To deploy a Windows 365 security baseline, create a profile from Endpoint security > Security baselines in the Intune admin center, review its defaults, and assign it to a pilot group of the Cloud PCs it is meant to protect. Creating the profile applies it immediately to assigned devices, so confirm the scope before you select Create. Microsoft’s deployment guide describes version 24H1; check the versions available in your tenant rather than assuming that is the newest one.
What the Windows 365 security baseline does
A security baseline is a collection of recommended configuration settings for a particular Microsoft product and version. The Windows 365 Cloud PC baseline provides a starting configuration for managed Cloud PCs; it is not a guarantee that a deployment meets every security, regulatory, or operational requirement. Review each setting against your existing policies and business needs before assigning the profile. Microsoft’s overview of Intune security baselines explains their purpose and the need to evaluate baseline settings in context.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s Windows 365 deployment instructions identify the general Cloud PC baseline as version 24H1. That is the version documented on the page, not a promise that every tenant currently offers only that version or that it remains the latest. Check the baseline list in your own Intune tenant before creating a profile. Microsoft’s Windows 365 deployment guide includes the documented workflow and version reference.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat you need before deployment
- Intune management: Confirm that Intune manages the Windows 365 Cloud PCs in scope. Microsoft recommends Intune as the management plane for Windows 365 device management. See Microsoft’s Intune management guidance for Windows 365.
- License: Microsoft says an Intune Plan 1 subscription is required to deploy Intune security baselines. Check your organization’s subscription and applicable licensing terms. Microsoft’s profile management guidance covers licensing and baseline administration.
- Permissions: Use an Intune role with appropriate permissions to manage security baseline profiles. Verify the administrator’s role and scope before beginning.
- Groups and scope: Prepare a pilot group containing the intended Cloud PCs, plus any exclusion groups needed to prevent unintended devices from receiving the profile.
How to deploy a Windows 365 security baseline in Intune
- Open the baseline list. In the Intune admin center, go to Endpoint security > Security baselines. Select the Windows 365 baseline version available in your tenant. Do not select a version solely because a documentation page names it; confirm its version and settings in the tenant.
- Create a profile and inspect its settings. Open the selected baseline and start profile creation. Review the setting groups and defaults, then customize settings where required by your organization. Similar settings can appear in different baseline types with different default values; Intune cannot decide which product’s intent is appropriate for your environment.
- Set scope tags if needed. Configure scope tags to align profile administration with your organization’s delegated management model.
- Assign a pilot. Assign the profile to a group containing the Cloud PCs you intend to test. Add exclusions where needed to refine the scope, and check the included and excluded groups carefully.
- Review and create. Confirm the selected baseline, settings, and assignment before creating the profile. Microsoft states that “As soon as you create the profile, it’s pushed to the assigned group and is applied immediately.” Treat the Create action as deployment, not as a draft or preview.
- Validate before widening scope. Check the pilot’s policy results and operational impact, resolve conflicts or unexpected effects, and adjust the profile or assignments before adding more Cloud PCs.
Which baseline settings should you review before assigning?
Do not treat baseline defaults as universal requirements. Compare each setting with your security standards, user workflows, existing Intune policies, and other controls. Settings from separate baselines may overlap while prescribing different values; assigning multiple policies without resolving those differences can create conflicts or outcomes that are difficult to interpret.
#1 Best Overall
- Check whether a setting is already configured by another Intune policy or security product.
- Confirm that the setting’s effect is compatible with the applications and tasks Cloud PC users need.
- Decide whether to retain, change, or leave a setting unconfigured based on its purpose and your requirements.
- Record the intended configuration and validate the actual result on the pilot devices before broader rollout.
Microsoft’s general baseline guidance also notes that Windows 10 reached end of support on October 14, 2025. Windows 10 devices may still enroll in Intune and use eligible features, but Microsoft does not guarantee functionality, which can vary. Check the supported operating system and feature requirements that apply to the devices you manage. Read Microsoft’s Intune security baseline overview.
Windows 365-specific limitations and related controls
Administrator protection
Windows 365 Cloud PCs do not support Administrator protection. Microsoft recommends using an assignment filter to exclude Cloud PCs from policies that enable this feature. Check policy targeting so a broader assignment does not unintentionally include Cloud PCs. Microsoft’s Windows 365 security overview describes this limitation and the recommended exclusion approach.
Rank #2
Defender for Endpoint and Purview
Windows 365 also integrates with Microsoft Defender for Endpoint and Purview endpoint data loss prevention. These are adjacent security controls, not settings that should be assumed to be enabled or guaranteed by the Windows 365 baseline. Purview endpoint DLP can govern data movement such as clipboard or drive copying and printing to unauthorized devices; assess and configure these controls separately according to your requirements. See the Windows 365 security overview for the documented integrations.
Recommended Free Tools
Windows 365 for Agents uses a separate baseline
If the target devices are Windows 365 for Agents Cloud PCs, do not assume the general Windows 365 Cloud PC baseline is the applicable one. Microsoft documents a separate Windows 365 for Agents security baseline, with device-focused settings intended to be applied early, before agent user sign-in. Its prerequisites include Intune management, appropriate administrator permissions, and target groups. Confirm the workload and baseline applicability before assigning a profile. Read Microsoft’s Windows 365 for Agents baseline guidance.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
