Forum Discussion

RaymondChan's avatar
RaymondChan
Copper Contributor
Aug 17, 2023

Apply MSIX app attach application to Remote Desktop session with App Masking

I have applied MSIX app attach application in one Remote Desktop host pool. The app attach application is published in the Default Remote Desktop application group (DAG). Assignments are granted to users who need remote desktop access. We would like to limit the access of the app attach application to only some of those remote desktop users (e.g. 100 users have access to the remote desktop but only 10 users can see the app attach application and launch it). This can be done with FSLogix app masking rule for locally installed applications. How can we enable App Masking to the MSIX app attach application?

 

Based on this Q&A, the only way to grant permission to users is by means of Remote Application group assignments. 

https://learn.microsoft.com/en-us/answers/questions/1111595/msix-app-attach-with-fslogix-app-masking-possiblit

 

I have opened MS case and the support engineer confirmed that the user assignment is based on application group level. There is no option to allow some users in the same DAG group can see the MSIX app attach application , while the other users cannot see it.

 

Please kindly share any information or comments or tips & tricks

MSIX app attach with App Masking
  • Malcolm Walker's avatar
    Malcolm Walker
    Icon for Microsoft rankMicrosoft
    Aug 22, 2023
    Hi Raymond. If you want to limit access to the MSIX app Attach applications, just create a new Remote App group for the MSIX App Attach application and limit access that way with an Azure AD group. You could also create a separate Host Pool and add the MSIX App attach package to that desktop application group. Typically from an App Management standpoint, it's very rare to see App Masking and MSIX App Attach being used together on the same host pool. I'm not saying it's not possible, but very rare in my experience.
    • RaymondChan's avatar
      RaymondChan
      Copper Contributor
      Aug 24, 2023

      Hi Malcom,

       

      Thanks for your comment. Understood Remote App group with specific assignment to an AD group can limit access of app attach application to a group of users. However our requirement is giving full desktop experience to users while we still can control only a few users can access specific application (e.g. 100 users have access to the Remote Desktop session but only 10 of them can launch MS Office from the Start menu of their remote desktop sessions). This can be achieved with FSLogix app masking rule. We would like to explore the capabilities of MSIX app attach to providing similar masking feature. 

    • lctimcoles's avatar
      lctimcoles
      Copper Contributor
      Oct 30, 2023

      I've watched this twice now and I don't think they actually answered Raymond's question. They talked about winget identifying store apps but there was nothing about how to selectively allow app-attach apps within a Full Desktop session. I also have the same question as Raymond. I get that a Remote App could be added and controlled by assignment, but the Remote Apps are not available within the full Desktop session.

Resources