everybody hope you're having a great day we are going to talk about something i have been waiting
for for quite a while and here it is oh wait let me try this maybe that'll make it easier
that's right we are talking about msix app attach finally in the wvd admin portal
i'm Dean Cefola and this is the azure academy now to get a full understanding of what this feature
is and how it's going to help you let's start at the beginning what in the world is msix well it is
the next generation version of a packaging format we've had msis for forever and now we have msix
now one of the things that makes this packaging format so cool is that it's basically container
based taking that package and basically dump the contents of it into a virtual hard drive
and that virtual hard drive can be placed on a file share of any kind in any location which
can then be attached to your wbd session hosts and then the user simply needs to be registered
with the app manifest file so that they can see the application and open it as for performance
there's two things that you need to know first of all attaching the virtual hard drive will cost you
one eye op that's right one io once the drive is attached the msix container will be inflated
and the i o will depend a little more on what's inside the package the larger and more complex
the data the more i o you need on the permission side there's two parts as well this is one of
the beauties of msix app attach and that is that the hard drives are mounted in a read-only state
so the users on the other end can't mess with the application the other side of this is the session
hosts and much like fs logix the active directory computer objects for those session hosts will need
access to the file share as well as ntfs permissions now if you're using azure files
with ad or azure ad domain services authentication you'll have to grant the smb share contributor
role to those computer objects and the best way to do that is through a single group i'll show
you that in a minute one more little detail around this would be your user data so we've
got the application mounted and that's read only where does the user write the data related to that
application in their user profile just like always for example you have vs code that has a settings
and configuration file that would be in the user app data folder so what does that mean for you
well ultimately it could mean that your images no longer need to exist you can rely on microsoft's
gallery images simplifying your wvd processes your applications will be provided through app attach
and then any customizations and security requirements could all be filtered down to the
machines through group policies which ultimately could turn wvd into a virtually management-less
solution which would be a big saver in time money and complexity so this sounds awesome how can we
get started well it all begins with an application that application comes in some kind of format we
have to take whatever that application is and make an msix package out of it and for that we need a
tool say hello to the msix packaging tool this is a free tool right out of the microsoft store
and of course you could use other third-party tools to create your applications but the reason
why i like this one is one it's free two it's really simple and since i'm not an app developer
that sounds good to me so when you first run the tool you've got three options and the first one is
where we're going to start creating an app package so now we have to select the environment that we
want to create our package from so we'll choose the first option to create a package on our local
computer and hit next now there's going to be a packaging driver that is loaded onto the system
this is basically going to monitor the entire system file system registry services all that
stuff to monitor for changes and that's how it knows what to put inside the package and now
we have to select our application and you just click browse for that find your file and then
after that you can add any specific arguments to that file if you need to now we have our signing
preference and this is where we need to provide a code signing certificate in order to finish this
package that way it'll be a trusted package and every machine that you install this package on
will also need that certificate the most preferred way to do that of course would be through
an online certificate authority or your own ca that the machines already trust if you don't
know how to run your own certificate authority i've got something you could use in your own lab
for testing and that is powershell this is a quick script that i wrote it's up on my github link in
the description below and this will generate for you a self-signed certificate just be sure to edit
the dns name and the subject so that they can be the right things for your environment and the next
line we're generating a password because this is going to be a pfx file then we'll just export that
to finish it out now that we have our pfx file we need to get that installed on all of our session
hosts more about that in a minute and also we can present it back to our packaging tool so i'll go
ahead and select the sign with certificate pfx provide the password and now we've got our package
information so i'll just give my package a name and a display name and then a description of
my package and i'll hit next and at this point this is the coolest part of using this tool what
it's going to do is actually a normal standard installation of your application the beauty of
it is because you're already familiar with how to install this application this should be a breeze
and once you're finished with all of that stuff you can push next and you'll be prompted for are
you sure that you're done packaging but we're all done here we can click next and then we select a
location where we want to save our package and then click create now that we have an msix file
now we've got to make it into a hard drive now the code for all this is available in the wvd
documentation which is linked down below and you've got to download this msix tool
also linked in the documentation and then you just run this powershell script down here at
the bottom that's the important stuff that will take your msix package and dump the contents into
your virtual hard drive so i've copied down that code as well as some other code from the virtual
desktop documentation to create a virtual hard drive using the hyper-v powershell modules now
if you don't have that module installed you can either install it or just go right over here to
the disk configuration manager at the top go ahead and click action and create vhd and then you can
either type in the path or click browse give it a appropriate size for whatever your application
needs and then i would suggest selecting vhdx which will default also to dynamic allocation
this should keep your disks as small as possible once the disk has been created you'll want to
right click and initialize it and then we need to format it in ntfs and you know how to do that so
i'll just zip past that and go back to powershell now that we have our disk we can run the msix mgr
command which is going to extract the data out of our package and put it into our virtual hard
drive once the process is done you can see in our x drive we've got a bunch of stuff and in
there you'll find the app manifest file as well as a vfs folder and in there is where the contents of
our package are located then just go back to the disk manager and right click and dismount the disk
and here it is on my local file system which i will now copy up to the file share that i'm using
so over in active directory we need to be sure that the group we're going to set up is being
synced by azure ad connect which for me is under the corp ou so i'll go into my wvdo and there
are my computers i'll just select them all right click and then go to add to group and then i'll
search for msix app attach that's my group and then hit check name and we are good to go
make sure you give it enough time for azure ad connect to sync the group into azure or just
force a sync yourself then verify over in azure active directory under groups and you should see
your group next we'll go over to azure files so we can grant that side of the permissions
we'll go to my file share to app attach and then over on the left go to access control
i am and then at the top click the add button and add a role assignment over here you want to select
the drop down at the top for your role we want the storage file data smb share contributor all
right and then just search for your group msix app attach in my case select that and hit save there's
the group with the correct permissions now we need the ntfs side so go back to your server and
i'll right click on my share and go to properties then go to the security tab click edit and then
type in the name of the group msix app attach and then the permissions that it has by default here
the read and execute that's all we need and the last part of the prep are the certificates that
we created find your pfx file double click it we want to add this to the local machine and then
put in your appropriate password and then select a specific certificate store which in this case will
be called trusted people and then click next and that should import your certificate successfully
and just repeat the process if you happen to have more than one certificate now let's go to
the azure portal and set up msix app attach if you want to master the azure cloud you can start
right now by clicking the subscribe button and the notification bell so you don't miss anything
now at the time i'm recording this video this feature in the portal is in preview so there is
a sign up form where your subscription has to be white listed and there is a special
portal link again all that information in the description down below but once the feature is ga
you can just go into the normal azure portal and have fun so here in the portal click on the host
pool that you want to add your package to and then there it is the msix packages so just go ahead and
click that and then at the top click add now we just need to provide the unc path to your virtual
hard drive now when you put in the unc path what happens behind the scenes well the certificate
and the computer permissions to the share will be verified and then the msix container will
be inflated so you can see what's in that app manifest file then you'll be able to click this
drop down and see the list of the applications and you can add a display name as well then you set
the registration type as well as should this be an active or inactive package and then you click add
at the bottom so let's go over to our application groups and now that you have your msix package
loaded when you go to add that group check it out now you've got msix packages and you can select
your application from here it's standard wbd app management so when i launch the application
everything is normal for wvd my windows profile gets loaded onto the system i get logged into
the machine and then the application will launch let's spend a minute and talk about how msix app
attach is going to help you manage wvd now there are three main use cases in wvd the personal
desktops and then the pooled desktops and remote applications personal desktops always need to be
patched and maintained because they're somebody's personal computer but for pooled and remote apps
we should be doing things differently no matter what you're using all your session hosts have been
built from an image so let's talk about that image this generally has a few things in it windows
policy and configurations security baselines maybe some i.t related monitoring tools or antivirus
tools and then your applications and most people have a whole process in order to create or update
that image and maybe you've even automated the whole thing like we did in our previous video with
the azure image builder and that's great if you have done that but i want to do things a little
bit different microsoft builds and maintains images for all the supported operating systems
and their versions in the microsoft gallery and that means that you can select an updated version
of that image at any time and deploy a vm from it so i'd suggest that you don't need to have windows
in your custom image but wait there's more we have those policies and configurations and security
baselines and all that stuff can usually be pushed out through active directory group policy
or your own mdm solution like microsoft endpoint configuration manager which we will have a video
about soon so click that subscribe button so you don't miss it and i'd say that those things don't
need to be in an image either as for all those it support tools azure monitor will be able to
push out its monitoring tools through policy automatically to all of your systems and you
can even automate the deployment of something like microsoft defender advanced threat protection so
those don't need to be in the image either and finally we have the applications and for that
we have just two words msix app attach or is that three words anyway with msix app attaches the last
piece of the puzzle we can step away from that traditional way of managing your systems and move
forward with more of a devops mindset in managing wvd and the cloud and maybe even you can start
looking into full stateless wvd vms i wonder if anybody's done a video about that already
anyway it's okay if you're not ready for all this stuff yet you move at the pace that's good for you
i won't judge but do give me all of your questions and comments down below so i can respond to them
and if you want to see my video on stateless wvd vms it's right over there as well as the latest
video at the azure academy have a good week and we will see you next time happy learning