Windows 365 Cloud PC Settings Policy Configurations

• Overview
• Before you begin
• Steps 1–2: Basics
• Step 3: Configuration
• Disaster recovery
• Steps 4–5: Scope & assignments
• Step 6: Review
• After you create it
• Quick reference

Overview

A Windows 365 Cloud PC settings policy in Microsoft Intune turns Cloud PC features on or off for a group of users, even after their Cloud PCs are provisioned. This guide builds one policy, DevCloudPCSettings, using the five-tab Create setting wizard shown in the screenshots.

Microsoft’s Cloud PC configurations page lists three settings you can manage this way: AI-enabled features (Frontier preview), Enable local admin (preview), and Business continuity and disaster recovery (preview). Each can be set to Enable, Disable, or Not configured. Not configured is the default, and it means this policy does not manage that setting.

The wizard has five tabs, and the table shows what you do on each one and the value used in this guide.

Before you begin

You need access to the Microsoft Intune admin center and a clear decision on which features to manage, which scope tag to use, and who receives the policy. Check these four points first.

• Access. Sign in to the Microsoft Intune admin center with an account that can create Cloud PC settings. The Microsoft Learn pages for these settings do not name the required role, so confirm it with your Intune administrator.
• Cloud PC size. Microsoft’s Cloud PC configurations page says “Applicable only to devices with specs of 8vCPU/32GB/256GB and higher”, but it does not say which setting this refers to. Check your Cloud PC sizes against it before rollout.
• Overlapping policies. Each Cloud PC settings policy has a unique global rank, where 1 is the highest priority, and a new policy takes the lowest rank. If two policies set different values for the same setting, the higher-ranked policy wins. Settings left as Not configured do not take part. AI-enabled features are the exception: the most secure policy always wins, whatever its rank (Settings overview).
• Existing User settings. Microsoft recommends managing Enable local admin through Cloud PC configurations. Existing User settings can stay for now, but Microsoft plans to phase out support for them over time, so avoid targeting the same users in both places.

Steps 1 and 2: Open the wizard and fill in Basics

Step 1 gets you into the Create setting wizard, and Step 2 names the policy on the Basics tab.

Step 1: Start the wizard

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices, then Cloud PC Settings. Microsoft lists it under Manage Windows 365 Cloud PCs. The breadcrumb in the screenshots reads Home > Devices | Windows > Windows | Cloud PC Settings.
3. Select Create, then choose Cloud PC configurations from the dropdown. The Create setting wizard opens on the Basics tab.

Step 2: Complete the Basics tab

1. In Name (required, marked with a red asterisk), enter DevCloudPCSettings.
2. In Description (optional), enter a short purpose for the policy. The screenshot uses A settings for Dev Cloud PC's. A cleaner wording such as Settings for Dev Cloud PCs reads better in the policy list.
3. Select Next to move to Configuration settings.

Step 3: Choose the features on the Configuration settings tab

This tab decides which features the policy manages, and each dropdown offers Enable, Disable or Not configured. The note at the top of the tab explains the default: “When set to Not configured (default), this policy does not define a value. System defaults apply unless another applicable policy provides a configured value.”

1. Open AI-enabled features (Frontier) and select Enable. Microsoft describes this as installing “the hybrid compute framework” so the user’s device can use AI-enabled features. It is a preview feature. If another policy that applies to the same Cloud PC is more secure, that policy takes precedence whatever its rank.
2. Open Enable Local admin and select Enable. “Each user in the assigned groups is elevated to a local administrator of each of their own Cloud PCs. These permissions apply at the user level.” It is also a preview feature.
3. Scroll down to Business continuity & disaster recovery and configure it as described in the next section.

Step 3 continued: Business continuity and disaster recovery

The Business continuity & disaster recovery section controls how Cloud PCs are protected and recovered. This guide turns on Point-in-time restore every 12 hours and leaves the two regional disaster recovery options at Not configured. Microsoft’s disaster recovery setup page describes all three features.

Point-in-time restore: Enable

1. Open Point-in-time restore and select Enable. This lets an administrator restore a Cloud PC “to the exact state it was at an earlier point in time” (Point-in-time restore).
2. A required field, Frequency of restore-point service, appears underneath. Choose how often short-term restore points are created: 4, 6, 12, 16 or 24 hours. This guide uses 12 hours.

Each Cloud PC keeps 10 short-term restore points, so a shorter interval means more recent restore points but a shorter look-back window. The look-back figures below are calculated from that 10-point limit.

On top of the short-term points, each Cloud PC also keeps four long-term restore points saved every seven days, which you cannot configure. Administrators can also create one manual restore point per Cloud PC, which expires after about 28 days unless overwritten.

Cross-Region Disaster Recovery: leave as Not configured

This feature moves users to a temporary backup region during a regional outage. If you need it, select Enable and choose a Network type: a Microsoft-hosted network, where you pick the geography and region for backups, or an Azure network connection, where the connection you choose determines where backups are created. It needs a Windows 365 Cross Region Disaster Recovery add-on license for each user, and an administrator must activate and deactivate it manually (Cross-region disaster recovery).

Disaster Recovery Plus: leave as Not configured

This feature copies each user’s Cloud PC OS disk to another region and reserves capacity there, with targets of under 61 minutes for the recovery point and under 31 minutes for recovery time (Disaster Recovery Plus). Microsoft says it is enabled together with Cross-Region Disaster Recovery. Letting users start it themselves is a separate setting, Allow users to initiate Disaster Recovery Plus service, in a Windows App setting rather than in this policy.

Things to know before enabling any of these

• Wait up to 24 hours before activating business continuity and disaster recovery services.
• All Cloud PCs that belong to one user share the same business continuity and disaster recovery setting.
• Devices that are running in a temporary backup region do not receive a new Cloud PC configuration until they return to the primary region.
• Choose backup regions with data sovereignty and distance in mind, because a longer distance to the backup location can add latency.

Steps 4 and 5: Scope tags and Assignments

Scope tags decide which Intune administrators can see this policy, and assignments decide which users receive it.

Step 4: Scope tags tab

1. Leave the Default scope tag in place. Intune adds it automatically to objects that have no tag, and the review page describes it as the built-in tag for “all Intune entities without scope tag”.
2. Only if administrators are limited by scope tag, select + Select scope tags, tick the tags that should see this policy, and confirm. Creating a new scope tag needs the Intune Administrator Microsoft Entra role (Intune scope tags).
3. Select Next.

Step 5: Assignments tab

These settings apply per user: Microsoft describes them as elevating or configuring “each user in the assigned groups”. The toolbar offers Add groups, Add all users and Add all devices; Microsoft’s guidance covers assigning groups of users, so choose groups or all users.

1. For a developer-only rollout, select + Add groups, choose the group under Select groups to include, then select Select.
2. To cover the whole tenant instead, select Add all users. All users then appears in the Groups table, as in the screenshot.
3. To take an assignment out, select Remove beside it.
4. Select Next.

Step 6: Review and create

The Review + create tab shows every choice in read-only form, so this is the last chance to catch a mistake before the policy exists. Use Previous to go back to any tab and fix a value.

Check the page against this list.

• Name is DevCloudPCSettings and the description is correct.
• AI-enabled features (Frontier) and Enable Local admin both show Enable.
• Point-in-time restore shows Enable, with a frequency of 12 hours.
• Cross-Region Disaster Recovery and Disaster Recovery Plus both show Not configured.
• Scope tags lists Default.
• Assignments lists All users (type allUsers), or the developer group you chose.

When everything matches, select Create. The policy is saved and assigned to the users or groups you chose.

After you create it

Once the policy is saved, you can change it, re-order it against other policies, or delete it from the same Cloud PC Settings page.

• Edit. Open the policy, select Edit next to Settings or Assignments, make the change, then select Update. To remove a group, select the ellipsis (…) beside it, then Remove.
• Re-rank. If several policies set the same feature, select Rerank policies and change the ranks, drag and drop, or move policies up and down. A new policy starts at the lowest rank, and the higher-ranked policy wins for each setting that is configured.
• Delete. Select the ellipsis (…) in the policy’s row, then Delete, then Yes. Deletion is permanent.

If a setting does not seem to apply

1. Look for another policy with a higher rank that sets the same value. For AI-enabled features, the most secure policy wins regardless of rank.
2. Look for an older User settings policy that targets the same users, and remove any overlap. For User settings, Microsoft says that when a user is in more than one policy, the most recently created one is used and the others are ignored.
3. For local admin rights, ask the user to sign out and sign in again. Microsoft documents this behaviour for the User settings version of the setting: changes take effect when the user signs in.
4. For disaster recovery features, remember Microsoft’s advice to wait up to 24 hours before activating the services.

If you replace an existing User settings policy with this configuration, existing backup copies are kept as long as the restore-point frequency and backup region stay the same.

Quick reference and sources

Every field in the DevCloudPCSettings policy, the value shown in the screenshots, and what to keep in mind.

Sources

• Cloud PC configurations
• Windows 365 settings overview
• Business continuity and disaster recovery (preview)
• Point-in-time restore
• Cross-region disaster recovery
• Disaster Recovery Plus
• Assign users as local admin
• Intune scope tags