Intune baseline for Cloud PCs

Once a Windows 365 Cloud PC is provisioned, it enrols into Intune automatically — same as a physical laptop under Autopilot. From there, the management story is 95% identical to any other Intune-managed Windows 11 endpoint. But there are enough Cloud PC-specific subtleties that a blanket "apply your laptop policy" is not the right answer. This guide walks a minimum viable baseline that works for most Cloud PC estates.

The assumption throughout is Windows 365 Enterprise (Business runs a much lighter management surface without Intune) and Entra ID-joined Cloud PCs, which is now the default and recommended posture.

Provisioning policy

Provisioning starts with a provisioning policy in the Intune admin center: which image, which network connection, which region, which user assignment. This is where the Cloud PC differs most from a physical laptop — you are not shipping hardware to a person, you are defining the template a Cloud PC gets built from on demand.

Two decisions carry the most weight. Image: pick either the Microsoft-hosted Windows 11 Enterprise image (patched by Microsoft, simplest) or a custom image (yours, if you need pre-installed apps in the base). Custom images make provisioning slower and take on the burden of image maintenance — most estates should stick with the gallery image and layer apps on top.

Network: choose Microsoft-hosted network (fast, no infrastructure) or Azure Network Connection (ANC) into your own VNet (slower and more work, but gets Cloud PCs into a subnet that can reach your on-prem or Azure resources). If the Cloud PCs need line-of-sight to a domain controller, a file server, or an internal API, ANC is required.

Enrolment and identity

Cloud PCs auto-enrol into Intune. There is no separate enrolment restriction to configure — the provisioning policy is the gate.

Assign a User settings policy so users can be given local admin on their own Cloud PC (or explicitly not — the decision matters for developer workloads where local admin is a productivity floor, and for regulated workloads where it is a hard no). This is Cloud PC-specific policy: it does not appear in the standard laptop Intune baseline.

Compliance policy

Create a compliance policy targeted at Windows 365 devices (filter on model = Cloud PC — Cloud PCs identify themselves with a device model of Cloud PC Enterprise 2vCPU/8GB/128GB and similar). Baseline settings:

• Require BitLocker (yes — Cloud PCs support and enforce this by default, and Conditional Access should demand it).
• Require a compliant state before allowing sign-in through Conditional Access.
• Require Windows 11 minimum build (whatever your fleet-wide baseline is).
• No jailbreak / rooted check (N/A on Windows, but leave the standard setting).

Cloud PCs never fall behind on patches the way laptops do — they are always online and always managed — so the "device is out of date" grace period can be tighter than your laptop policy.

Configuration profiles

The Cloud PC configuration surface is nearly identical to a laptop. The pieces worth explicitly setting:

OneDrive Known Folder Move. Cloud PCs get a fresh profile every time the user reconnects to a re-imaged Cloud PC, so anything not synced to OneDrive is lost. KFM for Desktop, Documents, and Pictures is not optional here — treat it as required.

Delivery Optimization. Not useful on Cloud PCs (they don't peer with other Cloud PCs — they sit in Azure), so set the mode to HTTP only and skip the peer discovery overhead.

Microsoft Store / Winget. Turn on where policy allows — the fresh-provision use case makes app self-service through the Store or Company Portal genuinely useful.

Screen lock and idle timeout. Cloud PCs disconnect users after an idle period at the Windows 365 service level (default two hours). The Windows lock policy should be tighter than that — 10–15 minutes is normal — so a walked-away endpoint locks before the Cloud PC disconnects.

Windows Hello for Business. Works. Deploy it exactly as on a laptop.

Attack Surface Reduction (ASR) rules. Deploy the standard set. Cloud PCs are ordinary Windows 11 targets for the same threats as laptops.

Apps

Assign apps through the same Managed Apps blade you use for laptops. The Cloud PC-specific twist: users can be re-provisioned onto a fresh Cloud PC in an incident (or when they upgrade the SKU), and every install has to run again. That makes fast, deterministic app installs valuable — Winget-packaged apps and Store apps redeploy in minutes, big MSI installs less so.

Company Portal on the Cloud PC lets users self-service extra apps (Adobe Reader, Visual Studio Code, whatever). Assign the core productivity stack as required, and let optional apps live in Company Portal.

Autopatch

Enrol Cloud PCs in Windows Autopatch the same way you would enrol laptops. Autopatch's ring-based rollout works fine on Cloud PCs, and because Cloud PCs are effectively always online, the "test ring → broad ring" progression is faster and more predictable than on a laptop fleet where reboots can lag.

The one setting worth tuning: restart behaviour. Cloud PC users notice a forced restart more sharply than laptop users because the Cloud PC is their entire desktop. Configure Autopatch to prompt with adequate notice rather than force the restart during business hours.

Defender for Endpoint

Onboard Cloud PCs into Defender for Endpoint the same way you onboard any other Intune-managed Windows device. Defender treats Cloud PCs as regular Windows endpoints — the same EDR sensor, the same signals, the same automated investigations.

One note: some Defender attack surface reduction telemetry is noisier on Cloud PCs because Microsoft's own image and update pipeline runs many actions that on a laptop would look unusual. Give Defender a couple of weeks to calibrate before treating alert volume as signal.

What not to bother with

A few things on the laptop Intune baseline do not apply to Cloud PCs:

• Delivery Optimization peer discovery — no peers.
• Windows Update for Business rings — Autopatch handles this and does it better on Cloud PCs.
• Wi-Fi / VPN profiles — Cloud PCs have neither Wi-Fi nor an outbound VPN. Skip.
• Kiosk mode / shared device configuration — a Cloud PC is single-user by design.

Filter these profiles out with the Cloud PC device model filter so they do not create noise on the device compliance blade.

Ongoing operations

Once the baseline is in place, most Cloud PC operations are event-driven: a user gets a new Cloud PC (re-provisioned or SKU-upgraded), a Cloud PC is reset, a fleet-wide policy change goes out. Because provisioning is fast and repeatable, "just re-provision it" is a genuine incident-response option that it is not on a laptop — a Cloud PC in a suspect state can be reset without shipping hardware.

The Intune reports blade gives you the same visibility as for laptops. The Windows 365 section of the Intune admin center gives Cloud PC-specific reports: user connection quality, resize activity, and provisioning failures.

A well-baselined Cloud PC fleet is genuinely low-maintenance in a way that laptop fleets rarely are — which is the payoff for accepting the fixed monthly per-user cost.