Windows 365 Enterprise known issues

This page's changes and edits · All guidance changes

Microsoft's edit · 21 Aug 15:38 UTC

OOB | Req pub live date = 8/21/2026 03:00 PT | Add Administrator protection known issue for Windows 365 Cloud PCs (#12084)

Microsoft's commit message in MicrosoftDocs/SupportArticles-docs · commit 2ac297e · +62 ~~−47~~ lines · also on GitHub

11 ---

22 title: Windows 365 Enterprise and Windows 365 Flex Known issues

3 −description: Learn about known issues for Windows 365 Enterprise and Windows 365 Flex.

3 +description: "Learn about known issues for Windows 365 Enterprise and Windows 365 Flex. This information helps you quickly troubleshoot and resolve Cloud PC issues."

44 manager: dcscontentpm

5 −ms.date: 05/05/2026

5 +ms.date: 08/21/2026

66 ms.topic: troubleshooting

7 −ms.reviewer: kaushika, msft-jasonparker, stulimat, scottduf

7 +ms.reviewer: kaushika, japarker, stulimat, scottduf

8 +ai-usage: ai-assisted

89 ms.custom:

910 - pcy:WinComm User Experience

1011 - sap:Onboarding issues

⋯ 4 unchanged lines

1516

1617 # Windows 365 Enterprise and Windows 365 Flex known issues

1718

18 −The following items are known issues for Windows 365 Enterprise and Windows 365 Flex.

19 +## Summary

1920

21 +The following items are known issues for Windows 365 Enterprise and Windows 365 Flex. This article describes causes and solutions for these issues, and provides links to resources that provide more information.

22 +

2023 ## First-time Cloud PC sign-in triggers an impossible travel location alert

2124

2225 When you use Conditional Access, a user who signs in to a Cloud PC for the first time might trigger an impossible travel location alert.

⋯ 23 unchanged lines

4649 Find and manage the Cloud PC in Microsoft Intune by using the unchanged Intune device name, either through the **Devices** > **All devices** list or the **Devices** > **Windows 365** > **All Cloud PCs** list.

4750

4851 ## Windows 365 provisioning fails

49 −

50 − Windows 365 provisioning might fail if the Desired State Configuration (DSC) extension is used and the PowerShell

51 − execution policy is set to **AllSigned** through Group Policy.

52 −

53 − Windows 365 sets the PowerShell execution policy to `RemoteSigned` at the `LocalMachine` scope during provisioning.

54 − This policy allows locally created scripts and scripts run through the Custom Script Extension (CSE), while requiring

55 − downloaded scripts to be digitally signed. If a customer-configured GPO sets the execution policy to `AllSigned` at the

56 − `MachinePolicy` scope, it overrides the default configuration and blocks unsigned scripts.

57 −

58 − You might see either of the following errors:

59 −

60 − - **Custom Script Extension authorization manager validation failed.** Script execution was blocked by an authorization

61 − manager validation failure in the Custom Script Extension.

62 − - "An internal error occurred. The virtual machine deployment timed out."

63 −

64 − ### Solution

65 −

66 − 1. Ensure that the execution policy and App Control for Business policies allow required scripts to run.

67 − 1. Review any applied GPOs that set the PowerShell execution policy to **AllSigned**.

68 − 1. Remove the GPO or change the policy to **RemoteSigned**.

69 − 1. Retry the ANC health check. If the check succeeds, retry provisioning.

70 −

52 +

53 +Windows 365 provisioning might fail if the Desired State Configuration (DSC) extension is used and the PowerShell execution policy is set to **AllSigned** through Group Policy.

54 +

55 +Windows 365 sets the PowerShell execution policy to `RemoteSigned` at the `LocalMachine` scope during provisioning. This policy allows locally created scripts and scripts run through the Custom Script Extension (CSE), while requiring downloaded scripts to be digitally signed. If a customer-configured GPO sets the execution policy to `AllSigned` at the `MachinePolicy` scope, it overrides the default configuration and blocks unsigned scripts.

56 +

57 +You might see either of the following errors:

58 +

59 +- **Custom Script Extension authorization manager validation failed.** Script execution was blocked by an authorization

60 +manager validation failure in the Custom Script Extension.

61 +- "An internal error occurred. The virtual machine deployment timed out."

62 +

63 +### Solution

64 +

65 +1. Ensure that the execution policy and App Control for Business policies allow required scripts to run.

66 +1. Review any applied GPOs that set the PowerShell execution policy to **AllSigned**.

67 +1. Remove the GPO or change the policy to **RemoteSigned**.

68 +1. Retry the ANC health check. If the check succeeds, retry provisioning.

69 +

7170 ## Cloud PC reports as not compliant with the compliance policy

7271

7372 The following device compliance settings report as **Not applicable** when being evaluated for a Cloud PC:

⋯ 8 unchanged lines

8281

8382 ### Solution

8483

85 −To enable secure boot on the Cloud PC, reprovision the specific Cloud PC. for more information, see see [Reprovision a Cloud PC](/windows-365/enterprise/reprovision-cloud-pc)

84 +To enable secure boot on the Cloud PC, reprovision the specific Cloud PC. For more information, see see [Reprovision a Cloud PC](/windows-365/enterprise/reprovision-cloud-pc).

8685

8786 To remove the "not compliant" settings:

8887

⋯ 1 unchanged line

9089 1. For any existing device compliance policies that both evaluate to a Cloud PC and contain either of the **Not Compliant** settings, use this new filter to exclude Cloud PCs from the policy assignment.

9190 1. Create a new device compliance policy without either of the **Not Compliant** settings and use this new filter to include Cloud PCs for the policy assignment.

9291

92 +## Administrator protection isn't supported on Cloud PCs

93 +

94 +Windows 365 Cloud PCs don't support Administrator protection. If a policy that enables it is assigned to your Cloud PCs, users might see an unexpected authentication prompt when signing in, extra approval prompts for tasks that require elevation, and elevation failures.

95 +

96 +The sign-in prompt affects all users. The elevation prompts and failures affect users who have local administrator rights. By default, users aren't administrators of their Cloud PCs.

97 +

98 +### Solution

99 +

100 +If Administrator protection is already enabled on your Cloud PCs, set **User Account Control: Configure type of Admin Approval Mode** to **Legacy Admin Approval Mode** in the policy that's assigned to them, then restart the Cloud PCs. This setting is in the Intune settings catalog under **Local Policies Security Options**.

101 +

102 +To prevent Administrator protection from being applied to Cloud PCs:

103 +

104 +1. [Create a filter for all Cloud PCs](/windows-365/enterprise/create-filter#create-a-filter-for-all-cloud-pcs).

105 +1. Use the filter to exclude Cloud PCs from any policy that enables Administrator protection.

106 +

107 +For more information, see [Administrator protection](/windows/security/application-security/application-control/administrator-protection/).

108 +

93109 ## Single sign-on users see a dialog to allow remote desktop connection during the connection attempt

94110

95111 When you enable single sign-on, users see a prompt to authenticate to Microsoft Entra ID and allow the Remote Desktop connection when launching a connection to a new Cloud PC. Microsoft Entra remembers up to 15 devices for 30 days before prompting again. To connect, users select **Yes** in this dialog.

⋯ 14 unchanged lines

110126

111127 ## When a Cloud PC locks, it immediately disconnects single sign-on users

112128

113 −When single sign-on isn't used, users can see the Cloud PC lock screen and enter credentials to unlock their Windows session. However, when single sign-on is used, the Cloud PC fully disconnects the session to enable the following capabilities:

129 +When users don't use single sign-on, they can see the Cloud PC lock screen and enter credentials to unlock their Windows session. However, when users use single sign-on, the Cloud PC fully disconnects the session to enable the following capabilities:

114130

115131 - Users can use passwordless authentication to unlock their Cloud PC.

116 −- Conditional Access policies and multifactor authentication can be enforced when unlocking the Cloud PC.

132 +- You can enforce Conditional Access policies and multifactor authentication when unlocking the Cloud PC.

117133

118134 <a name='single-sign-on-users-arent-asked-to-reauthenticate-to-azure-ad-when-connecting-from-an-unmanaged-device---35593334--'></a>

119135

120136 ## When single sign-on users connect from an unmanaged device, they aren't asked to reauthenticate to Microsoft Entra ID

121137

122 −When you use single sign-on, all authentication behavior (including supported credential types and sign-in frequency) is driven through Microsoft Entra ID.

138 +When you use single sign-on, Microsoft Entra ID drives all authentication behavior, including supported credential types and sign-in frequency.

123139

124140 ### Solution

125141

126 −To enforce periodic reauthentication through Microsoft Entra ID, create a Conditional Access policy using the [sign-in frequency control](/windows-365/enterprise/set-conditional-access-policies#configure-sign-in-frequency).

142 +To enforce periodic reauthentication through Microsoft Entra ID, create a Conditional Access policy by using the [sign-in frequency control](/windows-365/enterprise/set-conditional-access-policies#configure-sign-in-frequency).

127143

128 −## I don't see the Cloud PC reports on the Devices > Overview page in the Intune admin center

144 +## I don't see the Cloud PC reports on the **Devices** > **Overview** page in the Intune admin center

129145

130 −If you turn on the **Use Devices preview** setting in the Intune admin center, the **Cloud PC performance (preview)** tab, **Cloud PCs with connection quality issues** report, and **Cloud PCs with low utilization** report aren't on the **Overview** page.

146 +If you turn on the **Use Devices preview** setting in the Intune admin center, the **Cloud PC performance (preview)** tab, **Cloud PCs with connection quality issues** report, and **Cloud PCs with low utilization** report don't appear on the **Overview** page.

131147

132148 ### Solution

133149

⋯ 102 unchanged lines

236252 - **Enable screen capture protection** = **Enable**

237253 - **Screen Capture Protection Options** = **Block screen capture on client and server**

238254

239 −## Windows 365 role assignments do not support device groups as scope groups

255 +## Windows 365 role assignments don't support device groups as scope groups

240256

241 −Windows 365 role assignments do not support adding device group as a part of scope groups. It only supports user groups.

257 +Windows 365 role assignments don't support adding device groups as part of scope groups. They only support user groups.

242258

243259 ### Solution

244260

245 −Make sure to add the right user groups within the administrator's role assignment. For devices that do not have associated users (Frontline in shared mode devices or CloudApps), the scope group check is skipped.

261 +Add the correct user groups within the administrator's role assignment. For devices that don't have associated users (Frontline in shared mode devices or CloudApps), the scope group check is skipped.

246262

247263 ## Windows 365 scope tags and nested groups

248264

⋯ 5 unchanged lines

254270

255271 ## Windows 365 doesn't support editing scope tags for individual Cloud PCs

256272

257 −The Windows 365 user interface and Graph API don't support the editing of scope tags for individual Cloud PCs.

273 +The Windows 365 user interface and Graph API don't support editing scope tags for individual Cloud PCs.

258274

259275 ### Solution

260276

⋯ 13 unchanged lines

274290

275291 The May 21, 2024 updates for Cloud PC gallery images lack the WebRTC Redirector Service. Without this component, Teams media redirection doesn't work.

276292

277 −This applies to the following gallery images:

293 +This condition applies to the following gallery images:

278294

279295 - Windows 11 23H2 with Microsoft 365 apps

280296 - Windows 11 22H2 with Microsoft 365 apps

281297

282298 ### Troubleshooting steps

283299

284 −For newly provisioned Cloud PCs, verify that WebRTC is available. If it's not, you can use either of the following options:

300 +For newly provisioned Cloud PCs, verify that WebRTC is available. If it's not, use either of the following options:

285301

286302 - To add the WebRTC Redirector Service app to the list of apps to install by default onto Cloud PCs, follow the steps in [Add Microsoft 365 Apps to Windows 10/11 devices with Microsoft Intune](/mem/intune/apps/apps-add-office365).

287303

⋯ 5 unchanged lines

293309

294310 ### Users can't access Windows 365 Flex Cloud PCs that are in shared mode

295311

296 −When Windows 365 Flex Cloud PCs in shared mode are assigned to a Microsoft Entra ID group that has more than 10,000 members, some users might not receive access and don't see the Cloud PC cards in the Windows app client.

312 +When you assign Windows 365 Flex Cloud PCs in shared mode to a Microsoft Entra ID group that has more than 10,000 members, some users might not receive access and don't see the Cloud PC cards in the Windows app client.

297313

298314 #### Solution

299315

⋯ 10 unchanged lines

310326 1. Go to **Microsoft Intune admin center** > **Devices** > **Windows 365**.

311327 1. Select **Provisioning policies**.

312328 1. Select the affected provisioning policy.

313 −1. To reset the deployment state, elect **Reprovision**.

329 +To reset the deployment state, select **Reprovision**.

314330 1. After the reprovisioning process completes, you can adjust the Cloud PC count as needed.

315331

316332 ### Scheduled reprovisioning doesn't recover after license changes

⋯ 6 unchanged lines

323339

324340 1. **Remove the provisioning policy assignment:**

325341 1. Go to the affected provisioning policy.

326 − 1. Go to the **Assignments** tab, and the remove all group assignments.

327 −

342 + 1. Go to the **Assignments** tab, and then remove all group assignments.

328343

329344 1. **Re-add the assignment:**

330345 1. Wait 5-10 minutes for the removal to process.

⋯ 11 unchanged lines

342357

343358 ### Autopilot Device Preparation (DPP) initially shows as failed if timeout limit is reached

344359

345 −After you create the provisioning policy, you receive the `DevicePreparationProfileTimeout` error code. This means that the Cloud PC provisioning process reached the initial DPP timeout but hasn't successfully applied Autopilot Device Preparation.

360 +After you create the provisioning policy, you receive the `DevicePreparationProfileTimeout` error code. This error code means that the Cloud PC provisioning process reached the initial DPP timeout but didn't successfully apply Autopilot Device Preparation.

346361

347362 #### Solution

348363

⋯ 7 unchanged lines

356371

357372 Wait for the process to continue. Cloud PC serial numbers can take up to 30 minutes to appear in the status information.

358373

359 −### Windows Autopilot Device Preparation is not currently supported for Citrix Cloud PCs

374 +### Windows Autopilot Device Preparation isn't currently supported for Citrix Cloud PCs

360375

361 −Device preparation policies (DPP) aren't supported for Cloud PCs that are configured to use Citrix integration. If you assign a device preparation policy to a provisioning policy that’s used for Citrix Cloud PCs, the policy won't be applied during Cloud PC provisioning.

376 +Device preparation policies (DPP) aren't supported for Cloud PCs that are configured to use Citrix integration. If you assign a device preparation policy to a provisioning policy that's used for Citrix Cloud PCs, the policy won't be applied during Cloud PC provisioning.

362377

363378 #### Solution

364379

365 −There is currently no workaround. To use Citrix integration, configure your Cloud PCs by using a provisioning policy that doesn’t include a device preparation policy.

380 +There is currently no workaround. To use Citrix integration, configure your Cloud PCs by using a provisioning policy that doesn't include a device preparation policy.

366381

367382 ## Next steps

368383

⋯ 1 unchanged line

Microsoft's Markdown source from MicrosoftDocs/SupportArticles-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.