Windows 365 gives businesses a fully cloud-hosted Windows desktop — provisioned centrally, accessible from any device, and, when configured properly, hardened to Australian cyber security standards from the moment a user first logs in.
The appeal is obvious: no physical hardware to manage, consistent security posture across every device, and a desktop experience that follows your team wherever they’re working. What’s less obvious is what actually goes into provisioning one of these machines correctly — the policy sets, the network configuration, and the mistakes that can send the whole process into a frustrating loop.
In this episode of Tech Tuesday, we built a Windows 365 Cloud PC from scratch — start to finish, mistakes included — so you can see exactly what the process involves before you attempt it yourself.
What Windows 365 Actually Is
Windows 365 is Microsoft’s Cloud PC service — a virtual machine running Windows 11 that’s provisioned, licensed, and managed centrally, then streamed to whatever device a user connects from. Unlike traditional VDI (Virtual Desktop Infrastructure), which typically requires significant on-premises infrastructure and specialist configuration, Windows 365 is designed to be provisioned largely through Microsoft’s own cloud tooling — Intune, Entra ID, and Azure.
For a business, the practical benefit is a desktop that’s identical regardless of the physical device a staff member is using, provisioned with company policies, security tooling, and applications already configured before the user ever logs in.
Before You Provision: The Settings That Matter
Before assigning a single licence, there are foundational settings that determine how secure — and how manageable — your Cloud PC deployment will be.
Cloud PC settings and local admin rights
The first decision is whether users have local administrator rights on their Cloud PC. Our approach is to disable local admin entirely, while still enabling users to reset their own Cloud PC if something goes wrong. This balances security — users can’t install unauthorised software or change system-level settings — with practicality, since a user who’s created a mess can self-service a reset rather than waiting on a support ticket.
These settings are configured in Intune under Devices → Windows 365 → Cloud PC Settings, and are tied to an Azure security group that determines which users the policy applies to.
Policy sets: the modern equivalent of Group Policy
Policy sets are where the real security posture of a Windows 365 deployment gets defined. Think of them as the modern, cloud-native equivalent of the Group Policy Objects that governed on-premises Windows environments for decades.
Our policy sets are built aligned to the ACSC Essential Eight and CIS Level 1 benchmarks — Australia’s own cyber security framework and an internationally recognised hardening standard, respectively. Rather than provisioning a vanilla Windows 11 image and hardening it after the fact, applications and security configurations are pre-installed and enforced before the machine is ever handed to a user.
This matters because retrofitting security onto an already-deployed fleet of machines is significantly harder — and riskier — than building it in from the first boot.
Provisioning: Autopilot, Regions, and Network Connections
With settings and policies in place, the provisioning process itself involves several decisions that determine how the machine deploys and performs.
Autopilot and Entra ID join
Windows Autopilot handles the deployment automation, while the machine itself is joined to Entra ID (formerly Azure Active Directory) — Microsoft’s cloud identity platform. This is distinct from a “hybrid join,” which requires an on-premises Active Directory connection back to a local network. For most Windows 365 deployments, a straightforward Entra ID join is simpler and sufficient.
Choosing your region
Region selection affects both data residency and performance. For Australian businesses, Australia East is the standard choice — keeping data within Australian borders and typically delivering strong performance for local users. This is a decision worth making deliberately rather than accepting a default, particularly for businesses with data sovereignty obligations.
Azure network connections
A Windows 365 deployment requires an Azure network connection — the connectivity layer that governs how the Cloud PC communicates with your broader environment. This needs to be configured on a subscription with an appropriate subnet before provisioning can complete successfully.
The Mistake to Avoid: Don’t Touch It Once It’s Provisioning
Here’s the lesson that cost real time during this build: once a Windows 365 Cloud PC begins provisioning, any change to the policies or provisioning settings restarts the entire process.
This isn’t intuitive. The instinct when something looks slow or incomplete is to check the settings, tweak something, and see if it helps. With Windows 365 provisioning, that instinct is exactly wrong — every change during an active provision resets the clock, sometimes by hours.
The practical guidance: once your provisioning policy is configured and the build has started, leave it alone. Let it complete, even if that means waiting overnight.
What You Get: Inside the Provisioned Machine
Once provisioning completes, the result is a fully functional Windows 11 Enterprise machine with Microsoft 365 applications pre-installed, running on generous cloud specifications — in this case, 8 vCPUs, 32GB of RAM, and 512GB of storage.
Users connect via the Windows App, available through the Microsoft Store, which then authenticates through standard multi-factor authentication and connects to their provisioned Cloud PC. From first login, the machine already reflects the organisation’s policies — OneDrive signed in, password manager configured, and remote monitoring and management tooling installed and active.
For Alphalogix specifically, every internally managed machine is Intune-managed and Autopilot-enrolled, while client machines are additionally deployed with NinjaOne for remote monitoring, patching, and support ticketing.
Performance: How Does a Cloud PC Actually Feel to Use?
The genuine surprise in this build was performance. Testing the Cloud PC’s connection speed against a standard home internet connection, the Australia East-hosted machine performed noticeably better — a result that matters for any business considering Windows 365 for demanding workloads like large file transfers, data migrations, or bandwidth-heavy applications.
This is a point worth understanding clearly: a Cloud PC’s performance isn’t bottlenecked by your local internet connection in the same way traditional remote desktop setups can be. For teams doing migration work or handling large datasets, this can be a genuine operational advantage over hardware tied to office-based bandwidth constraints.
Is Windows 365 Right for Your Business?
Windows 365 makes the most sense for businesses that want consistent, centrally managed desktop environments without the overhead of traditional VDI infrastructure — particularly organisations with distributed or hybrid teams, businesses undergoing device refresh cycles, or those wanting to standardise security posture across every endpoint without managing physical hardware variability.
It’s not automatically the right fit for every scenario — bandwidth-sensitive specialist applications, certain legacy software requirements, and organisations with existing heavy investment in on-premises VDI may need a more tailored assessment. But for a growing number of Australian businesses, it represents a meaningfully simpler path to a secure, consistent desktop fleet.
See More. Respond Faster. Stay Secure.
If you’re evaluating Windows 365 for your business, or reviewing whether your current desktop and VDI setup could be simplified and better secured, we’re happy to walk through what’s realistic for your environment.
No obligation, no lock-in, honest advice.
Alphalogix is a Sydney-based managed IT and physical security company.
alphalogix.com.au
