Windows 365 Requirements: What You Need Before You Deploy Your First Cloud PC

Windows 365 promises a simple idea: a personalized Windows desktop, streamed securely from the Microsoft cloud to any device. But “simple for the user” does not mean “no preparation for the admin.” Here is what the service expects before you provision your first Cloud PC.

• Azure
• Entra ID & Intune
• Domain
• Management
• Roles & Identity
• Checklist

The baseline is lighter than most people expect. The details change depending on one key decision: do you use a Microsoft-hosted network or your own?

1Azure Requirements

The first question most admins ask is whether they need an Azure subscription. The answer depends on your network model.

Your own network. If Cloud PCs need to reach resources in your own virtual network, such as on-premises systems or internal apps, you bring your own Azure network. That requires an Azure subscription and three permissions:

Assigning these at the right scope matters. Subscription-level reader, resource-group-level contributor and virtual-network-level user is a least-privilege pattern, and it is worth getting right the first time rather than granting broad access to make a deployment work.

2Microsoft Entra ID and Intune Requirements

Windows 365 sits on top of your Microsoft identity and device management stack, so you need:

• A valid Microsoft Entra ID and Intune tenant. This is the foundation. Cloud PCs are identified, enrolled and managed through these services.
• Intune enrollment restrictions that allow it. If your tenant blocks enrollment of Windows (MDM) devices as corporate-owned, Cloud PCs cannot enroll. Check that the Windows (MDM) platform is allowed for corporate enrollment before you start.
• Hybrid join readiness, if you plan to use it. Your infrastructure must support Microsoft Entra hybrid join. Microsoft Entra Domain Services is not supported for this scenario, so plan an alternative if your environment relies on it.

3Domain Requirements

Again, the answer depends on how you want your Cloud PCs joined.

Microsoft Entra hybrid join. If Cloud PCs also need to join on-premises Active Directory, prepare:

• A valid organizational unit (OU) in Active Directory where the Cloud PC computer objects will be created.
• An Active Directory user account with permission to join devices to the domain. This is the account the service uses during the join.
• Synced identities. Cloud PC users must exist in both Active Directory and Microsoft Entra ID, so identity sync must be working.

If identity sync is unhealthy, hybrid-joined Cloud PCs will not behave. Verify sync status before you provision, not after.

4Management Requirements

Once Cloud PCs are running, you need to manage them. The requirements are short:

• Microsoft Intune admin center is required to manage Cloud PCs. Provisioning policies, user settings and ongoing management all happen here. Because Cloud PCs are Intune-managed devices, you can apply the same compliance policies, configuration profiles and app deployments you already use for physical PCs.
• A Windows 365 Enterprise or Frontline license is required for configuration management. Enterprise suits users who need a dedicated Cloud PC at all times. Frontline suits shift and part-time workers who can share Cloud PC capacity. Pick the model that matches how your people actually work.

5Role and Identity Requirements

The last area covers who can administer the service and who can use it.

• Admin role. The person configuring Windows 365 must be an Intune Administrator or a Windows 365 Administrator in Microsoft Entra ID. Use the Windows 365 Administrator role where possible, since it is scoped more narrowly to the service.
• User identity. Cloud PC users must have hybrid identities so they can authenticate across cloud and on-premises resources. This lets a user sign in to their Cloud PC and still reach file shares, apps and other internal services seamlessly.

Pre-Deployment Checklist

Before you create your first provisioning policy, confirm the following:

1. Decide on the network model: Microsoft-hosted or your own Azure network.
2. If using your own network, assign Reader, Windows 365 Network Interface Contributor and Windows 365 Network User at the correct scopes.
3. Confirm your Entra ID and Intune tenant is valid and that Windows (MDM) corporate enrollment is allowed.
4. If using hybrid join, prepare the OU and the domain-join account, and confirm Entra Domain Services is not part of the design.
5. Verify identity sync so users exist in both Active Directory and Entra ID.
6. Assign Windows 365 Enterprise or Frontline licenses.
7. Make sure admins hold the Intune Administrator or Windows 365 Administrator role.