Windows 365 Enterprise and Intune Management

Learn to deploy Windows 365 Enterprise, from requirements and Azure AD join to deploying a cloud PC, with provisioning, sizing, custom images, user settings, and optional labs for network connectivity.

Outline the requirements for Azure AD joined cloud PCs in Windows 365 Enterprise, including user licensing (Intune AAD P1/P2 and Windows enterprise license) and provisioning policy assigned to a group.

Verify licensing prerequisites and set up an Azure AD join provisioning policy to deploy Windows 365 Enterprise cloud PCs, then provision and access the cloud PC.

Explore Windows 365 client options across web, Windows desktop, store, mobile, and Mac clients, comparing features such as integrated and immersive remote apps, multi-monitor support, dynamic resolution, and hardware redirection.

Learn to access Windows 365 cloud PCs via web, desktop, and mobile clients; sign in, manage cloud PCs, upload files, and customize display and session settings.

Remove the Windows 365 license from the user to place the cloud PC in a seven-day grace period, then end the grace period to remove access.

Connect cloud PCs to Azure networks using Azure AD joined, hybrid Azure AD joined, or Microsoft hosted networks, and configure Azure VNet, subnets, and DNS for on premises access.

See how Azure network connections undergo health checks for Windows 365, validating the virtual network, subnet, URLs, and permissions, then test Azure AD join and Hybrid Azure AD join.

This lab guides creating an Azure AD join network connection to connect a cloud PC to a private Azure network, with permissions verified and network health checks performed.

Create a hybrid Azure AD join network connection to link a cloud PC to a Windows domain, configure DNS and domain controllers, provide credentials, and run a health check.

Examine provisioning policies that configure cloud PCs, including join types, region-aware network connections, and image choices. Learn how assignments, language, patching, and reprovisioning govern policy changes and cloud PC lifecycle.

Create an Azure AD join provisioning policy and its group, assign a test user and license, and verify cloud PC provisioning via the Azure AD join network connection.

Create a hybrid Azure AD join provisioning policy for Windows 365, assign it to a test group, license a user, and verify the cloud PC's hybrid join status.

Update a hybrid Azure AD joined provisioning policy in the Windows 365 portal, then reprovision a cloud PC to apply Windows 11 OSS, showing policy changes and the reprovision process.

Explore cloud PC size options for Windows 365 Enterprise, matching personas and performance needs with 2-core to 8-core plans, and resizing while preserving data.

Verify licensing in the Azure AD portal, then resize a cloud PC from two cores eight gig to four cores sixteen gig in the Windows 365 admin center.

Explore when to use custom images in Windows 365, compare gallery versus custom images, and follow the generation 2 VM workflow (prep, snapshot, capture, provisioning) to deploy cloud PCs.

Learn to create a custom Windows 11 image for Windows 365 by provisioning a reference VM in Azure, generalizing, capturing, and importing the image into Azure Compute Gallery.

Add a custom image in Windows 365, create a provisioning policy with Azure AD join, assign a license, and verify a cloud PC with pre-installed apps.

Explore Windows 365 user settings for point in time recovery and local admin rights, including RPO, default weekly restore points, and adjustable short term restore points.

Configure and review default recovery points, create user-defined restore points, enable local admin rights, and grant rights to restore a cloud PC in Windows 365 via Endpoint Manager.

Master Windows 365 Enterprise deployment by configuring Azure AD joined cloud PCs, exploring connection options, private network integration with Hybrid Azure AD joined connections, and provisioning policies.

Explore options to manage Windows 365 cloud PCs, including Azure AD joined or hybrid joined devices, enrolled into Intune or Configuration Manager with Intune co-management and conditional access.

Organize cloud PCs into azure id groups to target profiles, policies, and apps; define three categories: all cloud PCs, provisioning policy cloud PCs, and configuration-specific cloud PCs.

Create dynamic device groups in endpoint manager using device model and enrollment profile name rules, validate membership, and save policies like data scientists with two vCPU four GB RAM.

Create device filters to apply Intune policies to cloud PCs. Three categories exist: all cloud PCs, cloud PCs from a provisioning policy, and old cloud PCs by configuration.

Create filters in Endpoint Manager Admin Center using the model device property to target Windows ten and later, preview results, and filters for cloud PCs and data scientists' provisioning policy.

Create and apply device configuration profiles in endpoint manager to manage cloud PCs, using administrative templates, baselines, and the settings catalog to configure wallpaper and security settings.

Intune enforces device compliance policies to protect data by requiring OS version and threat level, with device health checks and automated actions for noncompliant cloud PCs, noting Bitlocker isn't supported.

Deploy apps to cloud PCs using Intune or Configuration Manager, including Microsoft 365 apps, Teams, OneDrive, and Edge, with Win32, MSI, MSIX packaging.

Explore remotely managing cloud PCs with Intune, performing actions like restart, sync, rename, quick scan, full scan, Windows Defender updates, and collect diagnostics, plus provisioning and resize.

Explore cloud PC management in the endpoint manager, using sync, restart, restore, reprovision, and resize, and collecting diagnostics with quick and full Windows Defender scans.

Explore Windows 365 security baselines, policy templates built on security best practices and real-world experience to lower risks by configuring Windows 10, Edge and Defender for Endpoint.

Configure a Windows 365 security baseline in the endpoint manager, create a profile, customize settings like blocking Adobe Reader child processes, and deploy to all cloud PCs.

Use Azure AD conditional access to protect cloud PCs, enforcing if-then policies and requiring multifactor authentication based on user, location, device, app, and real-time risk; note Premium P1 is required.

Explore Azure AD conditional access to protect all users with multi-factor authentication for Windows 365 Cloud PC, applying the policy to a small test group first.

Explain digital forensics and review holds, including capturing a cloud pc snapshot to Azure storage for forensic analysis, preserving chain of custody and enforcing access control and auditing.

Manage updates for Windows 365 enterprise devices using Intune, choosing between re provisioning or cloud PC updates via Windows Update for Business, with ring-based policies and gallery image updates.

Create update rings in Intune to automatically deploy Windows updates to cloud PCs, enforce zero-day quality update deferral, and set maintenance-time auto installs with restart checks.

Explore the Intune admin center reporting, covering endpoint analytics, device management, analytics, Intune data warehouse, and Azure Monitor, with licensing for enterprise mobility and security.