Windows 365 explained

Windows 365 is Microsoft's Cloud PC service — a fully-managed virtual Windows desktop that streams from Azure to any device with a browser or the Windows App. You pay a per-user, per-month price for a specific VM size, and Microsoft handles the compute, storage, patching, and gateway between the endpoint and the desktop. The whole thing looks and behaves like a Windows 11 laptop that lives in the cloud.

Windows 365 is aimed at organisations that want the simplicity of SaaS applied to the desktop: no VDI stack to design, no session hosts to plan, no scaling rules to write. The trade-off is less flexibility than Azure Virtual Desktop (AVD) — you get one dedicated Cloud PC per user, not a pool.

The two editions

Windows 365 Business is aimed at small and medium organisations without Intune. You buy licences directly, users sign in with an Entra ID account, and there is a light admin surface at windows365.microsoft.com. No Intune, no Conditional Access enforcement — a very thin management layer.

Windows 365 Enterprise is the version most IT teams pick. It integrates with Intune for policy, Entra ID for identity, and Conditional Access for enforcement. Cloud PCs are joined to Entra ID (or hybrid-joined via an Azure Network Connection). This is the version this guide focuses on.

There is also Windows 365 Frontline for shift workers — three users can share one Cloud PC licence (but only one connects at a time), aimed at retail, healthcare, and manufacturing floor scenarios.

VM sizes and cost

Cloud PCs come in fixed configurations: 2 vCPU / 4 GB / 128 GB SSD at the low end, up to 16 vCPU / 64 GB / 1 TB SSD at the high end. Pricing is per-user, per-month, and includes the VM, the storage, the network egress at reasonable levels, and Microsoft's management of the whole stack. There is no consumption billing — the Cloud PC is provisioned and metered by the month whether the user runs it 8 hours a day or 80.

That flat rate is the strongest reason to choose Windows 365 over AVD when your users are always-on knowledge workers: you can predict the bill exactly. If your users are shift-based or highly variable, AVD's pooled multi-session Windows almost always wins on cost.

How provisioning works

You define a provisioning policy in Intune that specifies the image (Microsoft-provided or a custom image), the region, the join type (Entra ID join, or hybrid via Azure Network Connection), and the licence to consume. When a user is assigned a licence, Intune creates the Cloud PC automatically — typically in 20–40 minutes for a first provision.

The Cloud PC then behaves like any other Windows 11 endpoint in your Intune tenant: it enrols automatically, receives your compliance policies, your app assignments, your Defender configuration. There is no separate AVD-style host pool or session config to manage.

Custom images live in the Azure Compute Gallery. Most organisations start with the Microsoft-provided gallery image and layer everything else via Intune app deployment and configuration profiles, rather than baking apps into an image — the same modern-endpoint approach Autopilot uses for physical devices.

Networking

By default, Cloud PCs use the Microsoft-hosted network — internet-out via Microsoft, no line-of-sight to on-prem resources, no need to think about VNets. For most SaaS-first tenants that's exactly what you want.

When Cloud PCs need to reach on-prem file shares, legacy line-of-business apps, or a private Azure workload, you set up an Azure Network Connection (ANC) — a VNet you own in your Azure subscription that the Cloud PCs join. The ANC is your responsibility to size, and it's where all the classic VDI networking questions come back: BGP peering to on-prem, ExpressRoute or VPN, DNS forwarding, NSG design.

Users connect over RDP over HTTPS via a Microsoft-managed gateway — no inbound firewall exposure of the Cloud PC itself. The client is the Windows App (Windows, macOS, iOS, Android) or any modern browser.

Identity and Conditional Access

Cloud PCs are joined to Entra ID (or hybrid-joined via ANC). That means Conditional Access applies to the sign-in to the Cloud PC, which the review board almost always wants: a Cloud PC in another country, on a non-compliant endpoint, or without MFA gets blocked exactly the same way a laptop would.

For admin operations on the Cloud PC itself — screen shadowing, restart, resize — Intune role assignments apply. There is a dedicated Windows 365 Administrator role for teams that shouldn't inherit full Intune scope.

When Windows 365 is the right answer

Pick Windows 365 when:

• You want one dedicated Cloud PC per user — knowledge workers, developers, contractors, BYOD scenarios.
• You want the cost predictable — flat monthly, no metering.
• You want the admin surface small — Intune only, no VDI stack.
• You want the endpoint to look like every other Intune-managed Windows 11 device — same policy, same app deployment, same reporting.

When Windows 365 is the wrong answer

Pick AVD instead when:

• Your users are shift-based, and pooled multi-session Windows would cut cost dramatically.
• You need custom hardware profiles per session (GPU sizes, specific storage tiers) that Windows 365's fixed SKUs don't cover.
• You already have a mature AVD estate — Windows 365 doesn't federate with AVD host pools.

Where to go next

The direct comparison to AVD is in Windows 365 vs Azure Virtual Desktop. For the Intune side, start with Intune compliance and Conditional Access and Intune app protection policies. For the identity story on Cloud PCs, Entra ID conditional access design applies as-is.