How to Configure Windows Sandbox Custom Audio Input and Microphone Passthrough via XML in Windows 11

Testing voice over IP (VoIP) applications, speech-to-text machine learning models, communication tools (such as Microsoft Teams or Zoom), and browser-based WebRTC microphone permission prompts requires audio recording capabilities inside the test environment. By default, Windows Sandbox in Windows 11 enables audio output (speakers) while disabling audio input (microphone) to protect user privacy. Using custom Windows Sandbox configuration (.wsb) XML profiles paired with PowerShell logon configuration scripts, developers can enable microphone passthrough and configure default audio recording devices upon launch.

Understanding Windows Sandbox Audio Redirection Architecture

Audio virtualization in Windows Sandbox operates through the Remote Desktop Protocol (RDP) virtual channel pipeline:

• <AudioInput>Enable</AudioInput>: Directs the hypervisor to bridge the host machine’s active recording device (microphone) into the sandbox container. When set to Disable, Windows Sandbox detects no audio capture devices.
• Privacy Controls in Windows 11: Windows 11 enforces global microphone privacy permissions. Even if the WSB file enables audio input, the host operating system must grant desktop apps permission to access the microphone.
• <LogonCommand>: Executes automated scripts to initialize audio endpoints, test recording buffers, and verify microphone capture levels upon desktop session startup.

Authoring the Windows Sandbox WSB Profile

Save the following configuration as Audio_Capture_Sandbox.wsb on your Windows 11 host machine:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <AudioInput>Enable</AudioInput>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxAudioAssets</HostFolder>
      <SandboxFolder>C:AudioDeploy</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:AudioDeployVerify-AudioInput.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Audio Verification Script

In directory C:SandboxAudioAssets on your host, create Verify-AudioInput.ps1:

Write-Host "Initialising Windows Sandbox Audio Subsystem..." -ForegroundColor Cyan

# 1. Start Windows Audio and AudioEndpointBuilder services
Set-Service -Name "Audiosrv" -StartupType Automatic
Start-Service -Name "Audiosrv"
Set-Service -Name "AudioEndpointBuilder" -StartupType Automatic
Start-Service -Name "AudioEndpointBuilder"
Write-Host "Windows Audio Services verified and running." -ForegroundColor Green

# 2. Query PnP Audio Devices inside Sandbox
Write-Host "Detecting Virtual Audio Hardware:" -ForegroundColor Yellow
$AudioDevices = Get-PnpDevice -Class "MEDIA" | Where-Object { $_.Status -eq "OK" }
$AudioDevices | Format-Table FriendlyName, InstanceId, Status

# 3. Check for Active Audio Capture Endpoints via WMI
$SoundDevices = Get-CimInstance -ClassName Win32_SoundDevice
$SoundDevices | Format-Table Name, Manufacturer, Status

# 4. Enable App Access to Microphone via Registry
$ConsentPath = "HKLM:SOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophone"
if (Test-Path $ConsentPath) {
    Set-ItemProperty -Path $ConsentPath -Name "Value" -Value "Allow" -Type String
    Write-Host "Microphone system access explicitly set to ALLOW." -ForegroundColor Green
}

Write-Host "Audio Input configuration complete. Launch recording or WebRTC applications." -ForegroundColor Cyan

Running and Verifying Audio Capture in the Sandbox

1. Double-click Audio_Capture_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in seconds with hardware GPU acceleration and audio input enabled.
3. The PowerShell window opens automatically upon logon, verifies the audio endpoints, and confirms microphone privacy consent.
4. Launch Microsoft Edge inside the sandbox and navigate to a WebRTC testing site (such as https://webrtc.github.io/samples/src/content/getusermedia/gum/).
5. Grant browser microphone permissions; speak into your host microphone and observe the input volume meter modulating in real time.
6. Closing Windows Sandbox terminates the session, completely wiping all temporary audio recordings and permission states.