Everything You Want To Know: The Anatomy of Windows 365

There is no denying how cloud-based solutions have evolved over the decades to become an integral part of most organizations’ operations. Businesses have grown to depend on these services to improve the ease of doing business as well as bolster their cyber security.

With Windows 365, Microsoft enables businesses to operate more effectively as well as offer their workforce greater flexibility.

The arrival of Windows 365 coincides with an increasing need in the workplace to offer employees more agility. Organizations can take advantage of virtualization technology to increase their talent pool by hiring the best people from anywhere in the world.

By using services like Windows 365, these individuals can easily communicate and collaborate with team members from across the globe. Given how much there is to gain from Windows 365, I will today be going through everything you may need to know about this platform.

Breaking new ground

In July of 2021, Microsoft announced a brand new service that would enable users to access Cloud PCs from anywhere. Although similar features have been available through virtualization and remote access software, Windows 365 has now become the first official service from Microsoft.

As businesses increasingly embrace the idea of a hybrid work environment, Windows 365 is aiming to be at the forefront of the services that potential clients will be looking into. By streaming Windows 10 or Windows 11 onto almost any device, Microsoft will offer users the ability to take their desktops anywhere.

And Microsoft has assured clients that Cloud PCs will be highly secure thus users will be able to work remotely with greater peace of mind.

Accessing your desktop on the cloud will also be relatively easy because all you need is a modern browser or Microsoft’s Remote Desktop app. So as long as your internet connection is good enough to stream videos then you’ll be able to access your Cloud PC on most devices.

Users will get instant access to their Cloud PCs and can stream Windows sessions with all of their same apps, tools, data, and settings across Macs, iPads, Linux machines, and Android devices.

And according to Wangui McKelvey, a general manager for Microsoft 365, “You can pick up right where you left off, because the state of your Cloud PC remains the same, even when you switch devices.

Windows 365’s solid foundation

Ideally, any service that you want to invest in needs to have a proven track record. However, given that Windows 365 is still less than a year old there’s not much of a track record to go over.

This is why it’s important to understand the foundation on which Windows 365 is built. Because the company that has given us Azure Virtual Desktop (AVD) is the same that is responsible for the Windows 365 Cloud PC.

And if there’s anything that AVD has shown us it is that Microsoft has a good handle on cloud computing services. This is vital for you when considering Windows 365 because Microsoft has built it on its Azure infrastructure.

So you can rest assured that if you go with Windows 365, you’ll be investing in a service that is founded on a tried and tested platform. Therefore, we can take a look at AVD’s track record and some of what it has been able to offer clients.

Azure Virtual Desktop has proven to be a cost-effective alternative to scaling up a traditional virtual desktop environment in your own data center. The reduction in expenses is something that could very well help you to have a better ROI.

AVD has also proven to be invaluable to companies because of how it lets organizations control apps and data while allowing their employees to access those resources on their own devices.

This means that you can offer your workers greater flexibility in how they work while still retaining overall control and keeping security standards high. Although you could get some of these benefits from a traditional VDI environment, the service that you get from Microsoft comes at a better price point with better security.

One of the greatest benefits that you will gain from investing in Windows 365 is that it will allow you to experience Windows 10 or Windows 11 at its very best. That’s in addition to having the full power of Microsoft 365 in your hands. AVD has built a reputation for offering clients a smooth experience when using these Microsoft products. And with Windows 365 being based on AVD, you can expect the experience to be even better.

Selecting an option

Microsoft wants to avail its Windows 365 services to as many organizations as possible. Obviously, that is not going to be a simple task considering the vast differences and needs between smaller companies and large enterprises.

However, Microsoft is determined to cater to the needs of the businesses that require this virtualization service. To that end, Microsoft offers us two different editions – Windows 365 Business and Windows 365 Enterprise.

The former is designed for smaller organizations while the Enterprise edition is aimed at larger ones. And the great thing about these options is that they share a lot of the same range of features.

Windows 365 Business

This edition of Windows 365 is going to be targeting smaller businesses that require no more than 300 Cloud PCs. The service allows these companies to get a simple way to purchase, deploy, and manage Cloud PCs.

So if you do sign up for Windows 365 Business, you can easily provide Cloud PCs to any of your users that need them. Doing so allows them to stream their apps, data, content, settings, and storage from the Microsoft cloud.

Purchasing Windows 365 subscriptions can be done either through the Windows 365 product site or via the Microsoft 365 admin center. And once you have purchased your subscription, you can assign licenses to users in your organization using the Microsoft 365 admin center. As far as sizing options are concerned, there are fixed-price licenses for the different Cloud PC sizes. During the assigning of licenses to users, you need to choose a size option. The options come with different numbers of CPUs, RAM, and storage to cater to the different work needs. The table below details this information:

* Microsoft is retiring the first option (1vCPU) so clients are encouraged to select the 2vCPU option as the minimum configuration going forward.

The Windows 365 Business edition doesn’t have any licensing pre-requirements to purchase and deploy. Also, Microsoft has simplified the provisioning process which will use the default configurations.

After Cloud PC licenses have been assigned, provisioning of those Cloud PCs will happen automatically using a standard image. When it comes to Windows updates, the default Windows Update for Business settings will be configured for users.

And if you have an Intune license then these settings can be edited. Moreover, device management is only going to be limited to the assigning and unassigning of licenses in the Microsoft Admin Center. Although, those that have Intune licenses may get some device management via Microsoft Endpoint Manager.

Users will be able to access their Cloud PCs from windows 365.microsoft.com or alternatively, they can use the Microsoft Remote Desktop app. During usage, users can restart, reset, rename, and troubleshoot their Cloud PCs.

Windows 365 Enterprise

The second option that Microsoft gives clients is for larger organizations that have significantly greater computing needs. Unlike with the Business edition, in this case, users will require licensing for Windows 10 or 11 Enterprise, Microsoft Endpoint Manager, Azure AD P1. The networking situation will see the networking go through a client’s Azure VNet since it’s not part of the license.

As the provisioning process goes on, each business can customize and configure the process to meet their specific needs. It’s the role of your admins to choose the network, configure user permissions, and then assign the policy to an Azure AD group.

With that done you can then provision the Cloud PCs using either standard gallery images or custom images. Microsoft Endpoint Manager can be used for managing Windows updates as well as for troubleshooting purposes.

Users can access their Cloud PCs in the same way as Enterprise clients from the Windows 365 website or via the Microsoft Remote Desktop app. Furthermore, users can restart, rename, and troubleshoot their Cloud PCs and will be assigned a standard user role by default.

However, the admin can change that in the Microsoft Endpoint Manager admin center. Windows 365 Enterprise offers high-end security measures through the use of features such as Conditional Access and integration with Defender for Endpoint.

In addition, for clients with E5 licensing, their Cloud PCs will respond to Defender for Endpoint policies and appear in MDE dashboards.

Cost of service

Regardless of how good a product may be, choosing whether or not to subscribe may ultimately come down to cost. As we’ve already discussed above, Microsoft offers two editions of Windows 365 and both of them have a range of configurations that clients can pick from. This should help all businesses that want Cloud PCs to find something that can fit within their budget.

So small businesses with less than 300 users and massive organizations with countless users can all potentially find a subscription that suits them. The pricing model has fees starting from $20 per user per month for the lowest-end SKU, up to $162 per user per month for the most expensive one. In addition, unlike with the consumption-based pricing model that you get with Azure Virtual Desktop, Windows 365 gives you fixed monthly subscriptions. And if you need to scale up then you are given the option of getting a different subscription as well.

Clients with the Windows 365 Business subscription can get a single virtual core, 2GB of RAM, and 64GB of storage for the starting price of $20.

However, this fee is only available for clients that have Windows Hybrid Benefit. The latter is Microsoft’s Bring-Your-Own license model that is designed to help clients to apply existing (or new) licenses toward the cost of a product. If not, then that cost goes up to $24.

But, if your organization requires a lot more, you can pay $158 for eight virtual cores, 32GB of RAM, and 512GB of storage. The same situation regarding Windows Hybrid Benefit applies here and so without it, the fee goes up to $162.

The pricing model is pretty much consistent and the range of prices remains the same for Windows 365 Enterprise clients. Those that aren’t looking for a lot of computing resources can get a single virtual core with 2GB of RAM and 64GB of storage for the same $20.

However, if your computing needs are a lot greater then you can get the option that offers eight virtual cores, 32GB of RAM, and 512GB of storage for $158 per user per month.

Cloud PC Provisioning

The provisioning process in Windows 365 is an automated one that is going to:

  • create a Cloud PC virtual machine.
  • set it up for the end-user.
  • perform any other necessary tasks to ready the Cloud PC for use.
  • send access information to the user.

Life is made easier for admins as they only need to furnish a few configuration details to get the provisioning process going. Once that’s done Cloud PCs will be automatically provisioned for all users who have a Windows 365 license and matching configuration details.

Because this process is a one-time per user and per license process, a user and license pair can only have a single Cloud PC provisioned for them. The complete process is going to follow the steps below:

  • Starts with the creation of a provisioning policy to manage access to the Cloud PCs. Provisioning policies are key to the entire process as they are responsible for building, configuring, and availing Cloud PCs to end-users. Each policy will require you to provide details regarding the on-premises network connection, the image used to create each Cloud PC, and an Azure AD user group.
  • Assignment of a Windows 365 license to users in the Azure AD user group will begin the provisioning process. And the provisioning of the Cloud PC will be carried out automatically by Windows 365 after which it will then send the necessary access information to the user. The automation is going to proceed in 3 phases that will be invisible to the administrator.
  • The last part of the process involves the end-user receiving the necessary access information that will allow them to sign in to the Windows Cloud PC from anywhere.

Windows 365 Architecture

Virtual network connectivity

All Cloud PCs are going to have a virtual network interface card (NIC) in Microsoft Azure. There are two available NIC management options:

  • Bringing an Azure subscription or managing the NIC won’t be necessary for those using Azure AD Join and a Microsoft-hosted network.
  • NICs are created by Windows 365 in your Azure subscription in instances where you bring your own network and use an OPNC.

The configuration of your OPNC is what will determine how the NICs are attached to an Azure Virtual Network. There are many regions in which Windows 365 is supported and to control which region is used you can:

  • Choose the Microsoft-hosted network as well as an Azure region.
  • Choose an Azure virtual network from your Azure subscription during the creation of the OPNC.

The region selected is what determines where the Cloud PC will be created and hosted. However, with your own virtual network access can be extended between your current Azure regions to other Azure regions supported by Windows 365.

Microsoft Endpoint Manager integration

Management of all Cloud PCs is handled with MEM. The latter along with associated Windows components have various network endpoints that must be allowed through the Virtual Network. If you don’t use MEM to manage Apple and Android devices then you can ignore the endpoints.

The system requires you to only grant access to a subset of endpoints based on your MEM tenant location. Microsoft recommends allowing access to an entire region and not just a specific endpoint to allow for the possible relocation of tenants within a region.

Identity services

Windows 365 relies on both Azure AD and on-premises AD DS. With Azure AD you get:

  • User authentication for Windows 365.
  • Device identity services for MEM via Hybrid Azure AD Join or Azure AD Join.

For the configuration of Cloud PCs to use Hybrid Azure AD Join, AD DS offers:

  • On-premises domain join for Cloud PCs.
  • User authentication for RDP connections.

And for the configuration of Cloud PCs to use Azure AD Join, Azure AD gives you:

  • The domain join mechanism for the Cloud PCs.
  • User authentication for RDP connections.

Azure AD

User authentication and authorization for the Windows 365 web portal and Remote Desktop client apps is provided by Azure AD. Azure AD Conditional Access can be included to offer.

  • multi-factor authentication
  • sign-in risk management
  • restrictions based on location
  • device compliance controls
  • session limits

Active Directory Domain Services

Microsoft gives you the option of having your Cloud PCs either Hybrid Azure AD Joined or Azure AD Joined. Your Cloud PCs will require domain joining to an AD DS domain if you want to use Hybrid Azure AD Join. And that domain should be synchronized with Azure AD. The domain’s domain controllers need to be hosted in Azure or on-premises.

If it’s the latter, connectivity should be made from Azure to the on-prem environment and the type can be either Azure Express Route or site-to-site VPN. The connectivity should be set up to enable communication from the Cloud PCs to the domain controllers needed by AD.

Hosted on behalf of” architecture

This type of architecture enables Microsoft services to attach hosted Azure services to a customer subscription. Using this type of connectivity model allows a Microsoft service to provide options other than the usual consumption-based services. These include software-as-a-service and user-licensed services.

All Cloud PC connectivity comes from the virtual NIC. Because of “hosted on behalf of” architecture, you have Cloud PCs that exist in the subscription owned by Microsoft. This basically means the costs for running and managing the infrastructure are borne by Microsoft.

Azure Virtual Desktop connectivity

AVD is responsible for the provision of Cloud PC connectivity. Thus, there aren’t going to be any inbound connections directly from the internet to the Cloud PC. Rather, the connections will be established from:

  • The Cloud PC to the AVD endpoints.
  • The Remote Desktop clients to AVD endpoints.

Microsoft recommends the use of Service Tags for AVD to identify these endpoints. By doing so you should be able to ease the configuration of network security controls. It’s also worth noting that configuring your Cloud PCs to make these connections is not a pre-requisite.

The integration of AVD connectivity components into gallery or custom images is seamlessly performed by Windows 365. Furthermore, third-party connection brokers aren’t going to be supported on Windows 365 Cloud PCs.

How businesses will benefit

Having a great-sounding service availed to you is one thing, but after looking into what Windows 365 is, you still need to know how exactly this product will help your business. After all, there are plenty of great services out there that just aren’t a good fit for your business. So just what are the benefits that Windows brings to an organization?

Remote access

Most people across the globe have probably familiarized themselves with remote work over the last couple of years. Although plenty of businesses saw the need for remote access during the pandemic, the need for it has grown beyond the pandemic scenario.

One of the things that some people may be looking at when considering career opportunities is the availability of remote access. This may just prove to be key in attracting as well as retaining the best people you can find for your organization.

The Windows 365 Cloud PC gives users the ability to carry their desktops with them wherever they may be. Therefore, access to the cloud is going to be simple and hassle-free because users won’t need to be at a workstation in the office to access corporate resources.

Lower hardware costs

If you tell any business that you can potentially help to lower operating costs then most would probably at least want to give you a few moments of their time. And this is what Windows 365 aims to achieve with the Cloud PC. The cost of purchasing high-end computers for the office that can meet the needs of the various users is no small one.

But, when your PC is running in the cloud then the actual device that you need is less important. Microsoft allows users to access their Cloud PCs from most devices including those running macOS, iOS, Android, and Linux.

This means that users don’t necessarily need to invest in new devices. Not only that, but in the long run, you may not need to refresh your hardware as often thus lowering your expenses even further.

Secure hybrid work

As attractive as the possibility of working remotely may be, without top-notch security the option is not viable. So Microsoft has enhanced security measures by implementing Zero Trust principles enabling each request to be fully authenticated, authorized, and encrypted before access is granted.

Add to that the fact that data is not stored on the physical devices but on the cloud and you have even more protection around your data. These measures should help to assuage concerns about the security of remote work as well as the risk of security breaches.

Not to forget as well that Windows 365 clients can benefit from the already existing solutions that are part of Microsoft Endpoint Manager. Microsoft has also made specific security recommendations that I will be addressing below.

Simple to use

Another feature that Microsoft puts forward as a highly attractive one for Windows 365 clients is how easy the service will be to use.

In fact, Microsoft has gone so far as to say that organizations won’t need to hire specialist IT professionals to set up and manage the Cloud PCs. Features such as easy management and instant start-up enable users to have the ability to work traditionally without any prior virtual work experience. This is something that may also help you to lower overall operating costs.

Furthermore, your IT staff can manage, deploy, and configure the PC environment just as they have done all along.

Windows 365 security measures

Continuing on from what I touched on above, there are other security features that are important to know. Microsoft gives Windows 365 certain capabilities straight out of the box that are meant to enhance your security. Just as you have with your physical computers, Windows 365 Cloud PCs will come with Microsoft Defender. This helps to ensure that your device is secure from the first-run experience.

Also, the provisioning of the Cloud PCs is done using a gallery image. To ensure improved security, the image will have the latest updates for Windows 10 through Windows Update for Business. There are some differences that must be noted regarding the security measures for Windows 365 Business and those for Windows 365 Enterprise.

Windows 365 Business

Since Windows 365 Business is a service aimed at smaller organizations, particularly those that may not have IT staff, users on this edition are granted local admin rights to their Cloud PCs.

So this situation basically replicates what happens with a lot of small businesses whereby users purchase computers and retain local admin rights.

For IT departments that want to use Windows 365 Business for particular cases, they need to follow standard security practices if they intend to make those users standard users on their devices. To use MEM for this approach, you’ll need to follow the guidelines below:

  • The process starts with device configuration to enroll the devices in MEM

               using automatic enrollment.

  • The next step involves the management of the Local Administrators group.

               This can be done using Azure AD or MEM.

  • In addition, it would be a good idea to have Microsoft Defender Attack

               Surface Reduction (ASR) rules enabled. This would be very useful because

               these rules are in-depth defense mitigations for specific security concerns,

               such as blocking credential stealing from the Windows local security

               authority subsystem.

Windows 365 Enterprise

When it comes to Windows 365 Enterprise you’ll start to see some significant differences because this edition was designed for organizations that have dedicated IT teams.

This makes things slightly easier for IT as you have a system that is molded on the management and security that Microsoft Endpoint Manager provides. All Cloud PCs in Windows 365 Enterprise configure users as standard users by default.

However, admins still have the ability to make exceptions on a per-user basis. Furthermore, all Cloud PCs will be enrolled in MEM with reporting of Microsoft Defender Antivirus alerts.

You’ll also get the ability to onboard into the full Microsoft Defender for Endpoint capabilities. Microsoft makes the following security recommendations for users of Windows 365 Enterprise:

  • Users should stick to standard Windows 10 security practices. This also means restricting access to your Cloud PC using local administrator privileges.
  • You need to deploy Windows 365 security baselines to your Cloud PC from MEM. Furthermore, you should utilize Microsoft Defender to protect your endpoints, especially all Cloud PCs.
  • Taking advantage of Azure AD conditional access is a must. With features such as MFA and user/sign-in risk mitigation, you can significantly reduce the risk of unauthorized access to your Cloud PC.

Communication and collaboration

Windows 365 not only provides a platform that facilitates remote work for your organization but also ensures that team members can work together regardless of location. Clients can take full advantage of the power of Microsoft Teams to ensure that communication in your organization happens smoothly.

By using Teams, your organization can set up your environment in a way that best suits you. And when you are ready to use Microsoft Teams, the users can download the Teams client from https://teams.microsoft.com/downloads. And just like Windows 365 itself, you can install the Teams client on various devices such as Windows, Mac, or Linux PCs as well as on your Android or iOS devices. However, you’ll need to ensure that all these users have the necessary Teams license.

Some of the more important elements in Teams include chat, teams, and channels. With chat, you can have one or more users talking, sharing files, or meeting privately. Teams will enable collaboration on any project at any time and it can be visible to the entire organization or just the relevant team members. And then channels can help segment topics, projects, or anything else within teams in a way that suits the way you would like to work. Meetings and conferences are two major things that businesses need to conduct to keep things moving smoothly. By using a Teams or Skype for Business client, individuals can participate in meetings to which they’ve been invited. Even if you happen to have a bad internet connection you can still participate in meetings via audio conferencing. All you need is your regular phone, the conference phone number, and the meeting ID. Although meetings are enabled by default, you can still retain control of the meeting experience.

For smaller businesses with fewer than 300 users, you can utilize Microsoft 365 Teams Phone with Calling Plan to establish an office phone system without having a complex, costly on-premises phone system. The system will include a phone system menu, caller ID, voice mail, and other great features. So all of these features are going to enable the Windows 365 Cloud PC experience to basically simulate the office experience. Those working remotely won’t miss out on collaborating with their colleagues, sharing ideas, and crucially maintaining social connections with others. Without this, working remotely could quickly become a difficult, isolated affair.

Easy administration management

As one is going through the information that we have on Windows 365, it becomes abundantly clear that there are countless benefits for end-users. But, your IT admins will also want to know if they’ll also see changes when compared to other services. And the reality is, the ease of use principle that Microsoft applies to Windows 365 extends to your IT team as well. From the management perspective, there is plenty to be excited about starting with the fact that there is no need to have headaches about the infrastructure you need to set up to get the Cloud PC experience. Microsoft handles that side of things. Also, admins won’t need to get certified in anything else or learn new management tools. This is because Windows 365 is designed for all organizations even those without expert IT pros on staff to be able to run it without difficulty. Furthermore, you’ll be happy to know that the way you currently manage your physical devices with Microsoft Endpoint Manager will for the most part be similar to the management of Cloud PCs. A good example of this is that if you navigate to the All Devices list in Microsoft Endpoint Manager, you’ll see both your physical and Cloud PCs listed side by side.

Admins will also find that the deployment process is not complicated at all. For users to get a Cloud PC assigned to them, there are pretty much just two requirements that need to be met. They need to have the necessary license in addition to being part of an Azure AD Group that’s assigned to a provisioning policy. The process starts in the Microsoft Admin Center where you assign licenses similarly to how you would for other Microsoft 365 services. You can have a licensing admin take care of this particular task. After that, you can head over to Active Users and perform the assignment. With that done, you can now give users Cloud PCs and set them up with Microsoft 365 as well. As soon as a user is added to a group, the Cloud PC provisioning process will be launched and it won’t be long before the Cloud PC is ready for use. And with Windows 365 using a fixed price per user per month model, there’s no extra workload involving tracking, utilization, or keeping idle resources running.

Wrap Up

Windows 365 is a service that has countless different applications that can help businesses, both large and small, to completely change their IT environment. Taking advantage of the Cloud PC can mean potential changes in policy about who and how your organization hires. The ability to give employees remote access without compromising collaboration gives you a far deeper pool of talent to choose from when looking to hire people. The cost of the service is something that can also help your business by reducing expenditure on hardware. Not having to provide employees with brand new high-end computers and reducing hardware refresh rates can go a long way in improving your bottom line. In addition, when you consider how Microsoft has designed Windows 365 to be easy to use then you begin to see a platform that can change the virtualization sector. Undoubtedly, there’s still a lot more to come as the service improves but for now, Windows 365 has certainly offered a lot to be excited about.

The Step-by-Step Process for Cloud PC Provisioning and Deployment

The idea of hybrid work is something that has captivated the minds of people for years. And it’s not surprising when you consider the long list of advantages that individuals and businesses alike stand to gain. By using Cloud PCs, businesses can have their employees working from anywhere and using just about any device.

In this guide, I will be focusing on Windows 365 Cloud PC and giving you the step-by-step process for Cloud PC provisioning and deployment.

Introduced by Microsoft last year, Windows 365 gives you Windows running on the cloud. And from the overwhelming response to the service that we witnessed, it’s quite clear that there is a lot of interest in Cloud PC technology.

Recap on Windows 365

Windows 365 is essentially a service that will run your desktop on the cloud. In the words of Windows 365 General Manager Wangui McKelvey, “Windows 365 takes the operating system to the Microsoft Cloud, securely streaming the full Windows experience — including all your apps, data, and settings — to your personal or corporate devices. This approach creates a fully new personal computing category, specifically for the hybrid world: the Cloud PC.”

And as Microsoft has stated, you can stream apps, tools, data, and settings from the cloud across any device. This means that you can use Apple devices

(Mac, iPads, etc), Android devices, and Linux PCs among others to access your desktop on the cloud. This gives you the convenience of being able to pick up your work right where you left off because the Windows experience does not differ. Regardless of where you may be or the device that you are using.

Planning your deployment

Deploying Windows 365 Cloud PC is a significant undertaking for any organization. As such, it needs meticulous planning to carry out.

There are several objectives that will need to be considered such as determining what end users will need to access on their Cloud PC. For instance, if your end users are going to use Windows 365 to access specialized software, then you’ll need to look into installing all lines of business apps.

Another objective would be considering the geographical locations of your end-users. Because Windows 365 can provide Cloud PCs in multiple Azure locations, it makes it possible to provide the Cloud PCs in a location with the lowest latency to your end users’ physical location.

The next objective to consider will be the management of Cloud PCs. In this instance, you’ll need to determine who will be managing the Cloud PCs as well as which management groups will have which permissions.

With the above done, you now need to look at how end users will connect to a Cloud PC. This means you need to know whether they’ll be using a browser or a Remote Desktop Client. And then, as far as licensing goes, you need to assess all use cases and evaluate workloads to determine the specific licenses that will be needed.

For the next step, you need to do a complete review of your endpoint management and infrastructure. This will enable you to determine whether you are going to keep your existing management plan for devices or if you need to come up with something different for the Cloud PC. So you need to look at Cloud PC management, application of policies (GPO or Intune), and the updating policy for all devices.

With all this considered, it becomes time to plan how and when users will receive their Cloud PCs. Here you can start by creating several different rollout phases based on your environment. Pilot and/or test groups are a great way to start with early stages involving willing participants who will provide feedback.

At the end of each phase, you can use the feedback provided to determine how to map the way forward for the rest of the organization. Also, it’s important to have clearly defined goals and success metrics if you want to stay on top of things and keep your rollout on track.

In the midst of all this planning, however, it’s key to have clear communication with all users. People need to understand what exactly the goals are and why the organization has chosen the Windows 365 Cloud PC.

Having a smooth rollout requires people to be fully informed of all the changes and potential disruptions that they will need to prepare for. You need to determine what information users need and this includes information about the Cloud PC and why the organization wants it.

During the pilot and subsequent onboarding phases, you should continue to provide additional information so that users understand the process and its importance. Just as important as the information is how you’ll communicate with users. You could have meetings or leverage platforms like Microsoft Teams or email.

Another key area to consider during the planning phase is your IT support and help desk staff. These individuals play a significant role in ensuring a smooth adoption of Cloud PC. They can help educate your end-users and show how to connect to and use the Cloud PC.

Because of this, IT support and help desk staff need adequate training to be able to provide the required support to end-users and resolve any issues that may arise.  And they also need to know how and at which level of end-users they will be supporting. This training should touch on all the various scenarios that Windows 365 will be used for and should also consider training on all supported Windows 365 platforms.

Overview of provisioning

When we talk of provisioning, we are referring to the process that is going to create a Cloud PC virtual machine and then set it up for the user. It’s also responsible for the completion of other tasks that prepare it for use and the sending of access information to the user. The process starts with admins providing configuration details to set up the process.

After which, users with a Windows 365 license and matching the configuration details will automatically have a Cloud PC provisioned for them. Because provisioning works on a  one-time per user and per-license basis, each user and license pair can only have one Cloud PC provisioned for them. The provisioning process is going to proceed as follows:

  • Starts with the creation of a provisioning policy to manage access to the Cloud PCs. Provisioning policies are key to the entire process as they are responsible for building, configuring, and availing Cloud PCs to end-users. Each policy will require you to provide details regarding the on-premises network connection, the image used to create each Cloud PC, and an Azure AD user group.
  • Assignment of a Windows 365 license to users in the Azure AD user will begin the provisioning process. And the provisioning of the Cloud PC will be carried out automatically by Windows 365 after which it will then send the necessary access information to the user. The automation is going to proceed in 3 phases that will be invisible to the administrator.
  • The last part of the process involves the end-user receiving the necessary access informationthat will allow them to sign in to the Windows Cloud PC from anywhere.

Provisioning policy objects

Provisioning policies are essential objects in the MEM admin console that carry the required rules and settings that enable Windows 365 to set up and configure Cloud PCs for your users. Admins will have the responsibility of providing the required information when creating provisioning policies. This includes:

On-premises network connection – the OPNC provides the platform that enables the policy to connect to your on-premises resources. It’s responsible for identifying:

  • The relevant Azure subscription for your Cloud PC.
  • Which domain and Organizational Unit to join.
  • The AD credentials that should be used.

Image – all Cloud PCs provisioned with a particular policy will carry a Windows image that is used as the reference image. This image can either be one that you select from the gallery or a custom image that you provide yourself.

Assignment – the role of the assignment is the identification of one or more Azure AD user groups. All licensed users in the policy’s Azure AD users group will then have Windows 365 automatically provision Cloud PCs for them. Also, users who may be added at a later date will get Cloud PCs as well.

The above information is absolutely integral to the provisioning process because without it the Cloud PCs cannot be provisioned. Once you’ve seen to the creation of the provisioning policies, Windows 365 takes over the provisioning process thus automatically providing users with Cloud PCs.

Modifying provisioning policies

Once provisioning of the Cloud PC is complete, there will be no possibility of a re-occur unless you perform a reprovision. Any alterations to the provisioning policy won’t trigger a reprovision and these alterations also won’t be applied to already provisioned Cloud PCs.

So any modifications that you make to a provisioning policy will only apply to subsequently provision Cloud PCs or those that are reprovisioned. Furthermore, changing the name of the provisioning policy will not update the Cloud PC name under All Cloud PCs. And it’s also not going to update the enrollmentProfileName in Azure AD

Deleting a provisioning policy

Only provisional policies that are not assigned to any Azure AD groups can be deleted. Removing the targeting of a provisioning policy that was used for successful Cloud PC provisioning will put the Cloud PCs into a grace period. And those Cloud PCs will face automatic deletion once this grace period has expired.

Provisioning policy conflict resolution

Since the assignment of provisioning policies is made to user groups the risk of overlapping groups/users does exist. In the instance where a user may have more than one provisioning policy assigned, the provisioning process will only consider the first assigned policy and ignore the rest. And in the event of reprovisioning, the policy used will be the one that has been modified most recently (if changes have been made to one of the provisioning policies).

Provisioning retry

If provisioning of a Cloud PC fails, the process automatically retries twice. And if it still fails, the process will stop and the affected Cloud PC is marked as Failed. There’ll also be an error message displayed. You’ll then need to figure out why the provisioning of the Cloud PC has failed. Once you get to the root cause, you can manually restart the provisioning process by clicking Retry.

Reprovisioning

Reprovisioning of Cloud PCs is something that admins can perform remotely. It comes in useful when:

  • You need to test various Cloud PC configurations.
  • There are problems with a provisioned Cloud PC.
  • A user requires a new Cloud PC.

You can also leverage the reprovisioning action for Cloud PCs that are in a Failed provisioning state in the Windows 365 provisioning node. Basically, you can look at reprovisioning like resetting a physical device. Since this action deletes the Cloud PC and creates a new one, all data, apps, etc, will also be deleted. The reprovisioning will use the configurations of the provisioning policy used by that user’s Azure AD group.

Users with multiple Windows 365 licenses

Users with multiple Windows 365 licenses can have more than one Cloud PC. In this scenario, each license can have a Cloud PC with the appropriate specifications provisioned. However, it’s worth noting that you cannot have different provisioning policies for different user licenses. The Cloud PCs for these users will be provisioned using the same provisioning policy.

Clean up

In the event of a provisioning failure or deletion of a Cloud PC after the grace period, Windows 365 will delete all objects that were created during provisioning. This will be done about 3 hours after the failure and will include Intune objects, Azure AD device objects, and Azure vNics.

Because other objects are relying on the network security groups the latter won’t be deleted. Neither will on-prem Azure AD computer accounts that were joined to the domain during provisioning. This is because Windows 365 does not have the necessary permissions and therefore can only disable the redundant computer objects.

Network requirements

Being a cloud-based service means that you need to have internet access to use Windows 365 services. As such, there are certain networking requirements that will support the necessary connections. These requirements are client-specific because they are based on your workload. Below are some of those requirements:

General network requirements

·       Azure virtual network – having a virtual network in your Azure subscription is a necessity. And it should be in the same region as where the Windows 365 desktops are created.

·       You’ll need to define your AD DS DNS servers as the DNS servers for the virtual network so that the virtual network can resolve DNS entries for your AD DS environment.

·        The Azure vNet needs access to an enterprise domain controller (on-premises or Azure).

·         There should also be a subnet within the vNet and IP address space must be available.

·         Network bandwidth is based on Azure’s network guidelines.

 Allow network connectivity

Your Azure network configuration will need to allow traffic to the following service URLs and ports:

DNS requirements

Organizations’ Cloud PCs should be able to join on-prem Active Directory because this is a Hybrid Azure AD Join requirement. Cloud PCs should be able to resolve DNS records for your on-prem AD environment. So you’re going to need to configure your Azure vNet where the Cloud PCs are provisioned as follows:

1)    Verify that your Azure vNet has network connectivity to DNS servers that can resolve your Active Directory domain.

2)    Navigate to Azure vNet’s Settings, select DNS Servers, and then choose Custom.

3)  Type in the IP address of DNS servers that environment that can resolve your AD DS domain.

Bandwidth

As you know by now, Windows 365 uses Azure network infrastructure. It follows therefore that you’ll need an Azure subscription to select a virtual network while deploying Windows 365 Enterprise. Costs incurred for using a Cloud PC are as follows:

  • Network traffic into a Cloud PC is free.
  • Any outbound traffic will incur charges against the Azure subscription for the virtual network.
  • Office data such as email incurs egress charges if the Cloud PC and a user’s data reside in different regions.
  • For RDP networking traffic you should always expect egress charges.

Choosing a Cloud PC option

After making the decision to sign up for the Cloud PC, you now need to choose what option is best suitable for your business. Microsoft offers clients two license types to cater to different business needs.

However, for both license types, the price will depend on the size of the Cloud PC. There are some significant differences between the business and enterprise licenses that are worth knowing before deciding. These include:

1)    Business is designed for small to medium enterprises with a maximum of 300 users whereas Enterprise is for much larger businesses looking to deploy Cloud PCs throughout their entire organizations and with an unlimited number of users.

2)  For Business, the desktop will be attached to a virtual network that Microsoft manages and has the added benefit of clients not being charged for network egress fees. When it comes to Enterprise, the desktops are attached to the customers existing Azure virtual network. And clients will also have to pay standard network egress fees.

3)    Enterprise clients will get both standard and custom images but Business clients will get only standard images.

4)    Business clients will have to go through a process of manual configuration and app installation. Enterprise clients will get automatic configuration and app installations because of the advantage of full integration with Microsoft Endpoint Manager/Microsoft Intune.

5)    For the Enterprise license, users will also need licenses for Windows 10 Enterprise or Windows 11 Enterprise, Microsoft Endpoint Manager, and Azure Active Directory P1. Business clients won’t require any additional licenses.

Having looked at the various differences, it’s clear to see that for smaller businesses looking to buy, deploy, and manage Cloud PCs, the Business license is the way to go. And it has the following options:

Basic – at a cost of $31/month and with support for up to 300 users, this option allows you to run light productivity tools and web browsers. Clients will get 2vCPU, 4GB RAM, and 128 GB Storage.

Standard – this option will cost $41/month and also supports up to 300 users. Clients will get 2vCPU, 8GB, and 128 GB of storage allowing you to run a full range of productivity tools and line-of-business apps.

Premium – the last option costs $66/month and gives you access to 4vCPU, 16 GB of RAM, and 128 GB of storage. With this, you get support for up to 300 users and can run high-performance workloads and heavier data processing.

For larger businesses looking to manage their Cloud PCs with Microsoft Endpoint Manager and take advantage of integrations with other Microsoft services, Windows 365 Enterprise is the choice for you. The options on offer are as follows:

Basic – at a cost of $31/month and with support for unlimited users, this option allows you to run light productivity tools and web browsers. Clients will get 2vCPU, 4GB RAM, and 128 GB Storage.

Standard – this option will cost $41/month and also supports an unlimited number of users. Clients will get 2vCPU, 8GB, and 128 GB of storage allowing you to run a full range of productivity tools and line-of-business apps.

Premium – the last option costs $66/month and gives you access to 4vCPU, 16 GB of RAM, and 128 GB of storage. With this, you get support for an unlimited number of users and can run high-performance workloads and heavier data processing.

Image source: Microsoft

Assigning licenses

Before users can start using their Cloud PCs, you will need to first assign licenses to them. The necessary licenses are available for purchase from the Microsoft 365 store and you can get there by going through the Microsoft 365 Admin Center: https://admin.microsoft365.com.

Once you have purchased all the appropriate licenses, you can begin the task of assigning licenses to all your users. To do this you first need to login to the Azure Active Directory admin center.

And for license assignment to a single user, you use the Microsoft 365 Portal. Once in there go to Users > Active Users and select the user that you want to assign with a license. Then, go to the tab “Licenses and apps” and select your Cloud PC license. Apply the changes while clicking on Save changes below.

Assigning group-based licensing is slightly different. For this, you go to the Azure Portal and then head over to your Azure Active Directory. If you look to your left-hand side you’ll see Licenses. Go there and select All Products.

Next, you select the available Cloud PC license and then click Assign. So to enable group licensing, go to the left-hand side, and select Licensed Groups. Yet again you’ll need to click on Assign and select the group that you want to automatically license for the Windows 365 Cloud PC feature.

Creating an on-premises connection

Another requirement that organizations will have is the need to have an on-premises connection. An on-premises network connection (OPNC) is an object in the Microsoft Endpoint Manager admin center that provides Cloud PC provisioning profiles with the required information to connect to on-premises resources.

Before getting started with Cloud PC, you’ll need the following:

  1. AD DNS domain name
  2. Organizational unit
  3. Configure Azure AD Connect
  4. AD username UPN
  5. AD join password

So first you need to find your domain name which is simple enough with access to a domain controller. Once you know your domain name then you can proceed to validate the User Principal Name Suffix (UPN Suffix). Checking that your UPN Suffix is routable is extremely important to avoid problems later on.

With that done, you need to create an Organizational Unit that will allow you to properly manage your CloudPCs and dedicated GPOs. To perform this task, go to AD Users and Computers mmc and then head over to where you want to set your new Organizational Unit. Next, you can then either right-click an existing Organizational Unit or click where you want to create a new one.

Next, you need to ensure that Azure AD Connect is properly configured to get users synchronized with Azure AD. This you will do by opening Azure AD Connect and then selecting Configure device options.

Finally, you need to fill in the AD username UPN and the AD domain password. Then click Next. On the page, that then appears click Review+create. It should take no more than a few minutes to create the on-premises network connection. And if you have configured everything properly, you’ll see a “checks successful” status.

Creating a provisioning policy

The next step in this process requires you to create a Provisioning Policy so that you can provision the Cloud PC with an image of choice and is based on Azure AD security groups. Provisioning policies hold key provisioning rules and settings allowing the Windows 365 service to set up and configure the right Cloud PCs for your users. To create a provisioning policy, follow the steps below:

1.   Sign in to the MEM admin center and select Devices > Windows 365 (under Provisioning) > Provisioning policies > Create policy.

2.    On the General page, enter a Name and Description (optional) for the new policy.

3.    For OPNC select the connection to use for this policy > Next.

4.    On the image page, you need to select one of the following options for the image type:

  • Gallery Image: Choose Select > select an image from the gallery > Select. Here you’ll get default images for your use.
  • Custom image: Choose Select > select an image from the list > Select. This shows you the list of images that you uploaded using the Add device images workflow.55

5.    Select Next.

6. On the Assignments page, choose Select groups > choose the groups you want this policy assigned to > Select > Next.

7.    On the Review + create page, select Create. It can take up to 60 minutes for the policy creation process to complete, depending on when the Azure AD connect sync last happened.

With the information provided through the on-premises network connections and the creation of provisioning policies, Windows 365 can now provision Cloud PCs for licensed users. Performing the provisioning process will involve Windows 365 automatically completing the following stages:

  • Core provisioning – this process does all the necessary tasks required to stand up a VM until a user can successfully sign in.
  • Post-provisioning configuration – modifications can be made to the configuration for the purpose of optimizing the Cloud PC end-user experience.
  • Assignment – a user is assigned to the Cloud PC and can now sign in.

User connectivity

After everything has been set up, users will then need to know how they can connect to the Cloud PC. We need to clarify what clients can be used as well as what options the end-users will have. Also, we need to know how administrative credentials can be provided to the end-user. Microsoft has provided two ways for users to connect to the Cloud PC:

                        I.        Web browser – the first method that users have for accessing the Cloud PC is via a web browser. All you have to do is simply navigate to windows365.microsoft.com. Once there you can log in with the user credentials that have a desktop provisioned and the portal will show you an overview of the desktops available to you. However, to access the Cloud PC using this website, users devices need to meet the following requirements:

Supported operating systems: Windows, macOS, ChromeOS, Linux,

A modern browser like Microsoft Edge, Google Chrome, Safari, or Mozilla Firefox (v55.0 and later).

 When using windows365.microsoft.com, end users can carry out various tasks on their Cloud PCs by selecting the gear icon on a Cloud PC card.

  • Rename: doing this will change the name of the Cloud PC that the user sees on the website. But, performing this action doesn’t change any name in Microsoft Endpoint Manager, Azure Active Directory, on the device, or in the Remote Desktop Apps.
  • Restart: this will restart the Cloud PC.
  • Troubleshoot: whenever a user is encountering challenges with connecting to the Cloud PC, this will help you to troubleshoot and try to resolve those challenges. A few checks will be run including verifying that all the files and agents necessary for connectivity have been properly installed. There will also be a check for the availability of Azure resources.

                        II.        Remote desktop – the second method that Microsoft offers clients for connecting to the Cloud PC is by using the Microsoft Remote Desktop app.

This is designed to enable users to access and control a remote PC, including a Cloud PC. So for those who have been using Azure Virtual Desktop, this is an app they will already be familiar with. Setting up the Remote Desktop is a relatively simple process that requires you to follow a few steps:

  1. First, you’ll have to download the Remote Desktop app. You can find it on the Download App page on www.microsoft.com/windows-365?rtc=1.
  2. Next, you select Subscribe.
  3. The next step will require you to enter your Azure Active Directory credentials.
  4. You will then see the Cloud PC appear on a list. Simply double-click it to launch.

Managing Cloud PCs

Next, let’s discuss just how you’ll be managing your Cloud PCs. For the management of your Cloud PCs, you’ll be using Microsoft Intune. The latter is a 100% cloud-based mobile device management and mobile application management platform for your apps and devices. And this also includes your Cloud PCs. Signing in to Intune requires you to navigate to the Microsoft Endpoint Manager admin center.

Overview page

To start, you’ll want to go over to the landing page for managing your Cloud PCs which is the Overview tab. To access it, you need to sign in to the Microsoft Endpoint Manager admin center > Devices > Windows 365 (under Provisioning).

This section is going to provide you with some information about how your Cloud PCs are performing. You’re going to see:

  • Provisioning status: this summarizes your organization’s Cloud PC status.
  • Connection health: this provides a summary of the health of your organization’s on-premises network connection.

All Cloud PCs page

On this page, you’re going to see a summary and list view with details regarding the status information for each of your organization’s Cloud PCs. The list view automatically refreshes every 5 minutes and by using it you can search filter, and sort. Users with multiple Windows 365 SKUs assigned to them will get multiple Cloud PCs and this means that in the All Cloud PCs list view there’ll be multiple rows for a single user.

Column details

Name – Name of the Cloud PC.

Device name – The Windows computer name.

Image – this is the image that was used during provisioning and so may not reflect the current Cloud PC version.

PC type – the Windows 365 SKU assigned to the user.

Status – this reflects the current provisioning status of the Cloud PC and possibilities include:

  • Provisioned: shows when provisioning was successful.
  • Provisioning: the provisioning is still in progress.
  • Provisioned with warnings: shows when a non-critical step failed in the provisioning process but the user still has access.
  • Not provisioned: this happens when a user has been assigned a Windows 365 license but doesn’t have a provisioning policy assigned to them.
  • Deprovisioning: appears when the 7 day grace period has ended and the Cloud PC is undergoing deprovisioning.
  • Failed: shows when the provisioning process has failed.
  • In grace period: indicates when a license/assignment change occurs for a user with a current Cloud PC.
  • Pending: it means that there are currently no available licenses in your tenant to process the provisioning request.

User – indicates the user to whom the Cloud PC is assigned.

Date modified – shows a timestamp reflecting the last status change of the Cloud PC.

Remote management

Like any other managed device, the option exists to remotely manage Cloud PCs using Intune. You’ll find that there are several remote management actions that Cloud PCs will support and they include:

  • Restart
  • Sync
  • Rename
  • Quick scan
  • Full scan
  • Update Windows Defender
  • Reprovisioning*
  • Resize*

*Reprovisioning and resizing are both remote actions that are unique to Cloud PC devices.

Conclusion

Microsoft’s personalized desktop solution brings a lot of advantages to the way enterprises operate. As technology continues to evolve in leaps and bounds, so too are the devices at our disposal. This has brought us to a point where many people in their various organizations are using many different devices to perform work-related tasks.

And businesses realize that bring-your-own-device policies will be integral moving forward. This is why platforms like Windows 365’s Cloud PC are potential game-changers. Giving users access to their desktops from anywhere and using almost any device enables businesses to operate at a completely higher level.

Furthermore, the last couple of years have shown just how important the need is for workers to be able to work from anywhere. This has helped to keep a lot of companies operational. Not only that but leveraging cloud computing helps the organization to lower its overall hardware expenses.

The Cloud PC also allows organizations to stay within their budgets by selecting the options that are best suited to their business. And if the need to scale arises then that can easily be achieved. Windows 365 Cloud PC really does have the potential to do great things for any business. It’s certainly worth a try.