How to Secure Windows 365 Cloud PCs in 10 Steps

• Last updated: 03 November 2026
• Cloud PC,Windows 365
• Written by Editorial Team

To secure Windows 365 Cloud PCs, protect three things: who can connect, the Cloud PC itself, and the data inside the session. In practice that means requiring multi-factor authentication through Microsoft Entra Conditional Access, enrolling Cloud PCs in Microsoft Intune with a security baseline where your edition allows it, keeping users as standard users, leaving clipboard, drive, USB, and printer redirection off until a role needs them, saving data to the cloud, and watching sign-in activity for attacks. Windows 365 is built with Zero Trust in mind and hands you the controls. The security you end up with depends on how you configure them.

This guide replaces our 2021 posts on securing Cloud PCs and monitoring for brute-force attacks. A lot has changed since then. Microsoft Endpoint Manager is now Intune, Azure AD is Microsoft Entra ID, and Azure Sentinel is Microsoft Sentinel. The Microsoft Monitoring Agent used in the old brute-force steps was retired in August 2024. Defaults have moved too: Windows 365 Business users are now standard users by default, and several data redirections are off until you turn them on. Below you will find ten steps, a clear view of what Business and Enterprise can and cannot do, and a modern way to detect password attacks.

Key Takeaways

How Windows 365 Security Works

Microsoft describes Windows 365 as built with Zero Trust in mind, and its Windows 365 security overview organizes the controls into three groups. Securing access to the Cloud PC aligns with identity. Securing the Cloud PC device aligns with the endpoint. Securing the data on and around the Cloud PC aligns with data. The same split makes a useful checklist, which is why this guide follows it (if Cloud PCs are new to you, here is how a Cloud PC works).

It also helps to understand the connection model, because it removes a whole class of risk. A user reaches a Cloud PC through two authentication challenges, one for the Windows 365 service and one for the Cloud PC itself. Microsoft’s network documentation says the default connection runs through a gateway using reverse connect transport, which means there is no need for inbound connectivity to the Cloud PC. In other words, you are not exposing a Remote Desktop port to the internet, and the attacks that dominate traditional RDP servers mostly do not apply here. The weak point moves to identity, which is where the first steps below focus.

Security Built In by Default

Before you configure anything, a Windows 365 Cloud PC already carries protections that many physical PCs lack. The table separates what is already on from what is still your job.

Area	Already On by Default	You Still Configure
Hardware-backed protection	Virtual TPM and Secure Boot on every new Cloud PC	Nothing for these two features
Credential and kernel protection	Hypervisor-protected code integrity and Credential Guard on Windows 11 gallery images	Confirm they stay on if you use custom images
Data encryption	Cloud PC disks are encrypted at rest	Optional extras such as encryption at host and customer-managed keys
Device redirection	Clipboard, drive, opaque low-level USB, and printer redirection disabled	Decide which roles genuinely need each one
Network exposure	No inbound connectivity required for the connection	Protect routes, firewalls, and any private network design
User access	Users start as standard users	Conditional Access, MFA, and any local admin exceptions

Microsoft also offers Purview Customer Lockbox, which an administrator can turn on so that Microsoft cannot access your content for service operations without your explicit approval. It is optional, and it is worth a conversation if you handle sensitive client data.

Windows 365 Business vs Enterprise: What You Can Secure

Your edition decides how much of the toolbox you can use, and the 2021 version of this article glossed over that. Microsoft’s Business and Enterprise comparison spells out the security differences, summarized here.

Capability	Windows 365 Business	Windows 365 Enterprise
Default user role	Standard user, with local admin by exception	Standard user, changeable by the administrator
Conditional Access	Through Microsoft Entra ID, with a Microsoft Entra ID P1 license	Through the Intune admin center or Microsoft Entra ID
Multi-factor authentication	Only through Conditional Access, since legacy per-user MFA is not supported	Through Conditional Access, and legacy per-user MFA works only for hybrid joined Cloud PCs
Security baselines	Not supported	Dedicated baselines you can edit and deploy in Intune
Policy management	Not supported	Group Policy and Intune device management
Microsoft Defender for Endpoint	Supported if you separately hold the required license	Integrates with Defender for Endpoint, and Cloud PCs respond to its policies with the right license
Monitoring and troubleshooting	Not supported	Endpoint analytics, service health, and Intune troubleshooting

Two nuances matter. Business has no licensing prerequisites, but you can use Intune for some management if your users hold Intune licenses, for example through Microsoft 365 Business Premium. In that case the Cloud PCs will not appear on the Windows 365 page in Intune. And Enterprise requires Windows Enterprise, Intune, and Microsoft Entra ID P1 for each user, as our checklist of client and license requirements explains. If baselines, monitoring, and policy control are must-haves, Enterprise is the edition built for them, and the current plan pricing by edition lets you compare the options.

How to Secure Windows 365 Cloud PCs in 10 Steps

These steps move from the biggest wins to the finishing touches. If you can only do a few today, do the first four.

• Step 1: Require MFA With Conditional Access

  Conditional Access is the primary control for who reaches a Cloud PC, and Microsoft notes that no policies are set for your tenant by default. Target all three apps involved in a connection: Windows 365, which lists your Cloud PCs and handles actions such as restart, Azure Virtual Desktop, which authenticates the connection to the gateway, and Windows Cloud Login, which signs users in to the Cloud PC when single sign-on is on. Microsoft recommends matching the policies across these apps so the experience is consistent.

  Create the policy in report-only mode first and review the results before you switch it on. One caution from Microsoft’s documentation: a policy that targets Windows 365 can also affect administrator sign-ins to portals such as Intune and the Azure portal, so scope it deliberately.

  

  Sign-in frequency is the companion setting. It controls how often users must reauthenticate, which matters most on personal devices that may not lock themselves. Microsoft explains that reauthentication happens only when a new access token is needed, and that unstable networks can trigger more prompts because a reconnect may require a fresh sign-in.

• Step 2: Move Toward Passwordless, Phishing-Resistant Sign-In

  Passwords are the most attacked part of a Cloud PC. Where you can, use phishing-resistant methods such as FIDO2 security keys and passkeys, which also remove the pain of password prompts. Windows 365 Link supports FIDO2 security key sign-in, and our guide to a purpose-built Cloud PC device explains how that works at shared desks. Whatever you choose, keep a small number of emergency access accounts that are protected carefully and excluded from policies that could lock you out.

• Step 3: Enroll in Intune and Apply the Windows 365 Security Baseline

  Every Enterprise Cloud PC is enrolled in Intune, which is what makes central security possible. Deploy the Windows 365 security baseline from Intune as your starting configuration, and layer your own settings on top. Business has no baseline support, so Business customers should treat Steps 1 and 4 as their foundation and consider Enterprise if they need more.

  How to Apply Security Policies to New Cloud PCs Automatically

  You do not want to configure each new Cloud PC by hand. Assign your Intune policies to Microsoft Entra groups, either the group of users who receive Cloud PCs or a dynamic device group that captures Cloud PCs automatically. Then every new Cloud PC picks up the baseline, Defender settings, and redirection rules as it enrolls. Pair this with a provisioning policy assigned to a group, and a new hire gets a secure desktop with no extra work. For larger rollouts, automating provisioning with Power Platform adds workflow on top.

• Step 4: Keep Users as Standard Users

  Both editions start users as standard users on their Cloud PCs, which is the right default. Local administrator rights let malware install, change security settings, and steal credentials, so grant them only by exception and review the exceptions regularly. In Enterprise, you set permissions in the provisioning policy and can change a user’s role in Intune. In Business, you can grant local admin to a specific user or change the organization default, and you should resist the old habit of making everyone an administrator.

• Step 5: Turn On Defender and Attack Surface Reduction

  Microsoft Defender for Endpoint integrates with Enterprise Cloud PCs, and with the required license your Cloud PCs respond to its policies and appear in its dashboards. Add attack surface reduction rules for the threats you care about most, such as blocking credential stealing from the Windows local security authority subsystem. The Credential Guard and hypervisor-protected code integrity defaults on Windows 11 gallery images already harden credentials, so make sure custom images do not turn them off.

• Step 6: Control Data Movement With Redirection Policies

  Clipboard, drive, opaque low-level USB, and printer redirection are disabled by default, so files cannot leave the session unless you allow it. Review each one by role. In Intune, a device configuration profile using the Settings catalog manages these redirections for Microsoft Entra joined Cloud PCs, and Group Policy covers hybrid joined ones, as described in Microsoft’s guidance on RDP redirections. Clipboard redirection can also be limited to one direction.

  Microsoft has put context-based redirection into public preview, which varies these controls by device compliance, user group, and network location, a good fit for personal devices such as an iPad (see our walkthrough for connecting from an iPad). For highly sensitive work, screen capture protection and traceable watermarking add a further deterrent, although they depend on a supporting client.

• Step 7: Protect Data at Rest and Keep It Out of the Cloud PC

  Cloud PC data is encrypted at rest, and Microsoft documents the details in its data encryption guidance for Windows 365. Organizations that want to hold their own keys can use Microsoft Purview Customer Key with Windows 365. Just as important, keep important files in OneDrive or SharePoint instead of only on the Cloud PC, because a Cloud PC is a workspace and not a backup. Regulated firms should also read how law firms should think about Cloud PCs and client confidentiality.

• Step 8: Secure the Network Path

  Because the connection uses outbound-only reverse connect transport, Cloud PCs on the Microsoft-hosted network need no inbound rules from you. If you place Cloud PCs on your own Azure virtual network with an Azure network connection, you take on the network design: use network security groups and firewalls, avoid opening inbound Remote Desktop access to the internet, and keep management access narrow. Microsoft also warns that changing the network routes of a Cloud PC can break its connection to the Remote Desktop broker, so test changes with a pilot group before you apply them widely.

• Step 9: Monitor Sign-Ins and Detect Brute-Force Attacks

  Detection matters because prevention is never perfect. This step replaces our old brute-force post, and the biggest change is where attacks land. With no inbound Remote Desktop port exposed, guessing attacks against Cloud PCs show up as password attacks on user accounts, so identity logs come first.

  Start With Microsoft Entra

  Microsoft Entra smart lockout is on by default and works against attackers guessing passwords. Review the Entra sign-in logs for patterns such as many failures for one account, failures across many accounts from one address, and a success after a run of failures. If you hold Microsoft Entra ID P2, Identity Protection adds risk detections and lets you build risk-based Conditional Access policies that respond automatically.

  Add Microsoft Sentinel for Cloud PC Events

  Microsoft Sentinel, Microsoft’s cloud SIEM, is the right home for correlating sign-ins and device events. Its built-in anomaly detection includes attempted user account brute force and attempted computer brute force, which look for unusually high volumes of failed logins in Entra sign-in logs and Windows Security logs, as listed in Microsoft’s Sentinel anomalies reference. You can also write a scheduled analytics rule that looks for repeated failed logons, Windows Security event 4625, followed by a success, event 4624, within a short window.

  Use the Azure Monitor Agent, Not the Old Monitoring Agent

  The original version of this article told readers to install the Microsoft Monitoring Agent. Microsoft retired the Log Analytics agent on August 31, 2024, and the replacement is the Azure Monitor Agent, which uses data collection rules and the Windows Security Events via AMA connector in Sentinel. Deploy the agent to Cloud PCs through your usual software deployment method, such as Intune, and check Microsoft’s current guidance for Windows client devices.

  Turn Detections Into Action

  A detection nobody sees is worthless, so finish the job. Group related alerts into a single incident when the entities match, send the alert to the people who can act, and add an automated response where it is safe, such as forcing a password reset or requiring reauthentication. Then test the whole chain with a controlled simulation so you know it works before you need it. Finally, follow Microsoft’s advice to enable Service Health notifications for Windows 365, so you hear about service events as well as attacks.

• Step 10: Patch, Review, and Retest Regularly

  Security is a routine, not a project. Keep Windows and your applications updated, and remember that clients matter too: Windows App updates through Windows Update on Windows and through the App Store on Apple devices. Review Conditional Access policies, local admin exceptions, and redirection rules every quarter, remove accounts and licenses you no longer need, and test your recovery process so you know how a restore works before an incident.

What to Do When Something Goes Wrong

Even a well-configured environment will face an incident, and the first hour usually decides how bad it gets. Decide your response before you need it, and write it down.

• Cut off access first. To block a user immediately, disable their account and revoke their refresh tokens. Removing a Windows 365 license is not instant, because it starts a seven-day grace period before the Cloud PC is deprovisioned.
• Preserve evidence before you clean up. Windows 365 Enterprise includes a device action to place a Cloud PC under review, so it can be examined before it is reset. Check Microsoft’s current documentation for how it works in your edition.
• Recover the Cloud PC. Enterprise lets administrators reprovision a Cloud PC to its initial state, and restore points can roll a Cloud PC back to an earlier moment. Restoring or reprovisioning can erase recent unsaved work, so confirm where the user’s files live first.
• Reset credentials and review sign-ins. Force password resets or reauthentication, then check Entra sign-in logs for other accounts that saw the same pattern.
• Decide who communicates. Name who tells leadership, customers, and regulators, because notification duties can start sooner than people expect.

If You Only Have One Day

Perfect security is a long project, and most breaches exploit basics that were left undone. A single focused day can close the biggest gaps. Work through these in order.

• Morning: require MFA. Create the Conditional Access policy for the three Windows 365 apps in report-only mode, review it, and turn it on for a pilot group, then everyone.
• Late morning: check admin rights. List every user with local administrator rights on a Cloud PC and remove the ones nobody can justify.
• Afternoon: review redirections. Confirm clipboard, drive, USB, and printer redirection are still off, and enable only what specific roles need.
• End of day: switch on alerts. Enable Service Health notifications, confirm someone watches sign-in anomalies, and book a quarterly review.

Windows 365 Security Mistakes to Avoid

• Treating a Cloud PC as secure by default. The defaults are strong, but identity policy, administrator rights, and data controls are yours to configure.
• Protecting only one of the three apps. A Conditional Access policy that skips Azure Virtual Desktop or Windows Cloud Login leaves part of the sign-in path uncovered.
• Skipping report-only mode. Turning a policy on without testing can lock out administrators or break access for a whole team.
• Assuming Business can do everything Enterprise can. Baselines, policy management, and monitoring are not available in Business, so plan around that.
• Opening redirections for convenience. Turning on clipboard and drive redirection for everyone defeats one of the best default protections.
• Following old brute-force advice. Steps that depend on the retired Monitoring Agent, or on watching for inbound Remote Desktop attacks, no longer match how Cloud PCs are reached.
• Never testing detection. An alert rule that has never fired in a simulation is a guess, not a control.

The Bottom Line

Windows 365 gives you a strong starting point: hardware-backed protection, encryption at rest, redirections that are off by default, and a connection model that needs no inbound access. What it cannot do is decide who should get in, how much power each user should have, or what should be allowed to leave the session. Require MFA through Conditional Access on all three apps, keep users standard, baseline and monitor your Cloud PCs, watch your sign-in logs for password attacks, and review it all every quarter. Choose Enterprise when you need baselines and monitoring, and bring in a partner when you want the setup and the watching done for you.

Frequently Asked Questions

1. Is Windows 365 secure?

   Windows 365 is built with Zero Trust in mind and includes a virtual TPM, Secure Boot, encryption at rest, and redirections that are off by default. Overall security still depends on how you configure Conditional Access, device policies, administrator rights, and monitoring.

2. How do I secure Windows 365 Cloud PCs?

   Secure access with Conditional Access and MFA, secure the device with Intune, a security baseline, and Defender, keep users as standard users, limit data movement with redirection policies, encrypt and save data to the cloud, and monitor sign-ins for attacks.

3. How do I require MFA for Windows 365?

   Create a Microsoft Entra Conditional Access policy that targets the Windows 365, Azure Virtual Desktop, and Windows Cloud Login apps and requires multi-factor authentication. Test it in report-only mode first, and note that Windows 365 Business supports MFA only through Conditional Access.

4. Which apps should I target in a Conditional Access policy for Windows 365?

   Microsoft recommends targeting Windows 365, Azure Virtual Desktop, and Windows Cloud Login, and matching the policies across them. Windows Cloud Login is needed only when single sign-on is configured in a provisioning policy.

5. Are users local administrators on Windows 365 Cloud PCs?

   No, not by default. Both Windows 365 Business and Enterprise assign users the standard user role, and administrators can grant local admin rights to specific users or change the default.

6. Do I need Intune to secure Windows 365 Business?

   Windows 365 Business has no licensing prerequisites, so Intune is optional, but it is needed for features such as application deployment and some device management. Business does not support security baselines or policy management, so Enterprise suits organizations that need them.

7. Are clipboard and drive redirection allowed by default?

   No. Microsoft disables clipboard, drive, opaque low-level USB, and printer redirection for Cloud PCs by default. Administrators enable them with Intune settings or Group Policy according to organizational policy.

8. How do I apply security policies to new Cloud PCs automatically?

   Assign Intune policies to the Microsoft Entra groups that contain your Cloud PC users, or to a dynamic device group that captures Cloud PCs. New Cloud PCs then receive the baseline, Defender, and redirection settings as they enroll.

9. Does a Windows 365 Cloud PC expose Remote Desktop to the internet?

   No. The default connection uses reverse connect transport through a gateway, and Microsoft states that no inbound connectivity to the Cloud PC is required. Password attacks therefore tend to target user accounts instead of an open Remote Desktop port.

10. How can I detect brute-force attacks against Windows 365?

    Review Microsoft Entra sign-in logs, rely on smart lockout, and use Microsoft Sentinel to detect repeated failed logons followed by a success. Sentinel also includes anomaly detections for attempted user account and computer brute force.

11. Is the Microsoft Monitoring Agent still supported for Sentinel?

    No. Microsoft retired the Log Analytics agent on August 31, 2024. Use the Azure Monitor Agent with data collection rules and the Windows Security Events via AMA connector instead.

12. Does Windows 365 encrypt my data?

    Yes. Cloud PC data is encrypted at rest, and organizations that want to manage their own keys can use Microsoft Purview Customer Key with Windows 365. Keep important files in OneDrive or SharePoint as well, because a Cloud PC is not a backup.