The next step is to configure MSIX App Attach, Nerdio Manager's method for delivering applications to session hosts without installing them directly on the image.
An MSIX App Attach image is an expanded container - a VHD, VHDX, or CIM file - holding one or more extracted MSIX packages. Nerdio Manager mounts these images to session hosts in the host pool, making the packaged applications available to users as soon as they sign in.
Nerdio Manager allows you to manage App Attach images and packages.
The following is a sample workflow:
-
Upload the App Attach image to the Nerdio Manager-managed image library. See Upload an App Attach image file and Upload an MSIX package file.
-
Add the App Attach images in the Nerdio Manager-managed image library as App Attach packages in Azure. See Use the App Attach package wizard.
Note
The App Attach package wizard allows you to assign users and groups in a host pools to the App Attach package.
-
You can manage image versions, as needed. See Upload a new version of an app and Manage Nerdio App Attach image versions.
-
You can manage assignments, as needed. See Manage App Attach Assignments.
To help you get you started, we created a few VHD(X) packages for some popular applications that you can download and start using in your AVD environment for testing purposes.
Note
These packages are not intended for production purposes. They should be used for proof of concept testing.
Google Chrome
Mozilla Firefox
Notepad++
PuTTY
VLC
Certificate
-
The certificate can be downloaded here.
-
The certificate is the same for all the packages.
You can upload an VHD/VHDX/CIM image to the Nerdio Manager-managed image library.
To upload an image:
-
Navigate to Applications > Catalog > App Attach.
-
Select the Nerdio App Attach Images area.
-
Select Upload image.
-
Enter the following information:
-
Friendly name: Type the name that you want to appear on the images list.
-
Description: Type a description.
-
Version: Type the version number of the image that you are uploading. This must be unique.
-
Storage locations: From the drop-down list, select the linked app storage location(s) in the AD-integrated Azure Files share.
Note
-
App Attach does not support Entra Domain Services. This needs to be Active Directory Domain Services (ADDS).
-
For App Attach working in Entra ID, you should enable Entra ID Host support. Navigate to Storage > Azure Files > Manage storage account.
-
-
Image File(s): Select the VHD(X)/CIM file(s) that contains the App Attach application expanded from MSIX installer or upload file(s) of the App-V package.
-
Certificate (.cer) file(s): Select the certificate file(s).
Note
A certificate that was used to create the package must be installed on all session hosts VMs. If you used a self-signed certificate to create the package, upload it here and it is automatically installed for you. Alternatively, you can install the certificate on the desktop image and re-image the session host VMs
-
-
Once you have entered all the desired information, select Upload.
The image is uploaded to Nerdio Manager.
If you do not already have a VHD/VHDX./CIM that contains the image, Nerdio Manager allows you to upload the MSIX file and Nerdio Manager automatically creates a VHD file for you. The VHD image is added to the Nerdio Manager-managed image library.
To upload an MSIX package file:
-
Navigate to Applications > Catalog > App Attach.
-
Select the Nerdio App Attach Images area.
-
Select Upload MSIX apps(s).
-
Enter the following information:
-
Image name: Type the image name.
-
Storage locations: From the drop-down list, select the storage locations where the App Attach application are stored. .
Note
-
Storage location should be in the same Azure region as the session host VMs that access the app.
-
In Premium and Core editions only, the first selected location is considered to be primary. The primary location contains all versions of the application.
-
-
MSIX file(s): Select the MSIX file(s).
-
Certificate (.cer) file(s): Optionally, select the certificate file(s).
Note
To expand the MSIX app into a VHDX container, a temporary VM is created to perform the operation and then deleted. It is recommended that you simply let Nerdio Manager handle the temporary VM's configuration. Otherwise, select Show advanced settings to specify the temporary VM's details.
-
-
Once you have entered all the desired information, select OK.
The MSIX file is uploaded, and Nerdio Manager begins the process of creating a VM to package the file into a VHDX image.
The App Attach package wizard adds the selected App Attach images in the Nerdio Manager-managed image library as App Attach packages in Azure. In addition, it allows you to assign the packages to all the desired users and groups in the specified host pools.
To use the App Attach package wizard:
-
Navigate to Applications > Catalog > App Attach.
-
Select the App Attach Packages area.
-
Select + Add App Attach package.
-
Alternatively, from the Nerdio App Attach Images area:
-
Locate the image you wish to work with.
-
From the action menu, select Package wizard.
-
-
Enter the information in the App attach wizard.
-
In the Image area, enter the following information:
-
Image source: From the drop-down list, select the image source.
-
App Attach Image: From the drop-down list, select the application image.
-
Image Version: From the drop-down list, select the version of the application image.
-
Temporary replica: From the drop-down list, select the version replica used to extract metadata from the selected App Attach image.
-
Temporary host pool: From the drop-down list, select the temporary host pool used to expand the image.
Note
-
The temporary host pool is required as a proxy to extract metadata from the selected App Attach image. No changes are made to the pool configuration and any host pool may be used. However, as best practice we recommend the creation of a dedicated App Attach pool. At least one desktop must be running in the pool to proceed.
-
The temporary host pool is also used to expand the image and test if the image is valid.
-
-
-
In the Package area, enter the following information:
-
Resource group: From the drop-down list, select the resource group where the App Attach package is created.
Note
This resource group does not need to be in the same region as the pool assignments, but it is recommended as best practice.
-
Packages: From the drop-down list, select one or more MSIX packages to make available to users on the selected host pools.
-
-
In the Assignments area, enter the following information:
-
Host Pools: From the drop-down list, select one or more host pools from the subscription of the selected resource group that are assigned to the package(s).
-
Users and Groups: From the drop-down list, select the authorized users and groups to run the applications included in the selected package(s).
-
-
In the Summary area, review the selections.
-
Once you have reviewed all the desired selections, select Run.
The App Attach wizard task starts. You can see the task's progress in the Tasks window.
Nerdio Manager allows you to have multiple versions of an app. Therefore, you can upload new versions of an app as desired.
To upload a new version of an app:
-
Navigate to Applications > Catalog > App Attach.
-
Select the Nerdio App Attach Images area.
-
Locate the image you want to work with.
-
From the action menu, select Upload version.
-
Enter the following information:
-
Version: Type the version number of the image that you are uploading. This must be unique.
-
Storage locations: Select the storage locations where the App Attach application is to be stored.
Note
Storage location should be in the same Azure region as the session host VMs that are accessing the app.
-
Image file(s): From the drop-down list, select the application image.
-
Certificate (.cer) File(s): Optionally, select the certificate file(s).
Note
A certificate that was used to create the package must be installed on all session hosts VMs. If you used a self-signed certificate to create the package, upload it here and it is automatically installed for you. Alternatively, you can install the certificate on the desktop image and re-image the session host VMs.
-
-
Once you have entered all the desired information, select Upload.
Nerdio Manager allows you to manage image versions. This includes uploading a new image, changing its storage location, or updating the host pools with the desired version.
To manage image versions:
-
Navigate Applications > Catalog > App Attach.
-
Select the Nerdio App Attach Images area.
-
Locate the image you want to work with.
-
Select the Image versions icon.
-
Locate the image version you wish to set as the default.
-
Perform any of the following on the image version:
-
Select the Update host pools icon
to update the assigned host pools with the selected version.
-
From the action menu, select Change storage locations, to change the image's storage location.
-
-
Alternatively, select + Upload new version to upload a new version.
Related Topics
Nerdio Manager allows you to assign users and groups in host pools to App Attach packages. You must first upload an App Attach image and add an App Attach package before you can perform the assignments. See Manage App Attach images and packages for details.
Note
These assignments can be performed by using the App Attach package wizard. See Manage App Attach images and packages for details.
You can assign an MSIX App Attach package to a host pool.
Warning
MSIX App Attach is deprecated. The feature does not receive any further updates from Microsoft. It is recommended that all new packages be created as App Attach.
To add an MSIX App Attach package to a host pool:
-
Locate the host pool you wish to assign the app to.
-
From the more actions menu
icon, select Applications > Catalog > App Attach.
-
When the App Attach window is displayed, from the more actions menu
-
Enter the following information:
-
Image Source: From the drop-down list, select the location of the image that contains MSIX packages.
Note
The image can be stored in Nerdio Manager's image library or on any SMB file share that session host VMs have access to. If you have uploaded or created MSIX images using Nerdio Manager, select Image Library.
-
MSIX App Attach Image: From the drop-down list, select an MSIX App Attach image containing the MSIX packages.
-
Image Version: From the drop-down list, select the image's version to be added to the host pool.
-
Packages: From the drop-down list, select one or more MSIX packages/apps present in the image to make available to users on this host pool.
-
-
Once you have entered all the desired information, select OK.
You can assign the package to users and groups in host pools.
To assign an App Attach package to users and groups:
-
Navigate to Applications > Catalog > App Attach.
-
Select the App Attach Packages area.
-
Locate the App Attach package you want to work with.
-
Select the Assignments icon.
-
Enter the following information:
-
Users and groups: From the drop-down list, select the users and groups to assign the package to.
Note
You must specify users and/or groups.
-
Host pools: From the drop-down list, select the host pools to assign the package to.
-
-
Once you have entered all the desired information, select OK.
You can assign App Attach packages to a host pool.
To assign an app to a host pool:
-
Locate the host pool you wish to assign the app to.
-
From the more actions menu
-
When the App Attach window is displayed, select Assign App Attach packages.
-
Enter the following information:
-
App Attach Packages: From the drop-down list, select the App Attach package(s).
-
-
Once you have entered all the desired information, select OK.
Nerdio Manager uses Azure Files share technology to store App Attach packages and their associated metadata. You can use an existing Azure Files share or create a new one with Nerdio Manager.
Note
What you need to configure depends on how your session hosts are joined. Entra ID-joined hosts and AD DS-joined hosts have different, non-overlapping requirements. Work through the section that matches your hosts.
App Attach supports the following identity providers:
-
Microsoft Entra ID
-
Active Directory Domain Services (AD DS)
For background on App Attach itself, see the Microsoft article App attach and MSIX app attach in Azure Virtual Desktop.
Entra ID-joined hosts can use App Attach applications. The only requirements are on the storage account that holds the App Attach images:
-
It must be in the same subscription as the session hosts.
-
It must have a Reader and Data Access role assignment whose members include Azure Virtual Desktop and Windows Virtual Desktop ARM Provider.
Nerdio Manager creates that role assignment for you when you enable Entra ID host support on the storage account. You can do this on a new share or on a share you already have.
Note
The storage account can be joined to Active Directory, joined to Entra ID, or not joined at all. You do not need to configure share-level or NTFS permissions for Entra ID-joined hosts.
To enable Entra ID host support on an existing Azure Files share:
-
Navigate to Cloud Desktops > Storage > Azure Files.
-
Locate the Azure Files share that stores your App Attach images.
-
From the share's action menu, select Manage.
-
In the wizard that opens, go to the Storage account tab and select Entra ID host support.
-
Select SAVE to save.
Note
Enabling this option adds the Reader and Data Access role assignment, with Azure Virtual Desktop and Windows Virtual Desktop ARM Provider as members, to the storage account. If you would rather assign it yourself, add the role to the storage account under Access Control (IAM) in the Azure portal with those same two members.
All three of the following conditions are mandatory:
-
The storage account that stores the App Attach images is joined to AD DS.
-
App Attach NTFS permissions are configured on the file share.
-
Share-level permissions are configured.
Default file share NTFS permissions
-
BUILTIN\Administrators:(OI)(CI)(F) -
BUILTIN\Users:(RX) -
BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -
NT AUTHORITY\Authenticated Users:(OI)(CI)(M) -
NT AUTHORITY\SYSTEM:(OI)(CI)(F) -
NT AUTHORITY\SYSTEM:(F) -
CREATOR OWNER:(OI)(CI)(IO)(F)
File share NTFS permissions for App Attach
-
BUILTIN\Users:(RX) -
BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -
NT AUTHORITY\Authenticated Users:(OI)(CI)(M) -
CREATOR OWNER:(OI)(CI)(IO)(F)
Tip
Rather than setting these by hand, let Nerdio Manager apply them. In the Azure Files wizard, select Assign NTFS file-level permissions and then App Attach, which grants Authenticated Users Read permission to sub-directories in the share. This is the recommended option for shares containing App Attach applications.
Note
Assigning NTFS file-level permissions automatically creates a temporary VM to perform the permission assignment task.
Choose one of the following configurations.
Option 1: Read-only access for all authenticated identities
Set the default share-level permission on the storage account to at least Storage File Data SMB Share Reader for all authenticated identities.
In Nerdio Manager, use the Share-level permissions option in the Azure Files wizard to set this. SMB Share Reader gives all authenticated users read-only access to the share, which is what App Attach requires.
Option 2: Read-only access for domain computers
-
In Active Directory, create a new Global Security group in an Organizational Unit (OU) that is being synched to Entra ID with ADConnect.
-
Add Domain Computers to the new group.
-
In the Azure portal, open the file share's Access Control and add the new security group with at least the Storage File Data SMB Share Reader role.
Note
You may need to wait for the next sync cycle for new groups to be available in Entra ID.
Option 3: A custom configuration
Any configuration that gives the session host computer objects at least read access to the share is supported. Adapt the options above to suit your organization's security policies.
Comments (0 comments)