Skip to content
Andy Kemp Consulting

Design and deploy#

Open deploy.andykemp.com/w365 and sign in. If you already have provisioning policies, they're listed first. Below them is the design, one page at a time. Your place is kept if you reload.

1. Cloud PCs#

  • Policy name. The users group, device group and user settings take their names from it, until you change them.
  • Language and region, installed on every Cloud PC.
  • Image: Windows 11 Enterprise with Microsoft 365 Apps (recommended), or Windows 11 Enterprise only. Review picks the newest supported image of your choice from Windows 365's gallery.
  • Single sign-on, on by default, so people sign in once with their work account, passkeys and Windows Hello included.

2. Network#

  • Microsoft-hosted network. Microsoft runs the network; Cloud PCs are Entra joined and reach the internet directly. Reach on-premises apps with a VPN or Global Secure Access. Your own network, through an Azure network connection, is coming soon; it's also what hybrid join needs.
  • Geography, from the regions Windows 365 offers your tenant.
  • Region: Automatic (recommended) lets Windows 365 use whichever region in the geography has capacity. A specific region keeps Cloud PCs there, but provisioning waits if it runs short.

3. Names#

Every Cloud PC gets a computer name of up to 15 characters: your prefix, the start of the user's name if there's room, and at least five random characters. For example, the prefix CPC gives CPC-%USERNAME:5%-%RAND:5%, so Alex Morgan's Cloud PC is called something like CPC-ALEXM-7K2Q9.

4. Access#

  • Users group: new (with you as owner) or existing. Windows 365 makes a Cloud PC for each person in it who has a Windows 365 Enterprise licence.
  • Licences (optional): assign a Windows 365 Enterprise licence through the group. The list shows your licences and how many are free.

  • Device group (optional): a dynamic group of these Cloud PCs for Intune. The recommended rule is Microsoft's one for a provisioning policy:

    (device.enrollmentProfileName -eq "<policy name>") and (device.deviceModel -contains "Cloud PC")

    Or match the name prefix, to cover several policies that share it:

    (device.displayName -startsWith "<prefix>-") and (device.deviceModel -contains "Cloud PC")

5. User settings#

Created by default and assigned to the users group: restore points every 12 hours, users can restore their own Cloud PC, no self-service reset, and no local admin. Turning local admin on shows a warning. Without user settings, Windows 365's defaults apply.

Review#

Review reads your tenant without changing anything:

  • your active roles. A missing role stops Review; holding more than the design needs (Global Administrator, say, or Intune Administrator where Windows 365 Administrator would do) is a notice only;
  • the gallery image, and whether it's nearing the end of support;
  • your Windows 365 Enterprise licences and how many are free, and whether any licence includes Intune;
  • a policy, user settings or groups with the same names. Existing ones are kept as they are; a policy that differs from your design is pointed out.

It then lists exactly what Deploy creates.

Deploy#

Five steps, each found by name first so running again only adds what's missing:

  1. Entra groups: the users group, and the device group if you asked for one.
  2. User settings.
  3. Provisioning policy.
  4. Assignments: the policy and user settings, to the users group, keeping any groups they're already assigned to.
  5. Licences: the chosen licence, to the users group.

Afterwards#

  • Add people to the users group (and give each a licence, if you didn't license the group).
  • Follow their Cloud PCs in the Intune admin center: Devices > Windows 365 > All Cloud PCs. Each takes up to about an hour.
  • Target Intune apps and policies at the device group.
  • People connect with Windows App on any device, or in a browser at windows365.microsoft.com.
  • When you're done, Remove the deployer's access deletes AKC W365 Deployer from your tenant. Windows 365 keeps running.