Apply MSIX app attach application to Remote Desktop session with App Masking

[RaymondChan]

I have applied MSIX app attach application in one Remote Desktop host pool. The app attach application is published in the Default Remote Desktop application group (DAG). Assignments are granted to users who need remote desktop access. We would like to limit the access of the app attach application to only some of those remote desktop users (e.g. 100 users have access to the remote desktop but only 10 users can see the app attach application and launch it). This can be done with FSLogix app masking rule for locally installed applications. How can we enable App Masking to the MSIX app attach application?

Based on this Q&A, the only way to grant permission to users is by means of Remote Application group assignments. 

https://learn.microsoft.com/en-us/answers/questions/1111595/msix-app-attach-with-fslogix-app-masking...

I have opened MS case and the support engineer confirmed that the user assignment is based on application group level. There is no option to allow some users in the same DAG group can see the MSIX app attach application , while the other users cannot see it.

Please kindly share any information or comments or tips & tricks

[#2]

Hi Raymond. If you want to limit access to the MSIX app Attach applications, just create a new Remote App group for the MSIX App Attach application and limit access that way with an Azure AD group. You could also create a separate Host Pool and add the MSIX App attach package to that desktop application group. Typically from an App Management standpoint, it's very rare to see App Masking and MSIX App Attach being used together on the same host pool. I'm not saying it's not possible, but very rare in my experience.

[#3]

Hi Malcom,

Thanks for your comment. Understood Remote App group with specific assignment to an AD group can limit access of app attach application to a group of users. However our requirement is giving full desktop experience to users while we still can control only a few users can access specific application (e.g. 100 users have access to the Remote Desktop session but only 10 of them can launch MS Office from the Start menu of their remote desktop sessions). This can be achieved with FSLogix app masking rule. We would like to explore the capabilities of MSIX app attach to providing similar masking feature.