Microsoft's edit · Windows 365 Enterprise known issues

5555 ### Solution

5656

5757 1. Check if the Azure network connection (ANC) fails with the error "An internal error occurred. The virtual machine deployment timed out." If yes, review the related GPO.

58 −2. Check if the PowerShell Execution policy is set to **AllSigned**. If it is, either remove the GPO or reset the PowerShell Execution policy to **Unrestricted**.

59 −3. Retry the ANC health check. If the check succeeds, retry provisioning.

58 +1. Check if the PowerShell Execution policy is set to **AllSigned**. If it is, either remove the GPO or reset the PowerShell Execution policy to **Unrestricted**.

59 +1. Retry the ANC health check. If the check succeeds, retry provisioning.

6060

61 −## Cloud PC reports as not compliant with compliance policy

61 +## Cloud PC reports as not compliant with the compliance policy

6262

6363 The following device compliance settings report as **Not applicable** when being evaluated for a Cloud PC:

6464

7474

7575 To enable secure boot on the Cloud PC, reprovision the specific Cloud PC. for more information, see see [Reprovision a Cloud PC](/windows-365/enterprise/reprovision-cloud-pc)

7676

77 −To remove "not compliant" settings:

77 +To remove the "not compliant" settings:

7878

7979 1. [Create a filter for all Cloud PCs](/windows-365/enterprise/create-filter#create-a-filter-for-all-cloud-pcs).

8080 1. For any existing device compliance policies that both evaluate to a Cloud PC and contain either of the **Not Compliant** settings, use this new filter to exclude Cloud PCs from the policy assignment.

8282

8383 ## Single sign-on users see a dialog to allow remote desktop connection during the connection attempt

8484

85 −When you enable single sign-on, you see a prompt to authenticate to Microsoft Entra ID and allow the Remote Desktop connection when launching a connection to a new Cloud PC. Microsoft Entra remembers up to 15 devices for 30 days before prompting again. If you see this dialog, select **Yes** to connect.

85 +When you enable single sign-on, users see a prompt to authenticate to Microsoft Entra ID and allow the Remote Desktop connection when launching a connection to a new Cloud PC. Microsoft Entra remembers up to 15 devices for 30 days before prompting again. To connect, users select **Yes** in this dialog.

8686

87 −To prevent this dialog from appearing, you can create a preconsented device group. To get started, fFollow the instructions to [configure a target device group](/azure/virtual-desktop/configure-single-sign-on#configure-the-target-device-groups).

87 +To prevent this dialog from appearing, you can create a preconsented device group. To get started, follow the instructions to [configure a target device group](/azure/virtual-desktop/configure-single-sign-on#configure-the-target-device-groups).

8888

8989 <a name='single-sign-on-user-connections-are-being-denied-through-azure-ad-conditional-access---42317382--'></a>

9090

9292

9393 ### Possible cause

9494

95 −To sign in through single sign-on, the remote desktop client requests an access token to the **Microsoft Remote Desktop** app in Microsoft Entra, which might be the cause of the failed connection.

95 +To sign in by using single sign-on, the Remote Desktop client requests an access token to the Microsoft Remote Desktop app from Microsoft Entra. In issue in this request process might cause the failed connection.

9696

9797 ### Troubleshooting steps

9898

9999 Follow the steps in [troubleshoot sign-in problems](/azure/active-directory/conditional-access/troubleshoot-conditional-access).

100100

101 −## Single sign-on users are immediately disconnected when the Cloud PC locks

101 +## When a Cloud PC locks, it immediately disconnects single sign-on users

102102

103 −When single sign-on isn't used, users can see the Cloud PC lock screen and enter credentials to unlock their Windows session. However, when single sign-on is used, the Cloud PC fully disconnects the session so that:

103 +When single sign-on isn't used, users can see the Cloud PC lock screen and enter credentials to unlock their Windows session. However, when single sign-on is used, the Cloud PC fully disconnects the session to enable the following capabilities:

104104

105105 - Users can use passwordless authentication to unlock their Cloud PC.

106106 - Conditional Access policies and multifactor authentication can be enforced when unlocking the Cloud PC.

107107

108108 <a name='single-sign-on-users-arent-asked-to-reauthenticate-to-azure-ad-when-connecting-from-an-unmanaged-device---35593334--'></a>

109109

110 −## Single sign-on users aren't asked to reauthenticate to Microsoft Entra ID when connecting from an unmanaged device

110 +## When single sign-on users connect from an unmanaged device, they aren't asked to reauthenticate to Microsoft Entra ID

111111

112112 When you use single sign-on, all authentication behavior (including supported credential types and sign-in frequency) is driven through Microsoft Entra ID.

113113

121121

122122 ### Solution

123123

124 −Turn off the **Use Devices preview** toggle in the upper-right corner of the **Devices** > **Overview** page.

124 +In the upper-right corner of the **Devices** > **Overview** page, turn off **Use Devices preview**.

125125

126126 ## Cloud PC is stuck in a restart loop after a restore or resize action

127127

128128 ### Possible cause

129129

130 −This issue might occur for Cloud PCs provisioned before July 2022 that use either:

130 +This issue might occur for Cloud PCs provisioned before July 2022 that use either of the following mechanisms:

131131

132132 - Microsoft Attack Surface Reduction rules (for example, [Manage attack surface reduction settings with endpoint security policies in Microsoft Intune](/mem/intune/protect/endpoint-security-asr-policy)), or

133133 - Third-party solutions that block the install language script execution during the post-provisioning process.

140140

141141 1. Search the Windows Event log. If the system shows the following reboot event (1074), continue to step 2.

142142

143 − ```output

144 − The process C:\WINDOWS\system32\wbem\wmiprvse.exe (<CPC Name>) has initiated the restart of computer <CPC Name> on behalf of user NT AUTHORITY\SYSTEM for the following reason: Application: Maintenance (Planned)

145 − Reason Code: 0x80040001

146 − Shutdown Type: restart

147 − Comment: DSC is restarting the computer.

148 − ```

143 + ```output

144 + The process C:\WINDOWS\system32\wbem\wmiprvse.exe (<CPC Name>) has initiated the restart of computer <CPC Name> on behalf of user NT AUTHORITY\SYSTEM for the following reason: Application: Maintenance (Planned)

145 + Reason Code: 0x80040001

146 + Shutdown Type: restart

147 + Comment: DSC is restarting the computer.

148 + ```

149149

150 −2. Run `Get-DscConfigurationStatus` in an elevated command window. If the result shows a reboot pending for a job, continue to step 3.

151 −3. Run `Get-DscConfiguration` in an elevated command window. If the results show the DSC that installs the language, continue to the next section.

150 +1. In an administrative Windows PowerShell Command Prompt window, run `Get-DscConfigurationStatus`. If the result shows that a restart is pending for a job, continue to step 3.

151 +1. At the administrative command prompt, run `Get-DscConfiguration`. If the results show the DSC that installs the language, continue to the "Solution" section.

152152

153153 ### Solution

154154

157157 - Remove the Azure Site Recovery policies or switch the policies to Audit mode, and then apply the new policies to the Cloud PC.

158158 - In an elevated command window, run the following command to reboot the job:

159159

160 − `Remove-DSCConfiguration -Stage Pending,Current,Previous -Verbose`

160 + ```powershell

161 + `Remove-DSCConfiguration -Stage Pending,Current,Previous -Verbose`

162 + ```

161163

162164 ## Cloud PC connection issues for GCC High government customers

163165

164 −Some GCC High government customers whose resources are deployed to `microsoft.us` environments might encounter issues connecting to their Cloud PC using web clients or the Safari browser.

166 +Some GCC High government customers, whose resources are deployed to the `microsoft.us` environments, might encounter issues connecting to their Cloud PC when they use web clients or the Safari browser.

165167

166168 ### Possible cause

167169

168170 The issue occurs when the web client or the Safari browser blocks third-party cookies. Third-party cookies are cookies set by a domain other than the one you're visiting.

169171

170 −For GCC High customers with resources deployed to `microsoft.us` environments, the `microsoft.us` cookies are considered third-party cookies by the web client or the Safari browser. This consideration is because the web client or Safari browser uses the Cloud PC's domain name, which is different from `microsoft.us`, to determine the first-party domain. If the web client or Safari browser blocks third-party cookies, it prevents the `microsoft.us` cookies from:

171 −

172 −- Being stored.

173 −- Used for authentication and authorization.

172 +For GCC High customers whose resources are deployed to `microsoft.us` environments, the web client or Safari browser uses the Cloud PC's domain name, which is different from `microsoft.us`, to determine the first-party domain. As a result, the web client or the Safari browser considers the `microsoft.us` cookies to be third-party cookies. If the web client or Safari browser blocks third-party cookies, it can't store the `microsoft.us` cookies or use them for authentication and authorization.

174173

175 −As a result, you can't connect to your Cloud PC session.

174 +As a result, the affected customers can't connect to their Cloud PC sessions.

176175

177176 ### Solution

178177

180179

181180 This change lets the web client or Safari browser store and use the `microsoft.us` cookies to connect to your Cloud PC session.

182181

183 −## Windows 365 Authentication Issues in Government Environments Using Windows App on macOS

182 +## Windows 365 authentication issues that occur in government environments when clients use Windows App on macOS

184183

185 −- Government customers (GCC, GCC High) using **Windows 365** on macOS might encounter authentication failures when adding a **Work or School Account** via the **Windows App**.

186 −- **Web browser access** to Windows 365 remains unaffected.

184 +- Government customers (GCC, GCC High) who use Windows 365 on macOS might encounter authentication failures when they use the Windows App to add a work or school account.

185 +- Web browser access to Windows 365 remains unaffected.

187186 - The Windows App on macOS doesn't properly detect the GCC High Windows 365 environment during discovery.

188187 - Required workspace URL (`https://rdweb.wvd.azure.us/api/arm/feeddiscovery`) isn't automatically identified during authentication.

189188

190189 ### Possible Cause

191190

192 −This behavior is by design and requires to choose **Add workspace** instead of **Work or School Account** for government customers.

191 +This behavior is by design. To add a device, government customers have to select **Add workspace** instead of **Work or School Account**.

193192

194193 ### Solution

195194

196 −- Instead of selecting **Add Account**, select **Add Workspace**.

197 −- Manually enter the following URL: `https://rdweb.wvd.azure.us/api/arm/feeddiscovery`.

198 −- The Windows 365 devices should now be discovered and added.

195 +1. Instead of selecting **Add Account**, select **Add Workspace**.

196 +1. Manually enter the following URL: `https://rdweb.wvd.azure.us/api/arm/feeddiscovery`.

199197

198 +The Windows 365 devices should now be discovered and added.

199 +

200200 ## Windows Security reports "Memory Integrity is off. Your device may be vulnerable."

201201

202202 Windows Security reports "Memory Integrity is off. Your device may be vulnerable."

203203

204204 In the Cloud PC's Windows Systems Information, you might also see that the Virtualization-based security (VBS) row shows **Enabled but not running**.

205205

206 −This issue can be caused when nested virtualization is turned on. When nested virtualization is turned on, it requires a running nested hypervisor, which inhibits Direct Memory Access (DMA) protections. DMA protections are required when running VBS.

206 +This issue can occur when nested virtualization is turned on. Nested virtualization requires a running nested hypervisor, which inhibits Direct Memory Access (DMA) protections. DMA protections are required when running VBS.

207207

208208 ### Solution

209209

210 −Make sure that:

211 −

212 −- Nested virtualization was turned off for the Cloud PC.

213 −- Policies have VBS enabled with DMA protection.

210 +1. For each Cloud PC, turn off nested virtualization.

211 +1. Policies that enforce VBS also enforce DMA protection.

214212

215213 Another option is to not require DMA for VBS because they're incompatible with each other.

216214

217215 ## Microsoft Teams isn't enforcing screen capture protection

218216

219 −When screen capture protection is enabled, Microsoft Teams on Windows 365 Cloud PCs isn't enforcing screen capture protection.

217 +When screen capture protection is enabled, Microsoft Teams on Windows 365 Cloud PCs doesn't enforce screen capture protection.

220218

221219 ### Troubleshooting steps

222220

223221 - Confirm that the WebRTC version is up-to-date.

224 −- Confirm that the screen capture protection policy is configured correctly to have the client and server selected:

222 +- Confirm that the screen capture protection policy is configured correctly to protect both the client and server:

225223

226 − 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Configuration**, and then choose the policy.

227 − 2. Under **Configuration settings**, select **Windows Components** > **Remote Desktop Services** > **Remote Desktop Session Host** > **Azure Virtual Desktop**, and then make sure the following is set:

228 − - **Enable screen capture protection** = **Enable**

229 − - **Screen Capture Protection Options** = **Block screen capture on client and server**

224 + 1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices** > **Configuration**, and then select the policy.

225 + 1. Under **Configuration settings**, select **Windows Components** > **Remote Desktop Services** > **Remote Desktop Session Host** > **Azure Virtual Desktop**, and then configure the following settings:

226 + - **Enable screen capture protection** = **Enable**

227 + - **Screen Capture Protection Options** = **Block screen capture on client and server**

230228

231229 ## Windows 365 scope tags and nested groups

232230

242240

243241 ### Solution

244242

245 −Edit scope tags for individual Cloud PCs on Intune's **All Devices** blade to sync the scope tag associations to the Windows 365 service.

243 +To sync the scope tag associations to the Windows 365 service, edit scope tags for individual Cloud PCs on Intune's **All Devices** blade.

246244

247 −## Scope tags for custom images can't be edited

245 +## Can't edit scope tags for custom images

248246

249 −Scope tags applied to custom images can't be edited or directly added by top-level admins.

247 +Top-level administrators can't add or edit scope tags that are applied to custom images.

250248

251249 ### Solution

252250

253 −When scoped admins create custom images, those custom images are tagged with the same scope tags that are associated with the scoped admin.

251 +When a scoped admin creates a custom image, the custom image is tagged with the same scope tags that are associated with the scoped admin.

254252

255 −For example, if an admin scoped with the scope tag "Scope Tag A" creates a custom image, the created custom image is automatically tagged with "Scope Tag A."

253 +For example, if a scoped admin who's associated with the "Scope Tag A" scope tag creates a custom image, the created custom image is automatically tagged by using "Scope Tag A."

256254

257255 ## WebRTC Redirector Service is missing from the latest Windows 365 Cloud PC gallery images

258256

269267

270268 - To add the WebRTC Redirector Service app to the list of apps to install by default onto Cloud PCs, follow the steps in [Add Microsoft 365 Apps to Windows 10/11 devices with Microsoft Intune](/mem/intune/apps/apps-add-office365).

271269

272 −- To add the WebRTC Redirector Service app to an individual Cloud PC, follow the steps in [Install the Remote Desktop WebRTC Redirector Service](/azure/virtual-desktop/teams-on-avd#install-the-remote-desktop-webrtc-redirector-service). To get the most up-to-date installer, use this link: [https://aka.ms/msrdcwebrtcsvc/msi](https://aka.ms/msrdcwebrtcsvc/msi).

270 +- To add the WebRTC Redirector Service app to an individual Cloud PC, follow the steps in [Install the Remote Desktop WebRTC Redirector Service](/azure/virtual-desktop/teams-on-avd#install-the-remote-desktop-webrtc-redirector-service). To get the most up-to-date installer, see [https://aka.ms/msrdcwebrtcsvc/msi](https://aka.ms/msrdcwebrtcsvc/msi).

273271

274272 ## Windows 365 Frontline issues

275273

276 −The following are issues for Windows 365 Frontline:

274 +The following items are known issues for Windows 365 Frontline.

277275

278 −### Users can't access Frontline Cloud PCs in shared mode

276 +### Users can't access Frontline Cloud PCs that are in shared mode

279277

280 −When Frontline Cloud PCs in shared mode are assigned to a Microsoft Entra ID group with more than 10,000 members, some users might not receive access and won't see the Cloud PC cards in the Windows app client.

278 +When Frontline Cloud PCs in shared mode are assigned to a Microsoft Entra ID group that has more than 10,000 members, some users might not receive access and don't see the Cloud PC cards in the Windows app client.

281279

282280 #### Solution

283281

284282 Reduce the Microsoft Entra ID group membership to fewer than 10,000 users.

285283

286 −### Can't decrease Cloud PC count when all Cloud PCs fail provisioning

284 +### Can't decrease the Cloud PC count when all Cloud PCs fail provisioning

287285

288 −If provisioning fails due to a Windows Autopilot Device Preparation Profile (DPP) failure and all Cloud PCs show no successfully provisioned devices, administrators can't decrease the number of Cloud PCs in the assignment configuration.

286 +If a Windows Autopilot Device Preparation Profile (DPP) failure causes Cloud PC provisioning to fail, and all Cloud PCs show no successfully provisioned devices, administrators can't decrease the number of Cloud PCs in the assignment configuration.

289287

290288 #### Solution

291289

292290 Perform a reprovisioning action in the provisioning policy:

293291

294 − 1. Navigate to **Microsoft Intune admin center** > **Devices** > **Windows 365**

295 − 2. Select **Provisioning policies**

296 − 3. Choose the affected provisioning policy

297 − 4. Select **Reprovision** to reset the deployment state

298 − 5. After reprovisioning completes, you can adjust the Cloud PC count as needed

292 +1. Go to **Microsoft Intune admin center** > **Devices** > **Windows 365**.

293 +1. Select **Provisioning policies**.

294 +1. Select the affected provisioning policy.

295 +1. To reset the deployment state, elect **Reprovision**.

296 +1. After the reprovisioning process completes, you can adjust the Cloud PC count as needed.

299297

300298 ### Scheduled reprovisioning doesn't recover after license changes

301299

302 −When Frontline Cloud PCs are provisioned in shared mode and licenses expire or are removed from the tenant, the Cloud PCs are deprovisioned until valid licenses are restored. After licenses are added back, Cloud PCs provision according to the policy configurations, but both scheduled reprovisioning and manual reprovisioning functionality remain disabled.

300 +When Frontline Cloud PCs are provisioned in shared mode, and licenses expire or are removed from the tenant, the Cloud PCs are deprovisioned. After you add back valid licenses, Cloud PCs provision according to the policy configurations. However, both scheduled reprovisioning and manual reprovisioning functionality remain disabled.

303301

304302 #### Solution

305303

306 −To restore full reprovisioning functionality after license expiration:

304 +To restore full reprovisioning functionality after you restore expired licenses:

307305

308 − 1. **Remove the provisioning policy assignment:**

309 − - Navigate to the affected provisioning policy

310 − - Go to the **Assignments** tab

311 − - Remove all group assignments

306 +1. **Remove the provisioning policy assignment:**

307 + 1. Go to the affected provisioning policy.

308 + 1. Go to the **Assignments** tab, and the remove all group assignments.

312309

313 − 2. **Re-add the assignment:**

314 − - Wait 5-10 minutes for the removal to process

315 − - Add the group assignments back to the policy

316 − - Verify that reprovisioning options are now available

317310

311 +1. **Re-add the assignment:**

312 + 1. Wait 5-10 minutes for the removal to process.

313 + 1. Add the group assignments back to the policy.

314 + 1. Verify that the reprovisioning options are now available.

315 +

318316 ### Can't decrease Cloud PC count due to pooled user storage limits

319317

320 −The number of Cloud PCs for Frontline Cloud PCs in shared mode can't be decreased when it would cause the pooled user storage limit to be exceeded.

318 +You can't reduce the number of Cloud PCs for Frontline Cloud PCs in shared mode if the operation would cause the amount of pooled user storage to exceed its limit.

321319

322320 #### Solution

323321

324 −Delete individual user storage to be under the new limit. The new limit can be determined by multiplying the new Cloud PC count by the OS disk size in GB.

322 +1. To determine a new pooled user storage limit, multiply the number of Cloud PCs that you want by the size of the operating system disks (in GB) that you want to use.

323 +1. Delete individual user storage to comply with new limit.

325324

326325 ### Autopilot Device Preparation (DPP) initially shows as failed if timeout limit is reached

327326

328 −Once you create the provisioning policy and you receive the error code `DevicePreparationProfileTimeout`, then the timeout limit has been reached and the Cloud PCs are provisioned without applying the Autopilot Device Preparation successfully.

327 +After you create the provisioning policy, you receive the `DevicePreparationProfileTimeout` error code. This means that the Cloud PC provisioning process reached the initial DPP timeout but hasn't successfully applied Autopilot Device Preparation.

329328

330329 #### Solution

331330

332 −Continue to wait as the Autopilot Device Preparation will continue to install in the background after the initial timeout period.

331 +Wait for the process to continue. Autopilot Device Preparation continues to install in the background after the initial timeout period.

333332

334 −### Cloud PC serial numbers don't show immediately in Windows Autopilot Device Preparation deployment status

333 +### Windows Autopilot Device Preparation deployment status doesn't immediately show Cloud PC serial numbers

335334

336 −When monitoring the status of the Autopilot Device Preparation profile immediately after provisioning, the Cloud PC serial numbers aren't available.

335 +Immediately after provisioning, the status information for the Autopilot Device Preparation profile doesn't include the Cloud PC serial numbers.

337336

338337 #### Solution

339338

340 −Cloud PC serial numbers can take up to 30 minutes.

339 +Wait for the process to continue. Cloud PC serial numbers can take up to 30 minutes to appear in the status information.

341340

342341 ## Next steps

343342

Windows 365 Enterprise known issues

Microsoft's edit · 14 Nov 2025 00:48 UTC