Manage and maintain devices · Topic 3 of 9
Windows 365 Cloud PCs and Windows Backup
MD-102 Cloud PCs and backup: Windows 365 provisioning policies, join types, network connections, image management, and Windows Backup for Organizations.
- 5 min
- A provisioning policy sets join type, network, image and users. Hybrid join always needs an Azure network connection.
- Microsoft hosted network needs no Azure subscription and works with Entra join.
- Custom images must be generation 2 and never joined, enrolled or co-managed.
What it is
Windows 365 gives users a personal Windows desktop, a Cloud PC, hosted in Microsoft's cloud and managed like any other Windows device in Intune. You provision Cloud PCs with a provisioning policy that sets the join type, the network, the image and the users. Windows Backup for Organizations backs up a user's Windows settings and Store apps, and lets them restore on a new or reset device during setup.
How it works
Provisioning policies
You create a policy under Devices, Windows 365, Provisioning policies. The main choices:
| Choice | Options |
|---|---|
| Type | Windows 365 Enterprise, or Windows 365 Frontline (also called Flex), which supports dedicated and shared modes for shift workers |
| Join type | Microsoft Entra join or Microsoft Entra hybrid join |
| Network | Microsoft hosted network, or an Azure network connection (ANC) |
| Image | A gallery image or a custom image |
| Users | The Entra groups that receive a Cloud PC |
A Microsoft hosted network needs no Azure subscription and is available with Entra join, where you choose the geography and region. An Azure network connection points to a virtual network in your own subscription, and is required for hybrid join and for Entra join when you need access to your own network. Hybrid join policies can take up to 60 minutes to finish, because they wait for Entra Connect sync, and they need infrastructure that automatically hybrid joins devices.
Editing a policy does not change existing Cloud PCs. Changes to the network, image, region or single sign on apply only to newly provisioned or reprovisioned Cloud PCs.
Network connections
An Azure network connection holds the Azure subscription, resource group, virtual network and subnet, and for hybrid join, the domain details and a service account. Windows 365 runs health checks on the connection (DNS, domain join, connectivity) and reports failures before provisioning. The subnet needs the required outbound access, and for hybrid join, a path to a domain controller.
Image management
| Image type | Notes |
|---|---|
| Gallery images | Built in Windows 11 and Windows 10 Enterprise images, optimised for Cloud PCs. Simplest choice |
| Custom images | Your own captured image. It must be a supported Windows Enterprise version, generation 2, and never joined to Active Directory or Entra ID, enrolled in Intune or co-managed |
Upload and manage custom images in Windows 365, Custom images. For hybrid join, Windows 365 copies the image to every region that has an ANC. For Entra join, it copies it to the provisioned region. Prepare custom images by generalising them with sysprep before capture.
Managing Cloud PCs
A Cloud PC is an Intune managed Windows device, so it uses the same configuration, compliance and app deployments. Windows 365 adds remote actions such as restart, rename, reprovision, resize, restore and troubleshoot. To target Cloud PCs with policy, create a dynamic device group on the Cloud PC naming or properties. Users need licenses for Windows Enterprise E3, Intune, Entra ID P1 and Windows 365, and the provisioning admin needs the Windows 365 Administrator or Intune Administrator role.
Windows Backup for Organizations
Windows Backup saves Windows settings and Microsoft Store apps to the cloud. It is not a disk image. Setting it up has two parts.
- Enable backup with a settings catalog policy: the Enable Windows backup setting, under the Sync your settings category, assigned to users.
- Offer restore during setup: under Devices, Enrollment, Windows, Enrollment options, Windows Backup and Restore, set Show restore page to On.
Details to remember:
- The restore page is a tenant wide setting, applied when a device enrolls. The default, Not configured, turns restore off. It does not change devices already enrolled.
- Changing it needs the Intune Administrator (service administrator) or Global Administrator role.
- It works for Microsoft Entra joined devices with a user. It is not supported with self-deploying mode or hybrid join for the OOBE restore page. With Autopilot, the profile must be user-driven.
- A separate settings catalog policy handles restore at first sign in.
- You can monitor in the device's Windows Backup and Restore profile state, including whether the device went through a restore.
A worked scenario
A consultancy gives each new hire a Cloud PC. The admin creates a provisioning policy with Entra join on a Microsoft hosted network and a gallery image, and assigns the hiring group. A second policy for the finance team uses an Azure network connection to reach an on premises ERP over ExpressRoute. For staff who replace their laptops, she sets Enable Windows backup for all users and Show restore page to On, so a reimaged laptop offers to restore settings during Autopilot.
What to remember for the exam
- A provisioning policy sets join type, network, image and users. Hybrid join always needs an Azure network connection.
- Microsoft hosted network needs no Azure subscription and works with Entra join.
- Custom images must be generation 2 and never joined, enrolled or co-managed.
- Editing a policy does not change existing Cloud PCs.
- Windows Backup needs a backup policy and the Show restore page enrollment option, which is tenant wide and not available for self-deploying or hybrid scenarios.
A Cloud PC that must reach on premises resources points to an Azure network connection.
How the exam asks about this
- "Cloud PCs must join the on premises domain." Hybrid join with an Azure network connection.
- "No Azure subscription available." Microsoft hosted network with Entra join.
- "Offer restore of settings when users set up a new laptop." Show restore page and Enable Windows backup.
- "A custom image fails to provision." It was joined, enrolled or not generation 2.
Common mistakes
Choosing a Microsoft hosted network for hybrid join. It needs an ANC.
Capturing an image from an enrolled device. It will fail the image requirement.
Expecting policy edits to change live Cloud PCs. Reprovision them.
Turning on the restore page without enabling backup. There is nothing to restore.
Check yourself
Which network option needs no Azure subscription?
Microsoft hosted network.
What setting offers restore during OOBE?
Show restore page, under Enrollment options.
What must a custom image never have been?
Joined to AD or Entra ID, enrolled in Intune or co-managed.
Topic 3 of 9 in Manage and maintain devices
Test yourself on Manage and maintain devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.