Skip to content
Andy Kemp Consulting

Before you start#

Access#

W365 Deploy needs an Andy Kemp Consulting account with access to it: talk to Andy. Windows 365 itself is licensed to you by Microsoft.

To see it first, the live demo is the same page on a made-up tenant.

Licences#

  • Windows 365 Enterprise for each person who gets a Cloud PC. The licence decides the Cloud PC's size, such as 2 vCPU, 8 GB RAM and 128 GB storage.
  • Windows Enterprise, Microsoft Intune and Microsoft Entra ID P1 for each of them, which Microsoft 365 E3, E5 or Business Premium include. Without Intune, provisioning fails.
  • Entra ID P1 also covers the optional device group (dynamic groups) and group licensing.

No Azure subscription is needed on the Microsoft-hosted network.

Roles#

W365 Deploy uses only your own sign-in, and Review checks these before anything changes. You don't need Global Administrator; if you're signed in as one, Review says so.

To You need
Create the provisioning policy and user settings Windows 365 Administrator, or Intune Administrator
Create the users or device group Groups Administrator, or User Administrator
License the users group License Administrator, or User Administrator

If you hold a role through Privileged Identity Management, activate it before Review.

Decisions to make#

  • A name for the policy, such as the persona or department it's for. Groups and settings are named after it.
  • Windows 11 with Microsoft 365 Apps, or without. Without them, you deploy apps with Intune to the device group, and Cloud PCs take longer to be ready.
  • The geography, nearest your people. Leave the region on Automatic unless data has to stay in one region.
  • A naming prefix, up to 8 characters.
  • Whether to license the group, or assign licences to people yourself.
  • Local admin. Off by default; turn it on only if people genuinely need it.

The first sign-in asks you to consent to AKC W365 Deployer reading your directory and Windows 365 (Directory.Read.All, CloudPC.Read.All). Deploy asks again, for that tab only, for CloudPC.ReadWrite.All, plus Group.ReadWrite.All if it creates groups and LicenseAssignment.ReadWrite.All if it licenses the group. These are delegated: the page can only do what your own roles allow.