My wife and I recently took a trip to Savannah, Georgia, and let me tell you, that city knows how to do food. We stumbled into this little restaurant, and they brought out a basket of biscuits that genuinely changed me as a person. Flaky, buttery, golden on the outside, soft on the inside. I’m not exaggerating when I say I considered smuggling a dozen of them back home in my suitcase. My wife talked me out of it, but only barely.
Now, what does any of this have to do with Windows 365? Well, think about it this way. Those biscuits were perfect because you got exactly what you wanted, nothing more, nothing less. No one handed me an entire kitchen just so I could enjoy a biscuit. They just gave me the biscuit. And that’s exactly the idea behind Windows 365 Cloud Apps.
Windows 365 Cloud Apps changes that equation entirely. Instead of giving every user a full desktop experience, Cloud Apps lets you stream individual applications directly from a Cloud PC. No taskbar, no Start menu, no desktop clutter. Just the app, running alongside their local applications as if it were installed right on their machine.
If you’ve been eyeing Azure Virtual Desktop’s RemoteApp feature but didn’t want to deal with the complexity, this one’s for you. So grab your favorite beverage (and maybe a biscuit), and let’s walk through how to get this set up.
What exactly are Windows 365 Cloud Apps?
In short, Windows 365 Cloud Apps is a feature that lets IT admins publish individual applications hosted on a Cloud PC and deliver them to users, without requiring a dedicated Cloud PC for every single person. Think of it as Microsoft’s answer to application streaming, built directly into the Windows 365 and Intune management experience you already know.
Under the hood, Cloud Apps runs on Windows 365 Frontline Cloud PCs in shared mode. This is a key detail, because it strips the user session of all the Windows UI elements (taskbar, desktop, Start menu) and renders only the application window on the user’s device. The result? A clean, integrated experience where end users often don’t even realize they’re running a remote app.
Prerequisites
Before you go clicking around in Intune, make sure you have a few things in place. Trust me, checking these first will save you some headaches later.
- Windows 365 Frontline license. Cloud Apps requires Frontline licensing. Enterprise and Frontline Dedicated licenses won’t work here because Cloud Apps is built exclusively on Frontline Shared mode.
- Microsoft Intune. All management is done through the Intune admin center.
- Microsoft Entra ID. Identity and access are governed through Entra ID.
- A supported Windows image. Either use a Microsoft Gallery image (recommended for simplicity) or upload a custom image with your LOB apps pre-installed.
- Entra security groups. You will need a user group for Cloud App access. You will also need a group for your Device Prep policy that we will cover shortly.
Step 1. Create a Device Preparation policy
I will keep this part short. However, if Device Preparation policies are still new in your world, it is worth taking a quick detour and reading up. It saves time later.
- Go to Devices > Enrollment > Device Preparation.
- Create an Automatic (Preview) policy.
- Set the owner of the group used by Intune Provisioning Client:
Additionally, pay close attention to what you put under Allowed Applications. That choice comes back in a big way later.
Step 2. Create the provisioning policy
General tab
Here’s the “this is Cloud Apps, not a full desktop” moment.
- For Experience, select: “Access only apps which run in the cloud”.
Once you pick that, two defaults should line up automatically:
- License type defaults to Frontline
- Mode defaults to Shared
After that, configure the usual suspects:
- Join type (Microsoft Entra join or Hybrid join)
- Network (Microsoft Hosted Network or your Azure Network Connection)
- Geography/Region
- Entra SSO (because nobody wants extra sign-in prompts)
Image tab
Next, choose what your Cloud PCs will be built from:
- Microsoft Gallery Image (recommended). Microsoft maintains and updates these images, so you are not babysitting patching forever.
- Custom Image. Use this if you need specific line-of-business apps baked in from the start.
Do yourself a favor and stick with the Microsoft image whenever you can. You will thank yourself later.
Also, note the Apps section. It lists the applications discovered on the image you selected. If you use a Microsoft image, you will mostly see OS and built-in apps.
Configuration tab
This is where a couple of important switches live.
- Language and naming are straightforward.
- Autopilot Device Preparation Policy (preview). Remember the one we created earlier? We also had Notepad++ and Visual Studio Code as Allowed Apps? This is the magical part now. It’s almost like finding out what they put in those biscuits.
- User Experience Sync. Enable this so app settings, user preferences, and application data persist between sessions. Since Cloud Apps runs on shared Cloud PCs, users can land on a different machine each time. User Experience Sync gives them their “stuff” back at sign-in, then detaches it at sign-out.
Assignment tab
Finally, aim this at the right people.
- Select the Entra security group containing your target users.
- Choose the Cloud PC size (vCPU, RAM, storage) that matches the workload.
- Add an assignment name and set the number of Cloud PCs you want allocated for these apps.
Step 3. Wait for provisioning
After you create the policy, Frontline Cloud PCs in Shared mode with experience type Cloud App begin provisioning. You can track this under All Cloud PCs. You will see items in a Provisioning status as they build.
This is a great time to grab coffee, maybe even a sandwich. If you’re like me, you’re still daydreaming about those Savannah biscuits. Either way, we’ve all been there.
Once the first Cloud PC is fully provisioned, the apps discovered on the image should show as “Ready to publish” in the All Cloud Apps area.
Step 4. Publish your Cloud Apps
Now for the fun part.
- Go to Windows 365 > All Cloud Apps in the Intune admin center.
- Find an app that shows Ready to publish.
- Select the app. A details pane opens with things like display name, description, command line, and icon settings.
- Click Publish to go with defaults or Edit if you want to customize first.
You will see statuses move like this:
Ready to publish > Publishing > Published
Additionally, this is where you will notice the payoff from your Device Preparation policy. Those Allowed Applications can show up here too.
Step 5. The end-user experience
Users access published Cloud Apps through the Windows App, which is the same client used for standard Windows 365 Cloud PCs and Azure Virtual Desktop.
Once apps are published, users will see an Apps area in the Windows App navigation. From there, they can:
- Launch apps with a click
- Favorite apps for quick access
- Search and filter to find what they need fast
Fun observation. When a Cloud App initializes, the connection window can briefly show “RemoteApp”, which is a nice little wink at the AVD DNA behind the scenes.
Security notes
Cloud Apps does not mean “cloud wild west.”
- You can still wrap access in Conditional Access policies.
- Your Intune security policies applied to the provisioned Cloud PCs still apply.
So yes, lock it down as much as you need to.
Wrapping up
Windows 365 Cloud Apps is one of those features that makes you wonder why it didn’t exist sooner. It lets you deliver just what the user needs, without the overhead of a full desktop. In other words, it hands them the biscuit, not the kitchen.
If you are already living in Windows 365 and Intune, the learning curve is refreshingly small. Conversely, if VDI complexity has been the thing keeping you on the sidelines, Cloud Apps might be the easiest on-ramp you have had in a while.
