects are not visible on Azure Storage Account IAM.... Synchronization process between Tenant Azure AD and ADDS on this tenant works only one way, like that Azure AD -> ADDS. So, my question is: How can I set role Storage File Data SMB Share Contributor to my HostPool Group on StorageAccount from IAM if group object is allocated on Azure Active Directory Domain Services ?
@@AzureAcademy So tell me what scenario is possible to authenticate session hosts as members of Storage File Data SMB Share Contributor group ? Let's go back to your presentation above and see what you said in 2.07' ....
You can use it for Setting up an AD authenticated file server or DFS. You can use it for WVD, FSLogix MSIX AppAttach, SQL clusters, Hyper-V clusters etc
I don't know what I'm doing wrong. Created several VHD's, attached them via the portal just fine, can see some actions inside the event log....But each time I start the application, instead of launching the app, I just get a Windows Explorer?! Certs imported, exclusions made in Defender, Permissions checked...
The issue here is that the session host or the user is missing something but the basic function of AppAttach is working...because MSIX launches windows file explorer, then opens your app...so because you see the explorer...you are missing something getting to the app. Check the certificate that you used to package the .MSIX file. Verify that exact cert is on ALL your session host. Verify the cert did not expire. Cert must be a code signing cert If cert is self signed it must be stored in the session hosts computers trusted people certificate store Permissions: The session hosts need to have permissions in your file share to read and execute If you are using Azure files, don’t forget to give the computers permissions on the Azure Files Share. The users need read only permissions Let me know how it goes
@@AzureAcademy Thanks for your reply and taking your time to support me. -I use Azure Files -I have created a Computer Group and added the Computer-Accounts to it -I have added the Group as "Storage File Data SMB Share Contributor " via IAM on a Resource Level. -The same Group has "Read+Execute" Permissions on the folder, containing the VHD's. -I have an Enterprise PKI which I have used to create a "Code Signing" Cert, that is trusted by my Domain. -Cert is valid til 2024 -I used that Cert to create the MSIX Package -I can open & install the MSIX Package manually and the application installs and starts. (No cert warning) -Users have Read Access. When clicking on the vhdx the user receives an UAC prompt, which is expected I suppose. But I verified this with a txt file, that the user was able to read from the share. -I can add the VHD via the Azure Portal, no problem & create the App Assignment. -Even though the cert is trusted by the Enterprise-PKI I manually imported it into Trusted-People as well. Could this be causing issues? -Cert Propertys show "Enhanced Key Usage "Code Signing (1.3.6.1.5.5.7.3.3) One thing I did notice, and I'm not sure if thats normal: When I mount the VHD manually, and try to navigate to the application folder, I don't have permissions to do so. Should I be able to open the VHD and navigate inside the app folder?
The UAC is normal. The user only has read rights, not the rights to mount a .vhd file. the rights issue at the end is a possible concern. the troubleshooting flow for AppAttach is: 1. permissions 2. firewall 3. malformed VDH/CIM 4. invalid MSIX in VHD/CIM 5. missing cert 6. missing PRI 7. missing entry point to MSIX 8. host pool in prod r1 instead of prod r0 9. wrong OS (2004 and up) 10. cim is created on OS different from the one where its mounted Check out the AppAttach guide github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf do a find in there for the work explorer the 2nd hit is your issue. run the query and see what the result is. Also check on the session host windows event viewer in the application logs. there will be MSIX items...are there any errors or warnings?
@@AzureAcademy thanks again for replying. I just wanted to keep you up to date. I was on holiday and have had some other things to do. However it seems that MS has updated something in the meantime. Since the VM has the latest agent 1.0.2866.1500 it simply worked!!! I have not changed anything since my last post here. Sometimes it’s probably the best idea to simply wait... I just have one small problem left: the apps don’t register in the start menu when launching a full desktop. They only can be started directly as RemoteApp. -I can see the VHDs mounted in disk manager -I can see the folder in Program files\Windows Apps They simply don’t show in the start menu. Weird?
Could have something to do with the service now being GA...so everything should work for everyone. As for your app group problem. Remote app groups allow users to use MSIX AppAttach remotely But a desktop user needs to have the MSIX AppAttached to the Desktop Application group Share the App to your desktop App Group and let me know
The cert script creates a self sign cert So the cert needs to be installed into the trusted people store on all your session hosts If you try to open the MSIX app package directly on a session host…not the vhd but the MSIX file, does that also give you a cert error…oh and make sure your cert isn’t expired
@@AzureAcademy I ran the script on the computer I was doing the packing from. After running the package, I removed the application and then rebooted. When I run the MSIX package on the same machine, it indicated the cert is not trusted and I cannot install. I did check the date and it expires in 2023.
Maybe you have some information for me. -I have registered for the preview. -The hostpool is tagged as validation environment. -I have made a new share with active directory integration. -I made the Computer Accounts to Storage File Data SMB Share Contributor and gave the group Read and Execute permissions. -I implemented the test msix packages and added the cert. -The validation in the azure portal also was successfull -I added the MSIX Application to the Desktop group for the users. The vhdx is not mounted, and the user does not see the program. Do you have any hinds?
I would test the MSIX package you created. Verify that everything in the package works correctly and the app works. Then test the .Vhdx by mounting it manually then going into it and see if you can open the app
@@AzureAcademy Currently I only tried the msix-vhdx files christiaan brinkhoff etc. are linking. I can manually mount them and open e.g. chrome. I can't see any errors in the event log but i also can not see any events when i search for *.vhdx on the session host except at the time I validate the msix package initialy over the portal. I forgot to mention that I am using Windows 10 20h2. I also can't see the apps when I am using msix pubapp-groups instead of the desktop app. Pubapps which are not msix related are available instant. I am starting to think that the tenant is not "fully" activated for the preview or something like that :D
Its the same case with my scenario. I don't see the vhdx not mounting. Manually with the Scripts, everything is working expected, however with the Portal its not working. I followed the step by step that given in your video however it still not mounting the vhdx.
1. did you sign up and get notified that you are accepted into the preview? 2. Did you have any issue with VM permissions? 3. are you able to see the names of the applications inside the MSIX Package in the portal?
Hi, another question. I think i have setup everything correctly, but my apps don't show up on my WVD portal or WVD session host. Do you maybe know what i am doing wrong?
@@AzureAcademy When i log in add rdweb.wvd.microsoft.... there is no application showing up. Also when i login on the sessionhost there is no VHD attached or visable MSIX application.
Don't know what happend, but it is working right now. Also for other people: techcommunity.microsoft.com/t5/windows-virtual-desktop/msix-app-attach-azure-portal-integration-public-preview/td-p/1986231
I am betting that there are multiple hosts in your pool? You need to add the certs to each host in the pool...and be sure that all the hosts can get to the storage correctly
@@AzureAcademy Im trying this also, i created a group in Azure AD but i cannot add the hosts into the group because access is denied. As AADS is mainly read only.
ah...so you would need to create a group in Azure AD for your computers, then populate it with your devices, then I believe you should be OK to grant the permissions to that group in Azure Files.
Hi Dean. while creating the vhd/vhdx from the msix package I can't see the AppxMetadata folder is not getting created because of which I am not able to attach it to the session host. Do you know what could be the cause of that?
@@AzureAcademy Hi Dean. I fould the issue today after doing some troubleshooting. The log says:No certificate found which meets the given criteria . Is there a specific type certificate I should be using?
Yes you need a code signing certificate. If your cert is self signed then is must go into the TRUSTED PEOPLE local machine certificate store on all your session hosts.
@@AzureAcademy Thanks Dean. Yeah i was able to figure it out yesterday that it needs code sign certificate and was able to get it resolved and was able to create packages. I am able to see the application now after attaching those msix packages to session hosts but they just don't open,no erro messages as well. Any pointers on what could be the issue? It's a basic notepad++ application
It is not allowing to create Remote app group for msix in the personal hostpool. Says there is already a desktop application group ,no provision to create Remote group. but I was able to add msix packages from the console. Basically unable to provide it to users.
![Chlöe - Shake (Feat. Jeremih) [Official Visualizer]](http://i.ytimg.com/vi/aDs_1ufpfv8/mqdefault.jpg)
I've watched dozens of Azure Academy videos, and this may be the best yet! Thank you Dean! Amazing work!
Dozens! Awesome, as you get into the more recent videos, let me know what you think. My style keeps evolving.
+Peter Heery 👍👍
No doubt why I was happy watching the video, because, I'm already subcribed to the channel. Highly informative, and happy to watch more. Thanks!
Awesome thanks Mohammad!
I love you, seriously. Love the way you explain these Topics - would't know where I was without your Videos
😉 awesome! Any requests for specific content?
two key things i would recommend:
1. Ensure AVD path i.e share\*.vhdx is whitelisted from AV
2. Ensure Share is in same zone with AVD
Those are great points, thanks!
such a simple yet clear explanation on a topic essential for Azure Virtual Desktop comprehension 👏👏
Thank you!
Hey Dean - Thanks for taking the time to post this content! Question... Is it possible to publish these apps to the "Full desktop" via WVD uniquely for specific users? Like if 2 users connect to the desktop but only the apps they have access to attach - so we don't have to use FSLogix Masking Rules to control the apps visible from the desktop?
Hmm... it seems perhaps MSIX applications attach in the full desktop even when they're deployed as Remote Apps in Remote App groups. If this is by design... flawless!
Yes, FSLogix masking rules are not required.
Understand that there are 2 sides to app attach
The attaching part on the VM
The assigning the user part
So the apps will attach and be available but only those users who are assigned can see it and use it
Kinda, but not in the same sense.
Awesome mate, thanks. Great video 📹
Thanks Néstor
another excellent video. i've been holding off on using msix attached apps until it's GA but it looks like this is what MS is going to be transitioning to as its "offical" way of modern app deployment and it's just freaking cool.
Yes...Yes it is!
HI Dean, now the NTFS permissions don't seem to be necessary anymore, just get the file share connected to domain and check if you can access it from the acc who had smb azure permissions, place the mxix package and ur done
I will have to look into that
man this is great, help a lot to undstand the whole process. thanks for the great effort!!
👍👍
Thanks +Gavin L
Hi Dean! As always, great video. I'd love to see one on maintaining an MSIX/VHDX. IE: If we were to use Acrobat or Quickbooks in MSIX form, what's the most effective way to patch it, etc?
Thanks Seth...Not sure if there is a full video here...but you have 2 choices
1. Create an updated package and have the original package as a prerequisite
2. Create a new package from the new full install version of the app.
How you would do this would be different for each app
My WVD project is on hold waiting for this! Are you going to do a session on creating MSIX packages?
Yes I will cover how to create MSIX packages, convert the package into a hard drive and setup MSIX AppAttach in the portal...as well as the future of managing WVD with AppAttach...please share the video with everyone 😎
Hi Dean, great video! Thanks for that, keep up the good work!
Thanks! What do you want me to cover next?
@@AzureAcademy To be honest, you already have quite a lot of video's which I need, so I don't want to ask you for something you already made. When I find something you don't already have covered, I will suggest it.
Thank you for replying!
sounds good.
Great video and Excellent presentation!!
Thank you! What else are you interested in?
Hi Dean having much fun following along with this video - could i ask a quick question? All is good up to the point where i am adding the computer object group to the share, troubleshooting this it seems the group i created has synced across to AAD but not the members (computer objects) LOL, is this normal behavior for AAD connect not to sync computer objects? By the way just want to shout out the massive amount of work you must have done to get put your video's together, im sure it takes a lot of trial and error to get 20 mins of gold contents - excellent work sir. Also kudos to MS - that packaging tool is awesome
Thanks Mark, it takes a long time to create each video…6-12 hours depending if I have to learn the feature too ☺️ as for the computers not syncing…check the sync logs
Also that computers are in an OU that is syncing
Check any sync rules for exclusions that may be blocking the computers
@@AzureAcademy After doing some digging it seems the userCertificate attribute on the computer object needs to be populated. Mine were not. I built up a CA and the computers were issues certificate. This populated the attribute and now the computer objects have synced. I wouldn't have come across this problem in prod as we have a CA infrastructure setup but in the lab i didnt. Anyway, interesting point to note if anybody else gets this issue - hopefully may help.
Awesome, thanks for sharing!
Great video, makes MSIX app attach easier to deploy.
Thanks Nayeem!
Hi Dean, what should be the DNSName and Subject in Cert Generation script.
Is Code.MSAzureAcademy.com the DNS server of your domain?
Sorry to ask this silly question~
In my example of a self signed cert it can be anything and doesn’t matter, but when dealing with a cert from a real certificate authority the subject name is the name of the cert
The DNSName is Fully qualified name
Hi Dean - Wow- mind blown. we are migrating apps running on an old citrix farm to remote app via AVD, we have some old proprietary apps installed nobody has the software for and the original admin has long since left the building- im sure you know the scenario LOL. I'm wondering if i can run MSIX packager on the server they are installed on and package them up into a msix app? is this possible without the original software? Cheers Mark T - keep up the great content!!
Thanks Mark! To package you need the installer and it is recommended to package on a clean VM that is basically identical to the VM you want to run the app on
@@AzureAcademy Hi Dean - thank you so much for clarifying. We dont have the installer so msix appattach is probably not the solution for this app but very useful for others we have to deliver as part of our project so many thanks for giving us the knowledge to proceed down this road. About time these old 90's apps were retired anyways LOL thanks again, Mark.
Anytime
Love this and the sound effects are epic, makes it very engaging :)
Thanks Fletcher!
Thanks, great video again. For me this looks like App-v Next gen :)
Thanks! You definitely can look at MSIX AppAttach “like” the next gen of App-V
☺️
Hi Dean. Great content and video. Question, are there applications that cannot be packaged with MSIX? Let's say SSMS or Visual Studios?
I have run into complex applications even ones that I “would not” try to package...like the entire office suite.
visual studio complexity depends on how you install it.
One tool I would suggest for complex, troublesome apps is PSFTOOLING
Hey Dean, may I know the BGM of your videos, it makes me so calm, I would like to hear that before I go to sleep.
Wow...I don’t know how I feel about that 😳 LOL
As long as you don’t fall asleep WHILE watching I guess it’s ok
@@AzureAcademy What is the name of that BGM, by the way~
the music is called microchip. I think I found it at Audio Hero
hello, thanks, if would you make one video about powersheell of certificated
Hi Marisol! I’m sorry…please Help me to understand more. You would like a video on powershell doing/with what exactly?
well done! amazing quality. great content
Thanks!
@10:47, I don't understand what you mean by "local machine"? My management PC? The machine running as my AVD? Why does the local machine need the self signed cert installed on it?
Just watched @10:47 again…I don’t talk about local machine here?
Each session host requires the certificate so that it can open the MSIX app attached package
This is good, but what if we have setup files which requires some more files except .exe to run, how can we package that and attach as msix app attach??
No matter what the installer is or the install process, the MSIX packaging tool watches your system for changes, and pours them into the package. .bat, .cmd, .msi, .exe etc.
Great tutorial! How do we add application the VMDX mounted msix packages? Do we repackage and mount again
Thanks! Not sure I am following the question. What VMDX are you talking about?
@@AzureAcademy sorry. it was typo from my end. I meant to say .VHDX
If you want to make any changes to the VHDX then YES you would do some repackaging of the MSIX first then convert to VHD/VHDX
Is it possible to deploy optional packages with AppAttach in this manner, or does this only work with a single standalone MSIX package? I'm thinking of things like optional packages in a related set with an MSIXBUNDLE file, or modification packages to apply configuration.
EDIT: I'm not sure related sets will work at all, since it looks like you have to extract the MSIX from the MSIXBUNDLE which means you lose the related set metadata (only present in the MSIXBUNDLE). I'd still be interested to know if you have any thoughts on deploying modification packages in this way?
Yes you can deploy optional and / or upgrade packages along with the base package
@@AzureAcademy Awesome! Thanks very much.
anytime!
Hi Dean, thanks for this great video!
How can I achieve this using Azure AD DS?
+ We don't have On-Prem AD, this is a full cloud environment, we use Azure AD DS.
+ I've created a group in Azure AD then I was trying to add the already joined WVD Session Hosts to this group but I can't because of insufficient permissions (I think because of the Azure ADDS service Read-Only).
Thank you!
At this point...you cannot!
MSIX AppAttach is not supported in AADDS...yet.
Stay tuned!
Hi, Dean. I hope you can help me out. I have the MSIX packages attached to the host pool and have created an application group and assigned it to users. However, after logging in with any of the users, the applications still don't show up. I ensured the users and the VMs have SMB Contributor Role assigned. Any ideas why the apps aren't showing up?
The users only need read only access. The VMs need more permissions. Check out this trouble shooting guide for more ideas - github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
I am trying to add the MSIX package to a host pool. However, when adding the path to my file share I get the error: No MSIX packages could be retirieved from the path. I know that the VM in the host pool must have read-only access on this path. I have the administrator role and still cannot put the vms into groups as shown in 8:04. Any possible solutions?
What do you mean you can’t pull VMs into groups?
Don’t forget that you need the cert on each vm as well.
Hello sir one more query currently I am working on Azure service so users are facing teams call issue voice is lagging echo is there and when we are adding any affected user in the fslogix exclusion list it is working fine I have checked the logs but unable to find any solution till now
What you need is TEAMS A/V Redirection
Watch this ruclips.net/video/RfbolIgPcBY/видео.htmlsi=ONZEzRuit9Bk4tYB
great video! just wondering why the SMB contributor is needed at the Storage Account instead of the reader?
Thanks, Because the docs say so 🤦♂️🤣😉 Honestly there are multiple layers to authentication. The Session Hosts need the SMB Share Contributor at least according to the docs today. But if you do a test for us all and try it with SMB share reader...and it work, you can mount and open the apps...I will go back to the Product Team and get the docs updated. 😉
This works great for ADDS hosts that sync to AAD by way of Azure AD Connect, but how do I authenticate hosts that are connected to AADDS (Azure Active Directory Domain Services)? the computer accounts for hosts joined to AADDS are obviously not present in AAD - Is there a way around this or is it just not possible with AADDS joined hosts. Or is there a way of syncing AADDS host to AAD that I'm not aware of
Thanks
You can’t ☹️ MSIX App Attach is NOT supported in Azure AD Domain Services today.
I think it has to do with the give the NTFS side file share permissions…which you can grant in AADDS because you don’t have any rights in that domain more info here 👉 ruclips.net/video/OWGVoJMdIRc/видео.html
Hi Dean Just wondering why when i launch a remote notepad session (packaged with msxi and published in its own app group) it displays the documents folder of user on the session host and not the app? no errors or anything? Bit of a worry for prod as i can browse through all the folders on the session host. Doesn't make sense why it would display that folder and not just bomb out if there was an issue - have you come across this before Dean?
That is a known issue here are 2 things to check
1. Verify that application has been assigned to the app group
2. Confirm application dependencies are present
@@AzureAcademy Hi Dean thank you for explaining - i had checked all the config prior to posting and couldn't understand why it would display explorer LOL Anyway the bottom line is i just gave it time (about 18 hours) and it just started working!! I can only assume it takes some time in the background to register things with the actual rds pool behind the scenes. Maybe the service was so busy with folks following along with your videos LOL - Keep up the great work sir its much appreciated.
the AVD session host agents do scans over time to detect me packages or changes in existing file shares / packages...so maybe you hit one of those scan cycles
This is the one we have been waiting since a long..when it will become GA
just in Public Preview now...there is no specific timeframe to go GA. Depends on any issues, customer feedback, number of customers using the service etc. Get everyone you know to watch my video and start using this feature. The more data we can get the faster we get to GA
😎
@@AzureAcademy i always recommend my entire team to watch out for your wvd series as it's the best series available out there
Awesome...Thanks! What other videos are you and your team interested in so I can make them?
@@AzureAcademy The main area of focus is wvd as we are moving from our on premises citrix vdi solution to wvd, nearly 4500 user movement. Apart from that i like your Devops series as we would like to implement automation as much as possible in our environment both during our intial build n steady state.
Awesome! What would be the next DevOps topic your team would be interested in?
Will MSIX AppAttach work in a CloudOnly environment (AVD AAD joined VMs, AAD Accounts only)?
In general, no FSLogix doesn’t support non AD joined storage…but I put out this other video that gets around the problem…but I haven’t tried it with app attach…let me know how it goes!
👉 ruclips.net/video/yJqTJh2Tgxo/видео.html
Like everytime you are very helpfully... But this time about this I have a lot of question for you Dean 😂... For now... Do you know about some store with msix packages? I know that not all the apps support msix...maybe only apps that support remote desktop enviroment? And the last one... What about updates? I mean if there is new version of vlc you deploy a new package or is better to upgrade this one? Sorry for all of this question. But msix app attach is very important for the new era of wvd ❤️
Thanks Alessandro! No worries on all the questions.
An easy place for MSIX packages is the Microsoft store...everything is MSIX ☺️
I am not aware of any app that is not compatible with MSIX...can you give me an example?
In WVD all apps are “normal apps”. So not sure what you mean there?
For updates to apps...you have some options.
1. Create an update to the package...which means you need the original and the new one...
2. Take that VLC version 4 app you downloaded and create a new package from it...and a new VHD.
But now you have multiple versions of the app you are supporting...but whatever works for you
@@AzureAcademy yeah... Thanks.... anyway I'm talking about programs that are need a lot of configurations and personalization ... For example IBM client for AS400 or some "not standard" software... Don't know how to explain better 😭. Something that you cannot find on the store... Let me tell some not standard software...
I think you are talking about apps that have an installation...but have a separate configuration file beyond the installation files. This depends on HOW that config is setup. Is it 1 config per machine or per user?
Ideally the config would be inside the MSIX package so everything is always right...but
Per user is easy...like I called out VSCode in the video, it will be stored in the users profile.
If it is per machine, then you can store that config file on the network or the local machine.
@@AzureAcademy you catch the point... Is very new for all of us.... I need to test it...
understood 😎
Is there a way to grant Azure file share access to session hosts and not be using AD DS or Azure AD DS?
Yes…storage account key stored in credential manager. Also Azure AD Kerberos coming soon
cool
What…NO! Not an advertisement at all! Did you watch the entire video?
1st I tell you What the App Attach feature is
2nd I show you step by step how to set it up and use it
Hello Dean,
I am trying to use MSIX App Attach for Siemens NX1899 CAD Application. I have implemented MSIX App attach for NX, however when I try to launch the NX application using WVD Client, instead of NX, 'Simcenter 3D' gets launched.
I am not familiar with Siemens NX1899 CAD Application. But it sounds like the wrong application was shared out...or there are specific commands or switches you need to set to get the proper app to launch.
Hi Dean, thank you for the video. Do you know if we are able to do this using Azure ADDS? Is this only available for a Hybrid On-Prem AD Sync? We are looking for a way to store our VHDX on a Storage Account and having it mount through WVD. We are able to do this on the VM, we've just had some struggles getting it to call from a Storage Account.
AADDS is not supported for MSIX App Attach today…but stay tuned!
Hello,
good content!
the local machine where you installed the msix , is it a local machine joined to the domain ? should exist in the host pool?
Thanks! The local pc was not joined to a domain
{"code":"400","message":"ActivityId: hjg012gjf-1c97-4bf0-9a9c-a9ef5a8ee83d Error: The MSIX Application metadata expand request failed on all Session Hosts that it was sent to. Session Host: vm-1, Error: Error accessing virtual disk at ≤\\\\mystorafgaccount.file.core.windows.net\\msixapp\
otte\
otte.vhdx≥."}
Not sure I understand, how did I succeed??
The session host failed here because it either doesn’t have the certificate or don’t have permissions to the share
@@AzureAcademy thank you
Can I use shared folder on Domain joined Vm as shared location for msix vhdx?
Technically yes you can, and sometimes I will do this for testing but I would not do it for production. To do so would be to have a single point of failure
When i add the MSIX package it says: The functionality is not supported. It will be included in a future release.
Did you fill out the preview form? Did you get a response that your subscription was accepted?
Hello sir, I am trying to deploy Chrome application with msix app attach it is done but when I am trying to access file explorer is opening and some time is working fine what trouble shooting can be done for this please guide
So you packaged the app successfully
Converted to a drive Image
Mounted the image but you don’t see the all in windows?
Did you add a cert to the app image
Is that cert installed in the proper location on all the hosts
@AzureAcademy yes sir it's installed and the issue is intermittent sometimes its directing to the application nd sometimes when clicking on Chrome its re-directing to file explorer
@AzureAcademy it would be really helpful sir if you could help us with step by step configuration notes if you have for domain join machine
1. Verify that application has been assigned to the DAG
2. Confirm application dependencies are present
@@AzureAcademy thank uu sir
Have you tried capturing an app that includes a service? I was trialling this out, but when clicking the app from the start menu it refuses to load (unlike other apps). Could it be related to service permissions somehow? I'm a little unsure how to troubleshoot this issue.
I have packaged apps that had services
How is the service permissioned
By a service account or by system
Also is the service ACTUALLY in the app package?
So if you deploy the app on another pc do you get the service as well?
@@AzureAcademy Thanks for your suggestion - I'll give that a go!
@@justrobin1234 let me know how it goes!
Thank you. Are all the vendors that build setup.exe or MSI files for Windows support MSIX format as well? I can convert the setup files to MSIX format using the tool you demoed, but, will the vendor support such conversion?
I can’t answer that. That is a question for the software vendor
Hi Dean, Thanks for the video
I have a issue while adding it to the application group. Portal says failed to retrieve MSIX packages even tho i can see it there. Unable to save the setting tho. Any clue?
Appreciate your Reply
Regards
Moin
All the hosts need the certificate in the right store, so I would double check that
Then look at this guide - github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
sounds great, but how does it handle Applications which updates often like Adobe Creative Cloud, etc. Does i always have to generate new MSIX Versions for that?
You must disable application updates.
Reason why is the .vhd is read only, which is a security feature of MSIX AppAttach. You would create new packages or update packages and convert to .vhd or .cim
@@AzureAcademy all right thanks for the answer :) so each 6 months or so, creating new Versions MSIX. I wasn't sure, but you make everything easy. So thanks for that!
👍👍
can it work with applications that require database schema update?
Yes as long as the database is not in MSIX ☺️
MSIX App Attach makes the app read only
great video, just wondering - how are you going to apply optimization for marketplace image without creating your own custom image?
Ah...good question, however, if you watch my video on WVD optimization you would see that you should NOT put the optimizations inside your image anyway ☺️
So the way you do this is with a VM script extension when you are building the VM
@@AzureAcademy I'm not very big fun of CSE :) BTW, can I use MSIX app attach for offline MS store for business apps? eg. MS Whiteboard, It made me a lot of pain to get it working in the image
yes you can package anything you like as MSIX...even MS Store offline apps
Hi , how can we formatting the disk 7:21
Right click on the disk. Select format
click next through the wizard
Thanks for your reply
Anytime!
Cant find your 'create VHD' script' Any clues?
The script to create the VHD was in the AVD Docs as I showed in the video
Is it weird that Dean Cefola looks like a younger version of Tom Sizemore? 😄
Not sure how to take that 🤪
@@AzureAcademy No disrespect intended, Tom Sizemore was once a brilliant actor in his prime👍
Awesome…I’ll check him out ☺️
Love the video. I have a question about you using on-prem AD to add the computer objects into a group, and then giving them access to the file share. My pooled session hosts are created alongside the WVD Host Pool in Azure. How do I add these session hosts into a security group in Azure? Do i have to create a Windows Server > Connect to my Azure domain > Put them into a group? Or can I do this in Azure? Might be a silly question, but I dont know to give my VMs access to the File Share.
Since your computers are synced objects from your on prem AD, the AD computer objects need to go into a normal AD group...then synced to Azure AD.
Once they are synced the computers will have to reboot to get the group memberships updated as well
Now that they are in the right group that is synced...now assign permissions in Azure files...then assign permissions in NTFS
@@AzureAcademy Hello again and thank you. I perfectly understood this part of the video. The issue is, from my understanding, that my computer objects are not synced from any on-prem AD. I dont have any sort of on-prem solution in my Azure environment as we speak. The computers I created was created at the same time as the WVD host pool, and they are not coming from any on-prem server. Therefore my question was, is there something I dont understand, or do I have to connect a Windows Server to my already existing Azure AD, or can I give my Azure WVD VMs access to the file share in any other way?
@@AzureAcademy This is the error message I get when trying to add a MSIX package btw; i.imgur.com/O3IR1SH.png. I have got the confirmation that my subscription can access MSIX from the Microsoft form.
This happens because your session host does not have the right permissions to the file share.
On the Azure Files share the Session host needs to have the rights of ASMB share contributor
On NTFS permissions of the share where you keep the vhd you need read and execute permissions
In both places users need read only
I have got the same issue, see my post up page.
You are right but this is big misunderstanding, Why it doesn't work ?
I can set proper rights to Hosts on NTFS security of Storage Account but I can't add Hosts group to Storage File Data SMB Share Contributor, because its not visible !
Host group object is alocated within Azure ADDS, not inside Onpremise ADDS !
This is the key of our issue !
Without this feature whole deployment doesn't work and We can throw them into the garbage...
I've packaged apps that are in .exe format and are available as a stand-alone.
Now I need to package Office 2016 that has a range of files with different extensions.
MSIX Packaging Tool is asking to choose the installer I want to package. What should I actually package?
Similarly, I also want to package Visual Studio 2019 using MSIX Packaging tool.
Please assist.
If you are new to packaging and .MSIX packaging Honestly I would not try to package all of office.
There is a reason why there isn’t a .MSIX package of office available today. IT IS HUGE. It’s a lot of code and there are a lot of things that can go wrong.
Start simpler with a stand alone office app like Visio or another app.
@@AzureAcademy Thanks for replying. I just became aware of MSIX concept two weeks ago and within 4 days I was able to sign certificates, create and unzip packages, it's pretty easy for stand-alone apps using MSIX Packaging tool, and have already packaged around 35 apps, deployed, tested, monitored, all good. My next big thing is Office or Visual Studio, that's where I'm stuck.
Wow...great job!!!
You are stuck on 2 of the largest and most complex apps that there are!
As I said there is a reason why Microsoft has not created office as a MSIX file yet
Hi Dean! All these videos have been so helpful, great work! Unfortunately, I couldn't get this working: "Error: Virtual disk not found at" "Code : 400". The session host is Azure AD joined, the package is on the same Azure Files SMB share as FSLogix user profiles (which work fine, had AD connected permissions). I guessed some sort of computer object permission issue, but the cloud security group the hosts are a member of has the SMB contributor role. I've also used AD Connect to writeback the same group to on-premise AD, with that handy new feature. That's enabled me to grant the NTFS permissions on the folders. Still no luck! I gave a VM file share a test as well, to no avail. The AAD environment does have kerberos to on-prem AD setup from one of your other videos. Any ideas much appreciated please?
Azure AD Join doesn’t support MSIX because we need to grant NTFS permissions to the session hosts on the file share…you need hybrid join or domain join so the computer object can be given Permissions.
They are also working on Azure AD Kerberos auth for this but I don’t think it is ready yet
@@AzureAcademy Thanks for the prompt reply! That's a shame, I thought I'd cracked it with group or device writebacks via AD Connect - but neither prevailed. Our situation sees for example; some users with Adobe reader (no license) and others with DC pro (licensed). Not sure the best solution for such situations, any thoughts? We wouldn't want additional pools due to the variances and to keep costs down. Might also be worthwhile a video on AAD vs hybrid/ joined session host benefits, I admit I didn't know which to go with or why...
Yeah… it I’m hoping support for 100% cloud without hybrid users will be available soon
Hi Dean!
I just try to use msix app attach because now i can see the menu in the gui. I want to start with msix without scripts then now is the moment :)... anyway i have the problem with permission. When i try to put the path share give me error code 400 that cannot access to this fileshare. I'm using the same azure file share that i use for fslogix. The file share is already joined on domain (for fslogix). I try to create the group of wvd computers but when ad connect sync it on azure ad i don't see the members. After that i try to configure with an file share on prem with computer permission but i have the same error code 400... i don't know what is wrong with this :(... i try also with ready vhdx published by Stefan with the same error
MSIX AppAttach is still in preview. And you gave to register for it. IF you already registered then fill out the request form again and ask them to unregistered and reregister you.
Also here is a troubleshooting guide
github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
@@AzureAcademy yes Stefan gives me the approval.. I will just try again... Thanks
...right I know you got access but error 400 means you don’t have access in that subscription. If you have another subscription try that...otherwise reach out to them again so they can fix your registration with the preview
Hello Dean, Thanks for the Video.
I need to understand if I can keep the MSIX app attach VHD in the traditional domain controller joined file server and add msix package from the WVD Hostpool, will it resolve or does it need to have Azure files or Azure Netapp files only
You’re welcome Owais! YES you can put the vhd on ANY file share you want, as long as the session hosts have permission to the share.
@@AzureAcademy Thanks Dean
Anytime
Am running my Citrix XA Server desktop Win2019 onprem - MSIX app attach works for it ?
Citrix has nothing to do with it. AppAttach is ability that is enabled by the right version of windows
MSIX files will run on server 2019.
But I have not run AppAttach on windows server...but running the PowerShell scripts will tell you if it works...now as far as being SUPPORTED
I doubt it.
I have NOT seen a support statement on using AppAttach outside of Azure.
Do you have to import the certificate to every single WVD host?
Yes you do. This can be done manually, with a script or with group policy
everything is working fine except it didn't appear in the remote desktop . please advise
I assume that you have also tested your MSIX package before you tried to use AppAttach...and I worked, right?
If there were no errors or issues when you setup MSIX AppAttach
Be sure that you have added the needed permissions for user and session host
hi could you please share any document with permission details cause i did this lab many times and faced the same issue which is VHDX doesn't appear in Disk Management , Remote DeskTop and also didn't installed . thank you for your support i appreciate that
Here are all the docs
docs.microsoft.com/en-us/azure/virtual-desktop/what-is-app-attach
docs.microsoft.com/en-us/azure/virtual-desktop/app-attach-image-prep
docs.microsoft.com/en-us/azure/virtual-desktop/app-attach-azure-portal
Hi Dean,
Is there anyway we can keep the WVD client up-to-date without IT and user intervention?
The WVD session host will update automatically so I assume that you are asking about the end user client
YES the client can be updated remotely or by the users...but with no one clicking to allow an update or someone deploying an update package...no
Hello, I wonder what you can say about my scenario ?
I have an issue adding Storage Account permissions by IAM to Azure ADDS hostpool group, why ?
Because, ADDS objects are not visible on Azure Storage Account IAM....
Synchronization process between Tenant Azure AD and ADDS on this tenant works only one way, like that Azure AD -> ADDS.
So, my question is: How can I set role Storage File Data SMB Share Contributor to my HostPool Group on StorageAccount from IAM if group object is allocated on Azure Active Directory Domain Services ?
You can setup Azure Files to use Azure AD Domain Services authentication...however MSIX AppAttach does not support AADDS at this time.
OK, thanks for reply. You have confirmed my suspicion, too bad.
I believe it is on the roadmap...but no idea how long till I comes
@@AzureAcademy So tell me what scenario is possible to authenticate session hosts as members of Storage File Data SMB Share Contributor group ?
Let's go back to your presentation above and see what you said in 2.07' ....
You can use it for Setting up an AD authenticated file server or DFS. You can use it for WVD, FSLogix MSIX AppAttach, SQL clusters, Hyper-V clusters etc
I need this.
Great...please share with everyone! 😎
My head is spinning
Is that a good thing?
Hello Dean, Can msix apps be deployed to AAD joned only VMs?
That is not currently supported because you need to assign NTFS permissions to the computer object and there is no way to do that in Azure AD Join…yet
@@AzureAcademy Thank you for the promt reply!!
👍👍
I don't know what I'm doing wrong. Created several VHD's, attached them via the portal just fine, can see some actions inside the event log....But each time I start the application, instead of launching the app, I just get a Windows Explorer?! Certs imported, exclusions made in Defender, Permissions checked...
The issue here is that the session host or the user is missing something but the basic function of AppAttach is working...because MSIX launches windows file explorer, then opens your app...so because you see the explorer...you are missing something getting to the app.
Check the certificate that you used to package the .MSIX file.
Verify that exact cert is on ALL your session host.
Verify the cert did not expire.
Cert must be a code signing cert
If cert is self signed it must be stored in the session hosts computers trusted people certificate store
Permissions:
The session hosts need to have permissions in your file share to read and execute
If you are using Azure files, don’t forget to give the computers permissions on the Azure Files Share.
The users need read only permissions
Let me know how it goes
@@AzureAcademy Thanks for your reply and taking your time to support me.
-I use Azure Files
-I have created a Computer Group and added the Computer-Accounts to it
-I have added the Group as "Storage File Data SMB Share Contributor
" via IAM on a Resource Level.
-The same Group has "Read+Execute" Permissions on the folder, containing the VHD's.
-I have an Enterprise PKI which I have used to create a "Code Signing" Cert, that is trusted by my Domain.
-Cert is valid til 2024
-I used that Cert to create the MSIX Package
-I can open & install the MSIX Package manually and the application installs and starts. (No cert warning)
-Users have Read Access. When clicking on the vhdx the user receives an UAC prompt, which is expected I suppose. But I verified this with a txt file, that the user was able to read from the share.
-I can add the VHD via the Azure Portal, no problem & create the App Assignment.
-Even though the cert is trusted by the Enterprise-PKI I manually imported it into Trusted-People as well. Could this be causing issues?
-Cert Propertys show "Enhanced Key Usage "Code Signing (1.3.6.1.5.5.7.3.3)
One thing I did notice, and I'm not sure if thats normal: When I mount the VHD manually, and try to navigate to the application folder, I don't have permissions to do so. Should I be able to open the VHD and navigate inside the app folder?
The UAC is normal. The user only has read rights, not the rights to mount a .vhd file.
the rights issue at the end is a possible concern.
the troubleshooting flow for AppAttach is:
1. permissions
2. firewall
3. malformed VDH/CIM
4. invalid MSIX in VHD/CIM
5. missing cert
6. missing PRI
7. missing entry point to MSIX
8. host pool in prod r1 instead of prod r0
9. wrong OS (2004 and up)
10. cim is created on OS different from the one where its mounted
Check out the AppAttach guide
github.com/stgeorgi/msixappattach/blob/master/Troubleshooting%20methedology%20v2.pdf
do a find in there for the work explorer the 2nd hit is your issue. run the query and see what the result is.
Also check on the session host windows event viewer in the application logs.
there will be MSIX items...are there any errors or warnings?
@@AzureAcademy thanks again for replying. I just wanted to keep you up to date. I was on holiday and have had some other things to do. However it seems that MS has updated something in the meantime. Since the VM has the latest agent 1.0.2866.1500 it simply worked!!! I have not changed anything since my last post here. Sometimes it’s probably the best idea to simply wait...
I just have one small problem left: the apps don’t register in the start menu when launching a full desktop. They only can be started directly as RemoteApp.
-I can see the VHDs mounted in disk manager
-I can see the folder in Program files\Windows Apps
They simply don’t show in the start menu. Weird?
Could have something to do with the service now being GA...so everything should work for everyone.
As for your app group problem.
Remote app groups allow users to use MSIX AppAttach remotely
But a desktop user needs to have the MSIX AppAttached to the Desktop Application group
Share the App to your desktop App Group and let me know
Anyone having issues with the Cert script? I keep getting untrusted app error when trying to execute package?
The cert script creates a self sign cert
So the cert needs to be installed into the trusted people store on all your session hosts
If you try to open the MSIX app package directly on a session host…not the vhd but the MSIX file, does that also give you a cert error…oh and make sure your cert isn’t expired
@@AzureAcademy I ran the script on the computer I was doing the packing from. After running the package, I removed the application and then rebooted. When I run the MSIX package on the same machine, it indicated the cert is not trusted and I cannot install. I did check the date and it expires in 2023.
@@AzureAcademy All set now! Thank you for the reply.
Nice!
If it is self signed I’m the very must be installed to the trusted people store
Awesome vedio.👏is CIM image suggested to be used in production now?
Cim images are supported
Maybe you have some information for me.
-I have registered for the preview.
-The hostpool is tagged as validation environment.
-I have made a new share with active directory integration.
-I made the Computer Accounts to Storage File Data SMB Share Contributor and gave the group Read and Execute permissions.
-I implemented the test msix packages and added the cert.
-The validation in the azure portal also was successfull
-I added the MSIX Application to the Desktop group for the users.
The vhdx is not mounted, and the user does not see the program.
Do you have any hinds?
I would test the MSIX package you created. Verify that everything in the package works correctly and the app works.
Then test the .Vhdx by mounting it manually then going into it and see if you can open the app
@@AzureAcademy Currently I only tried the msix-vhdx files christiaan brinkhoff etc. are linking. I can manually mount them and open e.g. chrome.
I can't see any errors in the event log but i also can not see any events when i search for *.vhdx on the session host except at the time I validate the msix package initialy over the portal.
I forgot to mention that I am using Windows 10 20h2.
I also can't see the apps when I am using msix pubapp-groups instead of the desktop app. Pubapps which are not msix related are available instant.
I am starting to think that the tenant is not "fully" activated for the preview or something like that :D
Not being "fully active" could be I guess, but not sure what would be going on there.
Its the same case with my scenario. I don't see the vhdx not mounting. Manually with the Scripts, everything is working expected, however with the Portal its not working. I followed the step by step that given in your video however it still not mounting the vhdx.
1. did you sign up and get notified that you are accepted into the preview?
2. Did you have any issue with VM permissions?
3. are you able to see the names of the applications inside the MSIX Package in the portal?
Hi, another question. I think i have setup everything correctly, but my apps don't show up on my WVD portal or WVD session host. Do you maybe know what i am doing wrong?
Where are they not showing up in the portal?
In app groups, applications, hostpool or workspace?
@@AzureAcademy When i log in add rdweb.wvd.microsoft.... there is no application showing up. Also when i login on the sessionhost there is no VHD attached or visable MSIX application.
Don't know what happend, but it is working right now. Also for other people: techcommunity.microsoft.com/t5/windows-virtual-desktop/msix-app-attach-azure-portal-integration-public-preview/td-p/1986231
they fixed a portal bug...glad it is working now
I am betting that there are multiple hosts in your pool?
You need to add the certs to each host in the pool...and be sure that all the hosts can get to the storage correctly
Hello Dean, did you test MSIX APPATTACH with an Azure file joined to an Azure ADDS ? Is it supported ? (I cannot make it work with Azure Adds)
I did not try it directly...but AADDS is supported as an Auth for the Azure File Share.
@@AzureAcademy Im trying this also, i created a group in Azure AD but i cannot add the hosts into the group because access is denied. As AADS is mainly read only.
Actually ive just gone onto the folder and added the machines directly to have readonly permissions. So ill try that and see how that goes.
Basically its not going anywhere as i didnt realise you have to register for the preview 🤣
ah...so you would need to create a group in Azure AD for your computers, then populate it with your devices, then I believe you should be OK to grant the permissions to that group in Azure Files.
Hi Dean. while creating the vhd/vhdx from the msix package I can't see the AppxMetadata folder is not getting created because of which I am not able to attach it to the session host. Do you know what could be the cause of that?
When you do the MsixMgr.exe command you can add a root Directory... that is where you add it
@@AzureAcademy Hi Dean. I fould the issue today after doing some troubleshooting. The log says:No certificate found which meets the given criteria . Is there a specific type certificate I should be using?
Yes you need a code signing certificate. If your cert is self signed then is must go into the TRUSTED PEOPLE local machine certificate store on all your session hosts.
@@AzureAcademy Thanks Dean. Yeah i was able to figure it out yesterday that it needs code sign certificate and was able to get it resolved and was able to create packages. I am able to see the application now after attaching those msix packages to session hosts but they just don't open,no erro messages as well. Any pointers on what could be the issue? It's a basic notepad++ application
Did you test your MSIX package, and know it works?
What is the operating system?
Did you assign permissions to the session hosts?
Hi Dean, Please let us know if the MSIX supports the persistent Pool, windows 10 2004 or just the shared pool
I was not able to create the App grp in Personal hostpool
Yes it does
What error did you get?
It is not allowing to create Remote app group for msix in the personal hostpool. Says there is already a desktop application group ,no provision to create Remote group. but I was able to add msix packages from the console. Basically unable to provide it to users.
It's working
Msix descent de app-v
you could say that MSIX App Attach’s parents are App-V and MSI
@@AzureAcademy yes
Sorry my English it's not perfect
No problem, thanks for watching ☺️