Note: The Frontier Preview is a public preview. Future availability depends on its results and is subject to change.

Prerequisites at a Glance

Before diving into the configuration, make sure you have the following in place:

With these in place, let’s start configuring.

Step 1: Create Dynamic Entra ID Groups

To target the right Cloud PCs and users, we will create two dynamic groups in Entra ID. This ensures that any future 8 vCPU Cloud PCs and their users are automatically included.

W365-U-Frontier (Dynamic user group)

This group automatically contains all users that have a Windows 365 Enterprise 8 vCPU license assigned.

1. Navigate to Microsoft Entra admin center > Groups > All groups > New group.
2. Set the Group type to Security.
3. Set the Group name to W365-U-Frontier.
4. Set Membership type to Dynamic User.
5. Click Add dynamic query and enter the following rule:

(user.assignedPlans -any (assignedPlan.servicePlanId -eq "69dc175c-dcff-4757-8389-d19e76acb45d" -and assignedPlan.capabilityStatus -eq "Enabled"))

The service plan ID 69dc175c-dcff-4757-8389-d19e76acb45d corresponds to the CPC_E_8C_32GB_256GB SKU (Windows 365 Enterprise 8 vCPU, 32 GB, 256 GB).

1. Click Save and then Create.

W365-D-Frontier (Dynamic device group)

This group automatically contains all Cloud PC devices that match the 8 vCPU configuration. The deviceModel property in Entra ID follows the format Cloud PC Enterprise 8vCPU/<RAM>/<disk>, so we use a -startsWith operator to capture all variants (128 GB, 256 GB, 512 GB).

1. Navigate to Microsoft Entra admin center > Groups > All groups > New group.
2. Set the Group type to Security.
3. Set the Group name to W365-D-Frontier.
4. Set Membership type to Dynamic Device.
5. Click Add dynamic query and enter the following rule:

(device.deviceModel -startsWith "Cloud PC Enterprise 8vCPU")

1. Click Save and then Create.

Tip: Give the dynamic membership rules a few minutes to evaluate. You can check the membership under Groups > W365-D-Frontier > Members to confirm devices are populating.

Step 2: Configure the PowerShell Execution Policy

AI-enabled features require the RemoteSigned execution policy on the Cloud PC. Instead of configuring this manually on each device, deploy it through Intune.

1. Navigate to Microsoft Intune admin center > Devices > Configuration > Create > New Policy.
2. Select Windows 10 and later as the platform and Settings catalog as the profile type.
3. Name the policy DEV-CONF-W365-FRONTIER-EXECUTIONPOLICY.
4. Click Add settings and search for PowerShell.
5. Select Administrative Templates > Windows Components > Windows PowerShell and enable Turn on Script Execution.
6. Set Execution Policy to Allow only signed scripts (this is the RemoteSigned equivalent).

1. On the Assignments tab, assign to the W365-D-Frontier device group.
2. Click Create.

Step 3: Enable Features Introduced via Servicing

A Windows Update policy must be enabled so that features delivered through servicing updates are activated. This setting is not available in the Settings Catalog, so we deploy it as a custom configuration profile using OMA-URI.

1. Navigate to Microsoft Intune admin center > Devices > Configuration > Create > New Policy.
2. Select Windows 10 and later as the platform and Templates as the profile type, then select Custom.
3. Name the policy DEV-CONF-W365-FRONTIER-SERVICING.
4. Click Add under OMA-URI Settings and configure the following:

1. Click Save, then Next.
2. On the Assignments tab, assign to the W365-D-Frontier device group.
3. Click Create.

Step 4: Enable Optional Diagnostics Data

The Windows Insider Program requires optional diagnostics data to be enabled on Cloud PCs. Without it, the device will display “To join the Insider program, turn on optional diagnostics data” and cannot enroll in the Beta channel. Deploy this through a Settings Catalog policy.

1. Navigate to Microsoft Intune admin center > Devices > Configuration > Create > New Policy.
2. Select Windows 10 and later as the platform and Settings catalog as the profile type.
3. Name the policy DEV-CONF-W365-FRONTIER-DIAGNOSTICS.
4. Click Add settings and search for Allow Telemetry.
5. Select System > Allow Telemetry and set it to Full (this enables optional diagnostics data).

1. On the Assignments tab, assign to the W365-D-Frontier device group.
2. Click Create.

Step 5: Enroll Cloud PCs in the Windows Insider Beta Channel

The AI features require the Windows Insider Beta channel. Instead of having each user manually opt in, use an Intune Update Ring to handle this at scale.

1. Navigate to Microsoft Intune admin center > Devices > Windows updates > Update rings.
2. Click + Create profile.
3. Name it DEV-CONF-W365-FRONTIER-INSIDERBETA.
4. Under Update ring settings:
   • Set Enable pre-release builds to Enable.
   • Set Select pre-release channel to Beta Channel.
5. Leave the remaining settings at their defaults.

1. On the Assignments tab, assign to the W365-D-Frontier device group.
2. Click Create.

After the policy syncs, Cloud PCs will start receiving Beta channel updates. Make sure devices check for updates and restart.

Step 6: Assign AI-Enablement in Intune

With all prerequisites deployed, you can now flip the switch to enable AI features on the targeted Cloud PCs.

1. Navigate to Microsoft Intune admin center > Devices > Device onboarding > Windows 365.
2. Select the Settings tab.
3. Click Create and select Cloud PC configurations.
4. Enter a Name, for example USR-CONF-W365-FRONTIER-AIENABLEMENT.
5. On the Configuration settings tab, set AI-enabled features to Enable.

1. On the Assignments tab, assign to the W365-U-Frontier user group.
2. Proceed to Review + create and click Create.

Important: After AI-enablement is assigned, it can take up to 48 hours for the background processes to complete. During this time, the Cloud PCs are setting up the AI infrastructure locally.

Step 7: Apply Updates and Restart

Once the 48-hour enablement window has passed, updates need to be applied:

1. On the Cloud PC, open Settings > Windows Update.
2. Click Check for updates, install any pending updates, and restart.
3. Repeat this process 3-5 times until no more updates are pending.

This can also be managed at scale using Intune’s Windows Update for Business policies or by using Expedite updates to push things along.

Step 8: Validate the Deployment

After the updates have been applied, you can verify that AI features are active in several places.

Intune Admin Validation

Device Overview page: Navigate to Devices > select a Cloud PC > Overview. The Essentials tab will show an AI-enabled field.

Reports dashboard: Navigate to Reports > Windows 365 > Cloud PC overview. You will see a breakdown of AI-enabled Cloud PCs by status:

• Initiated – AI enablement is in progress
• Ready to use – Features are available
• Failed – Setup could not complete

End-User Validation

Windows App: AI-enabled Cloud PCs show an “AI-enabled” tag on the device card within the Windows App.

Windows Taskbar: The search box on the taskbar displays a magnifying glass with sparkles icon when AI features are active.

Note: After a Windows Update, the sparkles icon might temporarily disappear. If clicking the search box doesn’t restore it, check the AI-enabled Cloud PC Known Issues page.

What You Get: Supported Features

Once everything is set up, your Cloud PCs get access to the following Copilot+ features:

Improved Windows Search

Users can find files using descriptive, natural-language queries. The AI interprets intent and searches across local files and OneDrive. For example, searching “airplane” will surface a photo named Picture26.jpg that contains an airplane.

This works in both the Windows Search box on the taskbar and in File Explorer. It supports English, Chinese (Simplified), French, German, Japanese, and Spanish.

Click to Do

Press Win + Q or hold the Windows key while left-clicking an element on screen to get contextual actions on highlighted text or images. You can summarize text, look up information, or perform actions on images without switching apps.

Note: You must launch the Click to Do app once after AI-enablement and after every Cloud PC restart before the keyboard shortcuts work. Some intelligent text actions (like “Ask Microsoft 365 Copilot”) are not yet supported on Cloud PCs.

Managing and Removing AI Features

Granular Feature Control

If you want to keep AI-enablement but toggle individual features:

• Click to Do: Manage through Click to Do client management policies.
• Improved Windows Search: Use the Search Policy CSP settings in Intune.

Disabling AI-Enablement Entirely

There are two options:

1. Unassign the user from the Enable policy.
2. Create a Disable policy: Follow the same steps as Step 6, but set AI-enabled features to Disable and assign to the target group. The Disable policy takes precedence over Enable during conflict resolution.

After disabling, it can take up to 48 hours for the AI features to be removed from the Cloud PCs.

Privacy and Security

AI-enabled Cloud PCs follow the same Windows 365 privacy and data policies:

• Processing: AI features process data ephemerally using a secure Windows 365 cloud service. No personal or user data is stored in the cloud service or used for AI model training.
• Storage: All data and indexes are stored locally on the Cloud PC. This is unchanged from existing Windows AI features.
• Controls: AI features are off by default. The IT admin must explicitly enable them through the configuration steps described above.

Conclusion

With a few Intune policies and a couple of dynamic Entra ID groups, you can bring Copilot+ AI features to your Windows 365 8 vCPU fleet without touching a single Cloud PC. The key steps are:

1. Create dynamic groups to target the right users and devices.
2. Deploy execution policy and servicing feature policies.
3. Enable optional diagnostics data for Windows Insider enrollment.
4. Enroll devices in the Windows Insider Beta channel.
5. Enable AI features through a Cloud PC configuration.
6. Apply updates and validate.

For troubleshooting, check the AI-enabled Cloud PC Known Issues page. For the full Microsoft documentation, see AI-enabled Cloud PC (Frontier Preview) and Manage AI-enabled features.

Looking for more Windows 365 management tips? Check out Windows 365 Restore Points: A Guide to Long-Term Storage and Adding Language Packs Using Proactive Remediations.

Sources

• AI-enabled Cloud PC (Frontier Preview)
• Manage AI-enabled features on Cloud PCs
• AI-enabled Cloud PC Known Issues
• Product names and service plan identifiers for licensing

The post Enabling AI Frontier Capabilities on Windows 365 with Intune appeared first on Jens Du Four.

Overview of Windows 365 Restore Points

Using restore points in Windows 365 offers several advantages. Firstly, they provide a safety net for system recovery, ensuring that users can quickly restore their system to a working state in case of any issues.

Secondly, restore points help protect data by preserving user settings and installed applications. This means that even if a system crash occurs, users can recover their data without losing important information.

Additionally, restore points can be used to test new software or updates, allowing users to revert to a previous state if the changes cause problems.

How to adapt the automatic Windows 365 Restore Points in Microsoft Intune

By default Microsoft Intune will create several restore points for each and every Cloud PC.

The amount of restore points will never change and is two bi-weekly restore points and ten restore points you can adapt the recurrence of, this is done through a “User Setting”:

Once you are here, you can adapt the recurrence.

What about Storage Accounts?

Storage accounts play a crucial role in managing restore points for Windows 365. These provide a secure solution for storing large amounts of data, including your restore points.

By utilizing storage accounts, users can ensure that their restore points are safely stored and easily accessible when needed. One of the key benefits of using storage accounts is the ability to manage data efficiently, with options for redundancy and backup to protect against data loss.

Additionally, storage accounts offer flexibility, allowing users to configure permissions and access controls to suit their needs. To use storage accounts for restore points, users can integrate their Windows 365 environment with Azure, setting up containers and blobs to store the restore points securely.

This integration ensures that restore points are preserved long-term and can be retrieved quickly in case of system recovery needs.

Creating the right Azure Storage Account

There a few requirements to be met when creating a Storage Account for the Restore Points of the Cloud PC. They are listed below and we will go over the steps needed in Azure after these.

• Instance details
  • Region: Same region as Cloud PC is recommended because of performance. There is no restriction on which region you should choose.
  • Performance: Premium (supports hot access tier) or Standard (supports all access tiers).
  • Premium account type: Page blobs
• Security
  • Minimum TLS version: Version 1.2.
  • Confirm Allow blob anonymous access is disabled (the default).
  • Disable Enable storage account key access.
• Networking
  • Network access: Enable public access from all networks

Creating a manual Restore Point in Microsoft Intune

Once the Storage Account has been set up, you have the option to create a manual restore point in Microsoft Intune.

If this option is not visible, verify the requirements above as the Storage Account will not be visible if it does not meet these.

Conclusion

In summary, Windows 365 restore points are an essential feature. They provide a reliable way to recover from system issues, preserve user settings, and test new software or updates.

By creating and managing restore points effectively, users can safeguard their systems and minimize downtime.

Additionally, utilizing Azure Storage Accounts for long-term storage of restore points offers a scalable and secure solution for preserving these critical backups. I encourage everyone to take advantage of them in Windows 365 to enhance system management and data protection strategies.

If you want to further enhance your Windows 365 environment, check out Enabling AI Frontier Capabilities on Windows 365 with Intune or learn how to automate language packs in Adding Language Packs Using Proactive Remediations.

Sources

• Windows 365 documentation | Microsoft Learn
• Cloud PC restore points | Microsoft Learn
• Azure Storage Accounts | Microsoft Learn
• Access tiers for blob data | Microsoft Learn

The post Windows 365 Restore Points: A Guide to Long-Term Storage appeared first on Jens Du Four.