Microsoft cloud
Provisioning policy
Windows 365 provisioning policy
A Windows 365 provisioning policy is the configuration object, created and managed in the Microsoft Intune admin center, that defines how new Cloud PCs get built and assigned for a given group of licensed users.
Why Provisioning policy matters in a Microsoft estate
Provisioning policy matters because Microsoft 365, Azure, Windows 365, Teams, and related services are usually managed as one estate. The term connects to planning, cost, configuration, security, and day-two operational decisions across that estate.
How Provisioning policy shows up in practice
It ties together the image to deploy, the network configuration to attach to, and the language and region settings into a single reusable template. Windows 365 executes this template automatically whenever a licensed user in the assigned Entra ID group needs a Cloud PC provisioned. Its core components are the image, either a Microsoft-provided gallery image or an organisation's own custom Windows image published to an Azure Compute Gallery, and the network connection type, either a Microsoft-hosted network for the simpler managed networking model or a specific Azure network connection for organisations that need the Cloud PC deployed inside their own virtual network.
It also specifies the target Entra ID group whose members will have Cloud PCs automatically provisioned as they are licensed, along with optional settings like a Cloud PC naming template and, for hybrid Entra join scenarios, the target on-premises Active Directory domain and organisational unit. Assignment is group-based rather than individual, which is both the policy's main operational strength and its most common source of misconfiguration. Adding a user to the assigned Entra ID group and licensing them for Windows 365 triggers automatic provisioning with no further administrator action required, which scales well.
But it also means an incorrectly scoped or overly broad group can trigger unintended provisioning. Equally, forgetting to remove a departed employee from the assignment group promptly can leave a licensed, running, and billing Cloud PC sitting idle for weeks before anyone notices, which is one of the most common and avoidable sources of ongoing Windows 365 waste in real deployments. Multiple provisioning policies are the normal way organisations handle different user segments needing different configurations. For example, an organisation might use separate policies for standard knowledge workers on a lighter image and network configuration versus a developer or power-user segment on a heavier custom image with access to internal source control systems through an Azure network connection.
Keeping these policies cleanly separated by group, rather than trying to force one policy to serve every user type, is standard practice for both manageability and cost control. Provisioning policy health, and its associated Azure network connection health where applicable, are the first two things worth checking whenever new Cloud PC provisioning fails or stalls. A failed domain join credential, an exhausted subnet, or an image no longer available in the target region will all surface as provisioning failures traceable back to the policy configuration, rather than to the user's licence assignment itself.