Provision Microsoft Entra Hybrid Joined Windows 365 Enterprise Cloud PCs

Platforms

Windows

Products

Windows 365IntuneEntra IDAzureActive Directory

Result

Users get hybrid joined Cloud PCs, managed by Intune and reachable from any device

Overview

Provision Windows 365 Enterprise Cloud PCs that join your on-premises Active Directory and Microsoft Entra ID (hybrid join), with an Azure network connection and a provisioning policy in Intune.

Windows 365 (generally available since August 2, 2021) is a Desktop as a Service (DaaS) solution that gives each user a persistent, personal Cloud PC. The Cloud PC is streamed to almost any device (Windows, macOS, iOS, Android or a web browser). Windows 365 is often compared with Azure Virtual Desktop (AVD), but there are key differences:

• Windows 365 has a fixed price per user licence, while Azure Virtual Desktop is paid by Azure resource usage (with autoscaling to save costs).
• Windows 365 resources are managed by Microsoft (with an Azure network connection you manage the network), while Azure Virtual Desktop is managed by you.
• Windows 365 is designed to be simple and gives each user a dedicated Cloud PC (Windows 365 Flex adds shared Cloud PCs). Azure Virtual Desktop is more complex but also offers pooled, multi-session desktops and app streaming.

Windows 365 editions (Business and Enterprise):

• Business (not covered here) is for up to 300 users. The user only needs a licence to get a Microsoft Entra joined Cloud PC, without Intune or an Azure subscription.
• Enterprise (covered here) adds the features large organizations need: Intune management, custom images, provisioning policies and connections to on-premises networks (see Compare Business and Enterprise). In 2021 Enterprise Cloud PCs had to be Microsoft Entra hybrid joined (formerly Hybrid Azure AD joined), so they needed line of sight to an on-premises domain controller. Microsoft Entra join is now also supported and Microsoft recommends it, with the Microsoft hosted network, for new deployments. I show the Entra join setup in my Windows 365 Entra join post.

For more background, see the articles by Christiaan Brinkhoff: Get started with Windows 365 Enterprise and Windows 365 Business.

Microsoft's comparison of the two editions at launch in 2021 (the current comparison is on Microsoft Learn):

Feature	Windows 365 Business	Windows 365 Enterprise
Click-to-provision directly from the product page	✓
"No-domain" setup	✓
Self-serve troubleshooting and reset	✓
"Cloud Save" (minimal Azure storage and potentially OneDrive for Business)	✓	✓
Self-serve upgrades		✓
Universal Print integration		✓
Partner and programmatic enablement (Graph APIs, MSP tooling)		✓
Custom images		✓
Image management (store, replicate, deploy)		✓
Endpoint analytics reporting and monitoring		✓
Service health and operational health alerts		✓
Connection to on-premises networks, apps and resources, with diagnostics		✓
Intune policy-driven provisioning, management and guided scenarios		✓
Advanced Intune troubleshooting and device management		✓

Prerequisites

Before you start, check that you have the following.

Configuration

Create the Azure network connection first, then the provisioning policy that uses it.

Azure network connection

In the Intune admin center (intune.microsoft.com) go to Devices > Provision Cloud PCs > Azure network connection > Create and choose Hybrid Microsoft Entra Join. In 2021 this was the On-premises network connection (OPNC) under Devices > Windows 365 (see Create an Azure network connection):

On the Network details page enter:

• Name: <any_name> (unique in the tenant)
• Azure subscription: <your_subscription>
• Resource group: a new one for Cloud PCs, for example Win365_Enterprise_Resources
• Virtual network and Subnet: the VNet with the gateway (ExpressRoute or site-to-site VPN) to your on-premises domain, in the region closest to your users

On the AD domain page enter:

• AD DNS domain name: domain.com
• Organizational unit: OU=AZURE_Win365,DC=domain,DC=com
• AD username UPN: an account that can join computers to that OU, for example svc-w365join@domain.com (I used the domain administrator in my lab)
• AD domain password

Note: the organizational unit must be in the scope of your Microsoft Entra Connect sync, so the Cloud PCs are synced and hybrid joined.

The checks take a few minutes. Select Refresh until the status changes to Checks successful, and select it to see the details:

Here are the detailed check results (see Azure network connection health checks):

If a check fails, the page gives recommended next steps. My first errors came from the network setup (Azure VNet and DNS resolution). These guides help: Troubleshoot Azure network connections and Troubleshooting hybrid Microsoft Entra ID errors during Windows 365 Cloud PC provisioning.

The connection is also monitored with the other connectors under Tenant administration > Tenant status > Connector status (in 2021: Windows 365 on-premises network connection):

Provisioning policy

Go to Devices > Provision Cloud PCs > Provisioning policies > Create (see Create provisioning policies):

Enter a Name (users see it), choose Hybrid Microsoft Entra Join and select the Azure network connection you created. You can also turn on Use Microsoft Entra single sign-on:

Select a Gallery image or a custom image. My 2021 screenshot shows Windows 10 images; today the gallery offers Windows 11 Enterprise images, for example Windows 11 Enterprise + Microsoft 365 Apps:

Under Assignments select the user group with Windows 365 Enterprise licences:

My W365-Enterprise-Users group has the licence assigned, and users get the Cloud PC size of their licence (here 2 vCPU, 4 GB, 128 GB):

The policy is created and Cloud PCs are provisioned for the assigned group:

User Experience

The Cloud PCs are provisioned and users connect from any device.

Under All Cloud PCs the status changes to Provisioned after about 30 minutes. I had only one licence for testing, so my second Cloud PC was in the grace period (up to seven days):

In Intune the Cloud PC is a corporate Windows device managed by Intune, with the manufacturer Microsoft Corporation and a model like Cloud PC Enterprise 2vCPU/4GB/128GB:

The model is useful for a dynamic device group or a filter for all Cloud PCs. Microsoft now recommends this rule, because newer Cloud PC models can start with Windows 365 (see Create a dynamic device group for Cloud PCs):

(device.deviceModel -startsWith "Cloud PC") or (device.deviceModel -startsWith "Windows 365")

In the Microsoft Entra admin center (entra.microsoft.com) the join type is Microsoft Entra hybrid joined:

In on-premises Active Directory, a computer object is created in the organizational unit for every Cloud PC:

By default Enterprise users are standard users on their Cloud PCs. To make them local administrators, create a User settings policy with Enable local admin under Devices > Cloud PC Settings (see User settings):

Note: the setting makes the users local administrators on all of their Cloud PCs.

Users connect with Windows App on Windows, macOS, iOS, iPadOS and Android, or in a browser at windows.cloud.microsoft (see Access a Cloud PC). In 2021 they used the Windows 365 portal (windows365.microsoft.com, now redirected to Windows App on the web):

In 2021 my testuser also used the Microsoft Remote Desktop app with a subscription URL from the portal. The Remote Desktop clients are retired or being retired (the Store app in May 2025, the MSI client in March 2026), so use Windows App today:

In the Remote Desktop app I added the workspace URL https://rdweb.wvd.microsoft.com/api/arm/feeddiscovery:

After signing in with the Microsoft Entra ID account, the Cloud PC started:

The same Cloud PC on an iPhone, exactly where the user left it: