Pre-Installed PowerShell Modules in Windows Sandbox

The Windows Sandbox is a great tool to safely test installations or program behavior. However, in many cases you need PowerShell modules that are not pre-installed.

Luckily, you can use a WSB file combined with a PS1 script to automatically install modules whenever the Sandbox starts. I always use the same structure and simply adjust the module array as needed.

WSB File Structure

<Configuration>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\GitHub\scloud\Windows-Sandbox</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell -executionpolicy unrestricted -command "start powershell {-noexit -file C:\Users\WDAGUtilityAccount\Desktop\Windows-Sandbox\APP-Upload.ps1}"</Command>
  </LogonCommand>
</Configuration>

• Line 4–5: Maps the folder containing the PowerShell script into the Sandbox in ReadOnly mode.
• Line 9: Defines that APP-Upload.ps1 is executed at Sandbox startup.

PowerShell Script Content

# Array of the PowerShell Modules
$PSModules = "ExchangeOnlineManagement", "MicrosoftTeams"

# ExecutionPolicy and NuGet
Set-ExecutionPolicy Unrestricted -Force
Install-PackageProvider -Name NuGet -Force

# Install all defined Modules
foreach($Module in $PSModules){
    Write-Host $Module
    Install-Module -Name $Module -Force
}

In this example, the modules ExchangeOnlineManagement and MicrosoftTeams are installed automatically.

Execution

Once both files are ready, just double-click the WSB file. The Sandbox will start and install all defined PowerShell modules automatically.

You can find my example files on GitHub:

Windows Sandbox @GitHub

Additional Examples

Here are a few more sample setups I prepared:

Filename	Description
win32-automated	Import Win32 applications into Intune
HostMachine-Folder	Read/Write access to GitHub Repo and modules MSOnline, AzureADPreview
M365Documentation	Create M365 documentation (by Thomas Kur, GitHub)
PS-Modules	Example above
CallFlowDoku	Visualize Teams Call-Flows

Note: Always adjust the file paths in the WSB configuration to match your environment.

Personally, I often use this setup to test program installations and Win32 apps in Intune. (my take on win32 apps - Intune | scloud).

Enable Windows Sandbox

If the Sandbox does not start, the Windows feature might need to be enabled first:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online -NoRestart -ErrorAction Stop