Windows 365 Business Cloud PC — No Local Admin + Intune MDM Not Enrolling

Question

Hi community,

I've just provisioned my first Windows 365 Business Cloud PC and running into two issues. Would appreciate any insight from those who've deployed Business tier before.

ENVIRONMENT

• License: Windows 365 Business
• Tenant: Microsoft 365 Business Standard + EMS E3
• Device join: Microsoft Entra Join (auto via Business provisioning)
• MDM authority: Microsoft Intune
• MDM user scope: Some — user confirmed in the scoped group

ISSUE 1 — User Not Local Admin

My understanding is that Windows 365 Business users should be local admins by default. However our provisioned user has standard user rights only. There is no local admin toggle in windows365.microsoft.com post-provisioning.

Questions:

• Is local admin default on Business correct, or does it depend on a setting at provisioning time?
• Is there any way to grant local admin on an already-provisioned Business Cloud PC without reprovisioning?

ISSUE 2 — MDM Enrollment Not Triggering

The Cloud PC shows as Entra Joined but is not enrolling into Intune MDM. User is confirmed in the MDM user scope group in Entra. Attempted Settings → Accounts → Access work or school → Sync with no result. Company Portal installed but cannot detect the account.

Questions:

• Should Business Cloud PCs auto-enroll into Intune when user is in MDM scope group?
• Is Intune management of Business Cloud PCs supported with M365 Business Standard/Basic + EMS E3?
• Is there a supported way to trigger enrollment without local admin access on the device?

Thanks in advance.

Answer 1

Hi Lance Yeaw,

The behavior you are seeing is perfectly normal for the Business tier. By default, Windows 365 Business Cloud PCs provision the primary user as a standard user. You do not need to reprovision the device to grant local administrator rights. You can elevate the account on the fly by navigating to your Microsoft 365 Admin Center or the Windows 365 web portal. Simply select the specific Cloud PC from your active devices and use the Change Account Type action to upgrade the user to a Local Administrator. The user will only need to sign out of their active Windows session and sign back in for the elevated token to take effect.

Your Intune enrollment failure comes down to a configuration toggle unique to Windows 365 Business. While having the user in the Entra MDM user scope is a baseline requirement, the provisioning engine will not hand the device off to Intune unless explicitly told to do so. You need to navigate to your Microsoft 365 Admin Center, go to Settings, then Org Settings, and select Windows 365 under the Services tab. There, you must check the box to enroll new Cloud PCs in Microsoft Intune. Because your user currently lacks the local admin privileges required to manually initiate an MDM enrollment through the Access work or school menu in Windows Settings, your most seamless solution is to enable this global setting and then issue a Reset command to that specific Cloud PC from the admin portal. This forces a clean reprovision that respects the Intune hand-off requirement.

Hope this answer brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VP

Answer 2

Windows 365 Business Cloud PCs and Windows 365 Enterprise Cloud PCs behave differently. The provided context only documents local admin and Intune enrollment behavior for Windows 365 Enterprise, but it still clarifies some of the mechanics that apply generally.

For Enterprise Cloud PCs:

• Local admin assignment is controlled by a User Settings policy. If provisioning completes but the user is not a local admin as defined by that policy, a “Local administrator permissions error” is raised.
• The documented remediation is: “Retry provisioning or create a new User Settings policy.” There is no supported in-place Cloud PC–specific toggle mentioned to fix local admin on an already-provisioned device.

“Windows 365 provisioned the Cloud PC but didn't grant the user local administrator permissions as defined by a User Settings policy. As a result, the user won't be an administrator on their Cloud PC… Suggested solution: Retry provisioning or create a new User Settings policy.”

For Intune enrollment on Enterprise Cloud PCs:

• Core provisioning includes an automatic device-based Intune MDM enrollment step after the Microsoft Entra ID object is available:
  • Step 4: Join to Microsoft Entra ID (Entra join or hybrid join).
  • Step 5: “Intune MDM enroll: After the Microsoft Entra ID object is available, the Cloud PC enrolls in Intune. This device enrollment doesn't need user credentials.”
• If Intune enrollment fails, the documented checks are:
  1. All required Intune endpoints are reachable from the Cloud PC’s virtual network.
  2. No MDM enrollment restrictions blocking Windows corporate enrollment.
  3. Intune tenant is active and healthy.
  4. If co-managing with Configuration Manager, the Cloud PC OU must not be targeted for client push; instead, deploy the ConfigMgr agent from Intune.
• Suggested troubleshooting: “Attempt an Intune enrollment using a test device or VM.”

“Windows 365 performs a device-based mobile device management (MDM) enrollment into Intune… Suggested solution: Attempt an Intune enrollment using a test device or VM.”

For Windows 365 Business Cloud PCs specifically (from the Business troubleshooting and app-deployment articles):

1. MDM authority and automatic enrollment configuration
   • The MDM authority must be set to Intune MDM Authority.
   • To allow Business Cloud PCs to enroll into Intune so admins can deploy apps:
     1. In the Intune admin center, ensure the Mobile Device Management Authority is Intune.
     2. Go to windows365.microsoft.com → Update organization settings.
     3. Enable Enroll new Cloud PCs in Microsoft Intune and save.
   • If Intune is not desired, the Business guidance is to:
     • Turn off automatic MDM enrollment in Microsoft Entra Mobility (MDM and MAM), and
     • Clear Enroll new Cloud PCs in Microsoft Intune in Organization Settings.

“Admins can deploy apps to users' Cloud PCs by first enrolling Windows 365 Business Cloud PCs into Microsoft Intune… Change setting to allow admins to enroll Cloud PCs in Intune… Select Enroll new Cloud PCs in Microsoft Intune > Save.”

2. MDM authority misconfiguration and enrollment failures
   • If the tenant is still on the legacy Microsoft Office 365 MDM Authority, certain Intune features (like the Enrollment Status Page) are not available until the authority is switched to Intune.
   • The context shows that changing the MDM authority to Intune resolves such issues.

“This is an older tenant, and it apparently got grandfathered in on the Microsoft Office 365 MDM Authority… That can be modified… after which I'm able to create an ESP without any issue.”

3. MDM authority and Windows 365 Business setup failures
   • For Business Cloud PCs, if automatic Intune enrollment is enabled but MDM configuration is incorrect, setup can fail or hang. The Business troubleshooting article instructs to:
     • Ensure Mobility (MDM and MAM) → Microsoft Intune is configured with MDM user scope = Some or All when Intune is used.
     • Ensure there are no MDM enrollment restrictions blocking Windows enrollment.
     • Ensure the MDM discovery URL is set to the Intune default.

“If the automatic enrollment of new Cloud PCs into the Microsoft Intune setting is turned on, users might see their Cloud PCs fail to complete their setup… Make sure that… There are no MDM enrollment restrictions on the tenant. Windows corporate device enrollment is allowed in custom and default policies.”

4. Licensing prerequisites for Intune management
   • For Cloud PCs to receive user policies from Intune, the user must have an Intune license assigned.

“Users who are assigned a Cloud PC must have an Intune license assigned to them to receive user policies. The CloudPCBPRT system account doesn't need to be assigned an Intune license.”

5. Supported trigger for Intune enrollment (Business)
   • The documented and supported mechanism for Windows 365 Business is service-driven enrollment controlled by:
     • Intune MDM authority,
     • MDM user scope and enrollment restrictions, and
     • The Enroll new Cloud PCs in Microsoft Intune toggle in Windows 365 Organization Settings.
   • The context does not describe any additional supported, user-initiated enrollment flow specific to Business Cloud PCs that bypasses these controls or requires local admin.

Based on the context:

• Local admin behavior and remediation are documented for Enterprise Cloud PCs via User Settings policies and reprovisioning; there is no documented in-place Cloud PC–specific local admin toggle.
• Intune enrollment for Cloud PCs is designed to be automatic and device-based after Entra join, provided:
  • MDM authority is Intune,
  • MDM user scope and enrollment restrictions allow Windows corporate enrollment,
  • Required Intune endpoints are reachable, and
  • The Windows 365 Business Enroll new Cloud PCs in Microsoft Intune setting is enabled.
• Users must have an Intune license to receive policies; the system account does not.
• Changing from legacy Office 365 MDM authority to Intune resolves certain enrollment/feature issues.

The context does not provide additional, Business-specific details on:

• Whether Windows 365 Business users are guaranteed local admin by default in all cases, or
• A supported, non-reprovisioning method to grant local admin on an already-provisioned Business Cloud PC, or
• A user-driven enrollment method that works without local admin beyond the service-driven automatic enrollment described above.

---

References:

• Troubleshoot provisioning errors
• Automated provisioning steps
• Troubleshoot Windows 365 Business Cloud PC setup issues
• Set up Intune so admins can deploy apps to Cloud PCs
• Can't create Intune Device Enrollment Status Page - Microsoft Q&A