Windows 365 · Sets up your tenant
Windows 365 Cloud PCs, set up from your browser
W365 Deploy takes you through a provisioning policy one step at a time, checks it against your tenant and sets it up: the users group, user settings, the policy, an Intune device group and the licences. You install nothing and run no scripts.
How it works
From design to Cloud PCs
Nothing in your tenant changes until you press Deploy. Windows 365 then provisions the Cloud PCs itself.
- 1
Design
Five short pages: Cloud PCs, network, names, access and user settings, with sensible defaults throughout.
- 2
Review
Your roles, licences, the gallery image and anything already in your tenant are checked. Nothing changes yet.
- 3
Deploy
The groups, user settings and provisioning policy are created and assigned, in about a minute.
- 4
Provisioning
Windows 365 makes a Cloud PC for each licensed person in the users group, each in up to about an hour.
- 5
Connect
People sign in with Windows App on any device, or in a browser. You remove the deployer's access when you're done.
The design
The choices that matter, and sensible defaults for the rest
Run it once per persona or department: each run is one provisioning policy, assigned to one group.
Microsoft-hosted network
Microsoft runs the network, so there's nothing to build in Azure and no subscription to pay for. Choose the geography; Windows 365 picks the region with capacity. Your own network is coming soon.
The right image
Windows 11 Enterprise with Microsoft 365 Apps, or without them so Intune installs your apps. Review picks the newest supported gallery image.
Names that follow your rules
A prefix and the start of each user's name, kept within Windows 365's 15 characters and its random part.
The users group
A new group with you as owner, or one you already have. Optionally, the Windows 365 licence assigned through it.
A device group for Intune
A dynamic group of exactly this policy's Cloud PCs, to target apps and policies. Or match on the name prefix instead.
User settings
Local admin off by default, restore points every 12 hours, and whether people can restore or reset their own Cloud PC.
Security
Your tenant, your sign-in, least privilege
Runs in your browser, as you
Every change is made with your own sign-in, from the page. Andy Kemp Consulting receives no Microsoft tokens or tenant data.
Only what this design needs
It reads your directory and Windows 365 on connect, and asks for write permissions only at Deploy, for that tab: Windows 365, and groups or licences only if the design uses them.
Tells you when you hold too much
Review blocks on missing roles, and notices when you're signed in with more than the job needs, such as Global Administrator.
Leaves what you have alone
A policy, settings or group that already exists is kept as it is. Assignments are added to, never replaced.
Local admin off by default
People aren't administrators of their Cloud PC unless you choose it, and the page warns you if you do.
Nothing in Azure
No Azure Resource Manager access at all. When you're done, remove the deployer's access from your tenant in one click.
Get started
Sign in and design
Sign in at deploy.andykemp.com/w365, connect your tenant and work through the design. Review tells you anything that would stop it before it starts.
- Windows 365 Enterprise licences for your users
- Windows 365 Administrator, or Intune Administrator
- Groups Administrator to create groups, License Administrator to license the group
- Entra ID P1 for the device group and group licensing (optional)
Questions
Frequently asked
How do we get access?
Using W365 Deploy needs an Andy Kemp Consulting account with access to it: talk to Andy. Windows 365 itself is licensed to you by Microsoft.
What do we need before we start?
Windows 365 Enterprise licences for your users, and the Windows Enterprise, Intune and Entra ID P1 licensing that Microsoft 365 E3, E5 or Business Premium include. To run it: Windows 365 Administrator (or Intune Administrator), plus Groups Administrator to create groups and License Administrator to license the group.
Do we need an Azure subscription?
No. On the Microsoft-hosted network, Microsoft runs the network and the Cloud PCs. Your own network, through an Azure network connection, is coming soon; it's also what hybrid join needs.
What size are the Cloud PCs?
Each person's Cloud PC gets the size of the Windows 365 Enterprise licence they hold, such as 2 vCPU, 8 GB RAM and 128 GB. Review shows the licences you have and how many are free.
We already have provisioning policies. Is that a problem?
No. They're listed when you connect. A design with the same name keeps the existing policy as it is and only adds what's missing, such as its assignment to your users group.
Can we run it again?
Yes. Everything is found by name first, so running it again only adds what's missing. Use it again for each persona or department, with its own policy name.
Click through it before you connect anything
The demo is the real W365 Deploy with a made-up organisation in it. Design, review and deploy: nothing is created and nothing connects to Microsoft.
Related tools
Use it with
- Cloud Desktop AdvisorWindows 365 or Azure Virtual Desktop? Get a recommendation with the reasons, AVD session host sizing, Windows 365 editions and sizes, and how users should connect, including Windows 365 Link and Boot.
- AVD DeployDesign, check and deploy Azure Virtual Desktop into your own subscription step by step, then finish the Entra and Conditional Access setup, all from the browser. Try the live demo.