How to Enable Local Admin on Windows 365 (W365) Cloud PCs: Step-by-Step with Intune

Windows 365 · Microsoft Intune

Sooner or later, someone on your team will say: “I can’t install my tools on my Cloud PC.” If you manage Windows 365 (W365), the cleanest fix is a single, group-based user settings policy in Microsoft Intune that gives users local admin rights on their own Cloud PCs, with no manual edits to the local Administrators group and no fragile scripts. In this guide we’ll build that policy step by step, with screenshots from the Intune admin center.

• Applies to: Windows 365 Enterprise
• Where: Microsoft Intune admin center
• Time: about 10 minutes
• Level: Beginner
• Updated: 25 Oct 2026

Jump to

What is local admin on a Windows 365 (W365) Cloud PC?

Windows 365 gives each user a personal Windows desktop, called a Cloud PC, that runs in the Microsoft cloud and that people reach through the Windows App or a web portal. W365 is simply the common shorthand for Windows 365; you’ll see it in group and policy names too, like the W365 User Policy we build below.

A user with local admin rights can install software, change system settings and run admin tools on their Cloud PC. In Windows 365 you grant that right with the Enable Local admin setting in a user settings policy, which elevates each user in the assigned groups to local administrator on each of their own Cloud PCs. Because the permission applies at the user level, you manage it per user group in Intune instead of touching individual Cloud PCs.

Before you start

Microsoft doesn’t list formal prerequisites for this feature, but you’ll have a much smoother time with these three things ready:

• Access to the Intune admin center with an account that can manage Windows 365 Cloud PC settings.
• A group that contains the users who need local admin. In this walkthrough it’s called W365Users. Policies are assigned to user groups, so create or pick one first.
• Cloud PCs, now or later. The good news: you can create this policy before or after the Cloud PCs are assigned.

Step-by-step: enable local admin on a Windows 365 Cloud PC with Intune

1

Open Cloud PC Settings in Intune

Sign in to the Microsoft Intune admin center, select Devices, then open Cloud PC Settings from the Manage Windows 365 Cloud PCs section of the menu.

2

Click Create, then choose User settings

On the Cloud PC Settings page, open the Create drop-down. You’ll see four policy types; pick User settings, which is the one that controls local admin.

3

Name the policy and pick your settings

You land on the Settings tab of the Add user setting wizard. Give the policy a clear name (I used W365 User Policy), then tick the boxes you want:

• Enable Local admin: makes each user in the assigned groups a local administrator on their own Cloud PCs. This is the one we came for.
• Enable users to reset their Cloud PCs: shows a Reset option in the Windows App and the web portal.
• Allow user to initiate restore service: lets users restore their own Cloud PC to any available backup. Once ticked, you must also choose a Frequency of restore-point service; I went with 12 hours.
• Optional Business Continuity and Disaster Recovery Settings: I left these at their defaults.

Think before you tick

A reset wipes and re-provisions the Cloud PC, deleting all user data and apps. Only enable it for users who understand that. If you just want local admin, leave the other boxes unticked.

Disaster recovery licensing

The wizard reminds you to buy and assign the optional disaster recovery licenses before configuring that section. Disaster Recovery Plus can’t be configured for Frontline Cloud PCs, and optional disaster recovery isn’t available for Government Cloud PCs.

Happy with the settings? Click Next.

4

Assign the policy to a user group

On the Assignments tab, click Add groups. Under Select groups to include, choose your user group (mine is W365Users), click Select, and confirm it appears in the list. Then click Next.

5

Review and create

The Review + Create tab gives you a read-only summary. Double-check that Enable Local admin says Yes and that the right group sits under Assignments. When you’re happy, click Create.

6

Confirm the policy shows up

Back on the Cloud PC Settings list, your new policy should appear with Type: User settings and Assigned: Yes. That’s it. The policy is live.

How to verify local admin on a Windows 365 Cloud PC

User settings are applied at logon, so the first thing to know is that nothing changes for someone who is already signed in. Ask a test user from the assigned group to sign out of their Cloud PC and sign back in. Then check from inside the Cloud PC:

1. Open Command Prompt and run the command below. The user’s account should appear in the list of local administrators.
2. Or right-click Command Prompt and choose Run as administrator. An admin sees a simple Yes/No consent prompt instead of being asked for admin credentials.

net localgroup administrators

Edit or delete a Windows 365 user settings policy

Needs change, people move teams. Here’s how to adjust the policy later. Both start the same way: Devices > Cloud PC Settings in the Intune admin center.

What if a W365 user is in two user settings policies?

User settings policies are assigned to groups, and people belong to many groups, so overlaps happen. The rule is simple: if a user is covered by more than one user settings policy, the settings from the most recently created policy are used and the others are ignored. The last updated time doesn’t matter, only the creation date.

That’s why the policy list shows Not applicable under Rank for user settings, while the other policy types in the screenshot carry rank numbers (1, 2, 3) and can be re-ranked.

Best practice: avoid overlapping targets so every user is covered by exactly one user settings policy.

Windows 365 local admin FAQ

Quick recap: Windows 365 user settings used in this guide

Here’s everything we configured in one place: