Setting up a new device for a developer usually means installing tools, cloning repositories, and applying configurations, all in a specific order. Microsoft Intune handles app and script deployment well, but it does not guarantee execution order. A Git install that finishes after the script that clones your repos is a problem.

Nerdio Scripted Sequences solve this. Introduced in Nerdio Manager for Enterprise (NME), Scripted Sequences let you define complex, multi-step task workflows with a guaranteed order of operations. They target Intune-managed devices, including Windows 365 Cloud PCs, and execute tasks sequentially through the Nerdio Endpoint Worker.

In this post we will build a real-world developer workstation onboarding sequence that installs Git, Visual Studio Code, clones team repositories, and confirms completion, all in the right order, every time.

Note: Scripted Sequences are in Public Preview. Feature scope and limitations may change in future NME releases.

What Are Scripted Sequences?

Scripted Sequences are an automation feature in NME that lets you create multi-step task workflows deployed to Intune-managed devices. Think of them as a lightweight task sequencer built into the Nerdio console.

Key characteristics:

Sequences respect the defined order of operations: Task 2 will not start until Task 1 completes successfully. Tasks can be grouped into Task Groups for logical organization. You can clone sequences, groups, and individual tasks for faster iteration.

Prerequisites

Before building your first sequence, make sure you have:

The Demo Scenario

We will automate day-one setup for a developer joining the team. The sequence installs prerequisites first, then tools, then runs a configuration script, in that exact order.

Let’s build it.

Step 1: Enable the Intune Integration

Before you can use Scripted Sequences, the Intune integration must be enabled. This is where NME connects to your Intune tenant.

1. Navigate to NME > Settings > Environment > Integrations > Intune.
2. Ensure the Intune integration is enabled.

Note: The initial Endpoint Worker deployment is controlled by Intune platform script delivery and may take some time. Subsequent tasks to the same device execute within a 15 to 30 minute window.

Step 2: Configure Task Automation

Task Automation must be configured before you can create or run Scripted Sequences.

1. Navigate to NME > Settings > Nerdio Environment > Task Automation.
2. Click Configure.
3. Enter a name and select a resource group for the Azure storage account that Nerdio Manager will create.
4. Click Save to complete the configuration.

Warning: If your NME deployment uses the Enable Private Endpoints scripted action, the storage account created here may have public network access disabled by default. The Nerdio Endpoint Worker on target devices needs to reach this storage account, so verify that public access is enabled or that a private endpoint is configured for it.

Step 3: Create the Scripted Sequence

1. Navigate to NME > Automation > Scripted Sequences.
2. Click New Scripted Sequence.
3. Name the sequence Developer Onboarding - Day One.
4. Optionally add a description: Installs developer tools and configures the workstation on first login.

Step 4: Add a Task Group

Task Groups let you organize related tasks. We will create one group for this sequence.

1. Inside the sequence, click Add task or Add group.
2. Select Add group.
3. Name the group Developer Tooling.

Note: A group must contain at least one task.

Step 5: Define the Tasks

Add the following six tasks inside the Developer Tooling group. The order you add them is the order they will execute.

Task 1: Set PowerShell Execution Policy

This ensures all subsequent PowerShell-based tasks can run.

• Task name: Set Execution Policy
• Type: PowerShell script
• Script:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force

Task 2: Install Git

This task uses a PowerShell script to install Git via winget. You could also use the Install Application task type instead.

• Task name: Install Git
• Type: PowerShell script
• Script:

winget install --id Git.Git --accept-source-agreements --accept-package-agreements --silent

Task 3: Install Visual Studio Code

This task uses the Install Application task type, which lets you select a winget package directly without writing a script. You could also use a PowerShell script as shown in Task 2.

• Task name: Install Visual Studio Code
• Type: Install Application
• Winget package ID: Microsoft.VisualStudioCode

Task 4: Clone Repos and Configure VS Code

This script clones the team repository and installs essential VS Code extensions. Adjust the repository URL and extension list to match your environment.

• Task name: Configure Workstation
• Type: PowerShell script
• Script:

# Refresh PATH so git and code are available
$env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")

# Clone team repository
$repoPath = "$env:USERPROFILE\Source\Repos"
New-Item -ItemType Directory -Path $repoPath -Force | Out-Null
git clone https://dev.azure.com/contoso/project/_git/main-repo "$repoPath\main-repo"

# Install VS Code extensions
code --install-extension ms-vscode.powershell
code --install-extension ms-python.python
code --install-extension hashicorp.terraform

Task 5a: Add Registry Key

First, create the registry key that will hold the completion marker.

• Task name: Log Completion
• Action: Add Registry Key
• Key path: HKLM\SOFTWARE\LeafIT\NerdioSequences

Task 5b: Set Registry Value

Next, set a value under the key to confirm the sequence completed. This makes it easy to query device status remotely via Intune or PowerShell.

• Task name: Log Completion clone
• Action: Set Registry Value
• Key path: HKLM\SOFTWARE\LeafIT\NerdioSequences
• Name: DeveloperOnboarding
• Value type: String
• Value: Completed

Step 6: Clone Tasks for Quick Iteration

Need a second sequence for designers with different tools? Since NME v7.6.0, you can clone the entire sequence or individual task groups and tasks.

1. On the Scripted Sequences page, select the Developer Onboarding - Day One sequence.
2. Click Clone.
3. Rename the cloned sequence and swap Git/VS Code for the tools your designers need.

This saves significant time compared to rebuilding sequences from scratch.

Step 7: Target Devices and Execute

1. On the Scripted Sequences page, click the three dots to the right of the Developer Onboarding - Day One sequence.
2. Click Run now.
3. Select the target Windows 365 Cloud PC or Intune device.

NME will push the tasks to the Nerdio Endpoint Worker on the device. Each task runs in order. Task 2 only starts after Task 1 reports success.

Tip: Monitor progress in NME > Logs.

Step 8: Validate on the Device

Log into the target Cloud PC and verify:

1. Git is installed. Open a terminal and run git --version.
2. VS Code is installed. Launch it from the Start menu.
3. Repos are cloned. Check %USERPROFILE%\Source\Repos\main-repo.
4. Extensions are present. Open VS Code and navigate to the Extensions panel.
5. Registry key exists. Open a terminal and run reg query "HKLM\SOFTWARE\LeafIT\NerdioSequences" /v DeveloperOnboarding.

Current Limitations

Scripted Sequences are still in Public Preview. Keep these constraints in mind:

Conclusion

Nerdio Scripted Sequences bring deterministic, ordered task execution to Intune-managed devices. This is something native Intune cannot guarantee today. By combining simple PowerShell scripts in a defined sequence, you can automate complex onboarding workflows and ensure every new device is configured consistently.

As the feature moves toward general availability, expect expanded scope and deeper integration within NME. For now, it is already a practical tool for any organization managing Intune endpoints at scale.

The post Automating New Device Setup with Nerdio Scripted Sequences appeared first on Jens Du Four.

Note: The Frontier Preview is a public preview. Future availability depends on its results and is subject to change.

Prerequisites at a Glance

Before diving into the configuration, make sure you have the following in place:

With these in place, let’s start configuring.

Step 1: Create Dynamic Entra ID Groups

To target the right Cloud PCs and users, we will create two dynamic groups in Entra ID. This ensures that any future 8 vCPU Cloud PCs and their users are automatically included.

W365-U-Frontier (Dynamic user group)

This group automatically contains all users that have a Windows 365 Enterprise 8 vCPU license assigned.

1. Navigate to Microsoft Entra admin center > Groups > All groups > New group.
2. Set the Group type to Security.
3. Set the Group name to W365-U-Frontier.
4. Set Membership type to Dynamic User.
5. Click Add dynamic query and enter the following rule:

(user.assignedPlans -any (assignedPlan.servicePlanId -eq "69dc175c-dcff-4757-8389-d19e76acb45d" -and assignedPlan.capabilityStatus -eq "Enabled"))

The service plan ID 69dc175c-dcff-4757-8389-d19e76acb45d corresponds to the CPC_E_8C_32GB_256GB SKU (Windows 365 Enterprise 8 vCPU, 32 GB, 256 GB).

1. Click Save and then Create.

W365-D-Frontier (Dynamic device group)

This group automatically contains all Cloud PC devices that match the 8 vCPU configuration. The deviceModel property in Entra ID follows the format Cloud PC Enterprise 8vCPU/<RAM>/<disk>, so we use a -startsWith operator to capture all variants (128 GB, 256 GB, 512 GB).

1. Navigate to Microsoft Entra admin center > Groups > All groups > New group.
2. Set the Group type to Security.
3. Set the Group name to W365-D-Frontier.
4. Set Membership type to Dynamic Device.
5. Click Add dynamic query and enter the following rule:

(device.deviceModel -startsWith "Cloud PC Enterprise 8vCPU")

1. Click Save and then Create.

Tip: Give the dynamic membership rules a few minutes to evaluate. You can check the membership under Groups > W365-D-Frontier > Members to confirm devices are populating.

Step 2: Configure the PowerShell Execution Policy

AI-enabled features require the RemoteSigned execution policy on the Cloud PC. Instead of configuring this manually on each device, deploy it through Intune.

1. Navigate to Microsoft Intune admin center > Devices > Configuration > Create > New Policy.
2. Select Windows 10 and later as the platform and Settings catalog as the profile type.
3. Name the policy DEV-CONF-W365-FRONTIER-EXECUTIONPOLICY.
4. Click Add settings and search for PowerShell.
5. Select Administrative Templates > Windows Components > Windows PowerShell and enable Turn on Script Execution.
6. Set Execution Policy to Allow only signed scripts (this is the RemoteSigned equivalent).

1. On the Assignments tab, assign to the W365-D-Frontier device group.
2. Click Create.

Step 3: Enable Features Introduced via Servicing

A Windows Update policy must be enabled so that features delivered through servicing updates are activated. This setting is not available in the Settings Catalog, so we deploy it as a custom configuration profile using OMA-URI.

1. Navigate to Microsoft Intune admin center > Devices > Configuration > Create > New Policy.
2. Select Windows 10 and later as the platform and Templates as the profile type, then select Custom.
3. Name the policy DEV-CONF-W365-FRONTIER-SERVICING.
4. Click Add under OMA-URI Settings and configure the following:

1. Click Save, then Next.
2. On the Assignments tab, assign to the W365-D-Frontier device group.
3. Click Create.

Step 4: Enable Optional Diagnostics Data

The Windows Insider Program requires optional diagnostics data to be enabled on Cloud PCs. Without it, the device will display “To join the Insider program, turn on optional diagnostics data” and cannot enroll in the Beta channel. Deploy this through a Settings Catalog policy.

1. Navigate to Microsoft Intune admin center > Devices > Configuration > Create > New Policy.
2. Select Windows 10 and later as the platform and Settings catalog as the profile type.
3. Name the policy DEV-CONF-W365-FRONTIER-DIAGNOSTICS.
4. Click Add settings and search for Allow Telemetry.
5. Select System > Allow Telemetry and set it to Full (this enables optional diagnostics data).

1. On the Assignments tab, assign to the W365-D-Frontier device group.
2. Click Create.

Step 5: Enroll Cloud PCs in the Windows Insider Beta Channel

The AI features require the Windows Insider Beta channel. Instead of having each user manually opt in, use an Intune Update Ring to handle this at scale.

1. Navigate to Microsoft Intune admin center > Devices > Windows updates > Update rings.
2. Click + Create profile.
3. Name it DEV-CONF-W365-FRONTIER-INSIDERBETA.
4. Under Update ring settings:
   • Set Enable pre-release builds to Enable.
   • Set Select pre-release channel to Beta Channel.
5. Leave the remaining settings at their defaults.

1. On the Assignments tab, assign to the W365-D-Frontier device group.
2. Click Create.

After the policy syncs, Cloud PCs will start receiving Beta channel updates. Make sure devices check for updates and restart.

Step 6: Assign AI-Enablement in Intune

With all prerequisites deployed, you can now flip the switch to enable AI features on the targeted Cloud PCs.

1. Navigate to Microsoft Intune admin center > Devices > Device onboarding > Windows 365.
2. Select the Settings tab.
3. Click Create and select Cloud PC configurations.
4. Enter a Name, for example USR-CONF-W365-FRONTIER-AIENABLEMENT.
5. On the Configuration settings tab, set AI-enabled features to Enable.

1. On the Assignments tab, assign to the W365-U-Frontier user group.
2. Proceed to Review + create and click Create.

Important: After AI-enablement is assigned, it can take up to 48 hours for the background processes to complete. During this time, the Cloud PCs are setting up the AI infrastructure locally.

Step 7: Apply Updates and Restart

Once the 48-hour enablement window has passed, updates need to be applied:

1. On the Cloud PC, open Settings > Windows Update.
2. Click Check for updates, install any pending updates, and restart.
3. Repeat this process 3-5 times until no more updates are pending.

This can also be managed at scale using Intune’s Windows Update for Business policies or by using Expedite updates to push things along.

Step 8: Validate the Deployment

After the updates have been applied, you can verify that AI features are active in several places.

Intune Admin Validation

Device Overview page: Navigate to Devices > select a Cloud PC > Overview. The Essentials tab will show an AI-enabled field.

Reports dashboard: Navigate to Reports > Windows 365 > Cloud PC overview. You will see a breakdown of AI-enabled Cloud PCs by status:

• Initiated – AI enablement is in progress
• Ready to use – Features are available
• Failed – Setup could not complete

End-User Validation

Windows App: AI-enabled Cloud PCs show an “AI-enabled” tag on the device card within the Windows App.

Windows Taskbar: The search box on the taskbar displays a magnifying glass with sparkles icon when AI features are active.

Note: After a Windows Update, the sparkles icon might temporarily disappear. If clicking the search box doesn’t restore it, check the AI-enabled Cloud PC Known Issues page.

What You Get: Supported Features

Once everything is set up, your Cloud PCs get access to the following Copilot+ features:

Improved Windows Search

Users can find files using descriptive, natural-language queries. The AI interprets intent and searches across local files and OneDrive. For example, searching “airplane” will surface a photo named Picture26.jpg that contains an airplane.

This works in both the Windows Search box on the taskbar and in File Explorer. It supports English, Chinese (Simplified), French, German, Japanese, and Spanish.

Click to Do

Press Win + Q or hold the Windows key while left-clicking an element on screen to get contextual actions on highlighted text or images. You can summarize text, look up information, or perform actions on images without switching apps.

Note: You must launch the Click to Do app once after AI-enablement and after every Cloud PC restart before the keyboard shortcuts work. Some intelligent text actions (like “Ask Microsoft 365 Copilot”) are not yet supported on Cloud PCs.

Managing and Removing AI Features

Granular Feature Control

If you want to keep AI-enablement but toggle individual features:

• Click to Do: Manage through Click to Do client management policies.
• Improved Windows Search: Use the Search Policy CSP settings in Intune.

Disabling AI-Enablement Entirely

There are two options:

1. Unassign the user from the Enable policy.
2. Create a Disable policy: Follow the same steps as Step 6, but set AI-enabled features to Disable and assign to the target group. The Disable policy takes precedence over Enable during conflict resolution.

After disabling, it can take up to 48 hours for the AI features to be removed from the Cloud PCs.

Privacy and Security

AI-enabled Cloud PCs follow the same Windows 365 privacy and data policies:

• Processing: AI features process data ephemerally using a secure Windows 365 cloud service. No personal or user data is stored in the cloud service or used for AI model training.
• Storage: All data and indexes are stored locally on the Cloud PC. This is unchanged from existing Windows AI features.
• Controls: AI features are off by default. The IT admin must explicitly enable them through the configuration steps described above.

Conclusion

With a few Intune policies and a couple of dynamic Entra ID groups, you can bring Copilot+ AI features to your Windows 365 8 vCPU fleet without touching a single Cloud PC. The key steps are:

1. Create dynamic groups to target the right users and devices.
2. Deploy execution policy and servicing feature policies.
3. Enable optional diagnostics data for Windows Insider enrollment.
4. Enroll devices in the Windows Insider Beta channel.
5. Enable AI features through a Cloud PC configuration.
6. Apply updates and validate.

For troubleshooting, check the AI-enabled Cloud PC Known Issues page. For the full Microsoft documentation, see AI-enabled Cloud PC (Frontier Preview) and Manage AI-enabled features.

Looking for more Windows 365 management tips? Check out Windows 365 Restore Points: A Guide to Long-Term Storage and Adding Language Packs Using Proactive Remediations.

Sources

• AI-enabled Cloud PC (Frontier Preview)
• Manage AI-enabled features on Cloud PCs
• AI-enabled Cloud PC Known Issues
• Product names and service plan identifiers for licensing

The post Enabling AI Frontier Capabilities on Windows 365 with Intune appeared first on Jens Du Four.

Overview of Windows 365 Restore Points

Using restore points in Windows 365 offers several advantages. Firstly, they provide a safety net for system recovery, ensuring that users can quickly restore their system to a working state in case of any issues.

Secondly, restore points help protect data by preserving user settings and installed applications. This means that even if a system crash occurs, users can recover their data without losing important information.

Additionally, restore points can be used to test new software or updates, allowing users to revert to a previous state if the changes cause problems.

How to adapt the automatic Windows 365 Restore Points in Microsoft Intune

By default Microsoft Intune will create several restore points for each and every Cloud PC.

The amount of restore points will never change and is two bi-weekly restore points and ten restore points you can adapt the recurrence of, this is done through a “User Setting”:

Once you are here, you can adapt the recurrence.

What about Storage Accounts?

Storage accounts play a crucial role in managing restore points for Windows 365. These provide a secure solution for storing large amounts of data, including your restore points.

By utilizing storage accounts, users can ensure that their restore points are safely stored and easily accessible when needed. One of the key benefits of using storage accounts is the ability to manage data efficiently, with options for redundancy and backup to protect against data loss.

Additionally, storage accounts offer flexibility, allowing users to configure permissions and access controls to suit their needs. To use storage accounts for restore points, users can integrate their Windows 365 environment with Azure, setting up containers and blobs to store the restore points securely.

This integration ensures that restore points are preserved long-term and can be retrieved quickly in case of system recovery needs.

Creating the right Azure Storage Account

There a few requirements to be met when creating a Storage Account for the Restore Points of the Cloud PC. They are listed below and we will go over the steps needed in Azure after these.

• Instance details
  • Region: Same region as Cloud PC is recommended because of performance. There is no restriction on which region you should choose.
  • Performance: Premium (supports hot access tier) or Standard (supports all access tiers).
  • Premium account type: Page blobs
• Security
  • Minimum TLS version: Version 1.2.
  • Confirm Allow blob anonymous access is disabled (the default).
  • Disable Enable storage account key access.
• Networking
  • Network access: Enable public access from all networks

Creating a manual Restore Point in Microsoft Intune

Once the Storage Account has been set up, you have the option to create a manual restore point in Microsoft Intune.

If this option is not visible, verify the requirements above as the Storage Account will not be visible if it does not meet these.

Conclusion

In summary, Windows 365 restore points are an essential feature. They provide a reliable way to recover from system issues, preserve user settings, and test new software or updates.

By creating and managing restore points effectively, users can safeguard their systems and minimize downtime.

Additionally, utilizing Azure Storage Accounts for long-term storage of restore points offers a scalable and secure solution for preserving these critical backups. I encourage everyone to take advantage of them in Windows 365 to enhance system management and data protection strategies.

If you want to further enhance your Windows 365 environment, check out Enabling AI Frontier Capabilities on Windows 365 with Intune or learn how to automate language packs in Adding Language Packs Using Proactive Remediations.

Sources

• Windows 365 documentation | Microsoft Learn
• Cloud PC restore points | Microsoft Learn
• Azure Storage Accounts | Microsoft Learn
• Access tiers for blob data | Microsoft Learn

The post Windows 365 Restore Points: A Guide to Long-Term Storage appeared first on Jens Du Four.