Device images overview

Windows 365 uses both default and custom operating system images to automatically create the virtual Cloud PCs that you provide to your end users. The default images are available from the gallery in Microsoft Intune as a part of creating your provisioning policy. You can also upload custom images that you create.

Image requirements

Both marketplace and custom images must meet the following requirements:

  • Supported versions of Windows 10 or Windows 11 Enterprise.

  • Generation 2 images.

    Note

    We recently made the change to generation 2 (Gen2) virtual machine images. Newly created custom images must be Gen2. Existing custom images uploaded based on generation 1 will remain active.

  • The image must never have been Active Directory, Microsoft Entra ID joined, Intune-enrolled, or enrolled for co-management. For more information, see Sysprep won't run correctly on a device that has been MDM enrolled.

  • Generalized VM image.

  • Single Session VM images (multi-session isn’t supported).

  • No recovery partition. For information about how to remove a recovery partition, see the Windows Server command: delete partition.

  • Default 64-GB OS disk size. The OS disk size is automatically adjusted to the size specified in SKU description of the Windows 365 license.

  • Data disks can't be attached to the VM prior to capturing the image.

  • Cannot contain FSLogix components.

  • Cannot contain more than 3,000 apps in the Start menu.

A custom image must also meet the following extra requirements:

  • Exist in an Azure subscription.
  • Is stored as a managed image in Azure or in an Azure Compute Gallery (currently in Public Preview)

Note

Some editions of the Windows operating system, like N or long term service channel (LTSC) editions, aren't supported. For best results when you create a custom image, use one of the Cloud PC gallery images as a starting template.

Storing a managed image on Azure incurs storage costs. However, customers can delete the managed image from Azure once they've successfully uploaded it as a Custom Image to Microsoft Intune.

Windows 365 provides a built-in gallery of Windows Enterprise images accessible through the provisioning policy creation flow. Each image helps admins with preset audit policies already enabled, like account policies, logon/logoff, object access, and policy change. These images are harmonized in GPOs. Any differences are due to preinstalled apps.

They're replicated to all Azure regions to give you a quick provisioning experience. These images are updated monthly with:

  • Optimizations for improved user experience.
  • The latest security updates so that end users have a secure and seamless experience.

There are three sets of images available to choose from across the different versions of Windows Enterprise:

  • Images with pre-installed Microsoft 365 Apps: Microsoft 365 Apps and Teams optimizations are already installed. The following settings are preapplied:

    • IsWVDEnvironment reg key (Teams).
    • C++ Runtime (Teams).
    • WebRTC Redirector (Teams).
    • Microsoft Teams (Teams).
    • Microsoft Edge settings like sleeping tabs, forced browser sign-in, startup boost, and first time optimizations based on Microsoft Entra ID and synchronization. For more information, see Configure Microsoft Edge policy settings with Microsoft Intune.
    • Microsoft Outlook first-time configuration settings (auto log on based on Microsoft Entra profile, support for other profiles).

  • Images with no preinstalled applications: A plain image without any preinstalled applications (look for images without the M365 Apps in the name).

  • Image with Developer Configuration (preview): This image provides a consistent, ready-to-use developer environment by preinstalling essential development tools and applying the required configurations across Windows and WSL Ubuntu. By standardizing the image with the necessary tooling and setup, this approach reduces onboarding time, minimizes manual configuration, and ensures a reliable and productive developer experience from first sign-in. The image includes:

    • Windows configuration and settings via registry.

      • Desktop configuration settings
      • File Explorer settings
      • Taskbar settings
      • Search and Start settings
      • Service/features settings

    • Developer tools installation, including PowerShell 7, Visual Studio Code (with extensions ms-vscode.powershell, ms-python.python, ms-vscode-remote.remote-wsl, github.vscode-pull-request-github, ms-edgedevtools.vscode-edge-devtools, and mspythondeprem.python-dependency-remediation), PowerToys, Python, Node.js, npm, nvm, git, GitHub, GitHub Copilot CLI (with Work IQ and Windows Dev Skills), Oh My Posh, UV tools, Azure CLI, .NET Runtime, .NET SDK, and WinApp CLI.

    • Install and set up Windows Subsystem for Linux (WSL) with a WSL Ubuntu

      • A bash script to configure the user environment in WSL Ubuntu
      • Installation of the same developer tools within the WSL environment

    • If an uninstall of the 3rd-party dev tools is desired, this script can be used to uninstall them.

Note

  1. This gallery image is provided as part of a public preview and is not intended for production workloads.
  2. Customers are responsible for managing and maintaining third-party applications installed on the VM image, including monitoring for vulnerabilities, applying security updates, configuring settings, and ensuring compliance with organizational security and compliance requirements.
  3. Preinstalled third-party applications included in the image are not currently manageable through Intune as packaged applications. Customers who require Intune-based application lifecycle management should uninstall the preinstalled applications and redeploy them through Intune.
  4. This image is not supported on 2 vCPU or GPU licenses because they do not support nested virtualization.

Known issues

  1. For customers that use the Developer Configuration image that also use OneDrive, the Oh-my-posh profile file is configured under the Documents folder, which syncs via OneDrive. When this file syncs to other machines via OneDrive where Oh-my-posh is not installed, it triggers an error upon opening a PowerShell window. There is no functional impact—the terminal operates as expected, with only an error message displayed.

All supported Windows 365 gallery images are updated monthly after the security patch release schedule of Windows Servicing & Delivery. This update happens around the middle of each month. Updated Windows 365 images are made available in Intune for provisioning around the end of the third week of the month.

Each updated image includes:

Applications that come pre-installed are the latest version that is available at the start of the second Tuesday of that month. Any app updates posted on that day are included in the image update of the subsequent month.

Newly provisioned Cloud PCs are automatically created with the latest images. For existing Cloud PCs, you can receive the updates by reprovisioning.

Custom images

If none of the default gallery images meet your requirements, you can upload up to 20 of your own custom device images.

For more information on creating such a custom image, see Create a managed image of a generalized VM in Azure.

A custom image can be created using any of the images mentioned previously as a starting point. For example, you can start with one of those images and then install more applications and make more configuration changes.

Note

For custom images with Teams application, follow the instructions detailed in Create a Cloud PC custom image that supports Microsoft Teams to configure optimizations that are needed. Images with disk encryption sets aren't supported.

For more information about adding a device image to Windows 365, see Add and delete custom device images.

When you upload a custom device image, Windows 365:

  1. Copies the image to a temporary subscription.
  2. Runs the following validation checks on the image:
    1. Verifies all the Windows 365 image requirements are met.
    2. Deploys a virtual machine and makes sure that the images can be booted and provisioned as a Cloud PC.
  3. If you have a Microsoft Entra hybrid join connection, Windows 365 replicates the image across all Azure regions where you have an Azure network connection.
  4. If you have a Microsoft Entra join connection, Windows 365 replicates the image to the provisioned region during provisioning.

Next steps

Learn about device configuration.

Learn about using apps, like Microsoft Teams, with your Cloud PCs.

Learn about restoring a Cloud PC to a previous state

  • Last updated on