Administrator protection isn't supported on Cloud PCs

Windows 365 Cloud PCs don't support Administrator protection. Components in the remote connection stack require updates to work with Administrator protection's least-privilege model. Support for this environment is planned for a future release. In the meantime, configure users as standard users to maintain least privilege in this environment. If a policy that enables it is assigned to your Cloud PCs, users might see an unexpected authentication prompt when signing in, extra approval prompts for tasks that require elevation, and elevation failures. The sign-in prompt affects all users. The elevation prompts and failures affect users who have local administrator rights. By default, users aren't administrators of their Cloud PCs. If your Cloud PCs are Microsoft Entra hybrid joined and receive the Windows security baselines from the Microsoft Security Compliance Toolkit through Group Policy, Administrator protection is turned on starting with the October 2026 Windows security update, even if you didn't enable it. Solution: If Administrator protection is already enabled on your Cloud PCs, set User Account Control: Configure type of Admin Approval Mode to Legacy Admin Approval Mode in the policy that's assigned to them, then restart the Cloud PCs. This setting is in the Intune settings catalog under Local Policies Security Options. If your Cloud PCs receive these baselines through Group Policy, set User Account Control: Configure type of Admin Approval Mode to Legacy Admin Approval Mode in a Group Policy Object that applies to your Cloud PCs and takes precedence over the baselin…

Permanent link to this revision