[W365 5] The Cloud PC as a Privileged Access Workstation
A dedicated Cloud PC is the cheapest privileged access workstation ever built, and an incomplete one. This article takes both halves of that sentence seriously.
Articles
[W365 4] Operating Cloud PCs: The Endpoint You Already Know How to Manage
A Cloud PC fleet runs on the Intune practice you already have. What is genuinely new are three levers physical hardware never offered: restore, resize, and reprovision.
[W365 3] Designing the Enterprise Deployment
The provisioning policy is the blueprint of a Windows 365 Enterprise deployment. Join type, network, and image are authority decisions, and this is how I argue them.
[W365 2] Licensing and Sizing: The Four Variables and the Flex Question
In Windows 365, the license is the hardware. Sizing is an ongoing discipline, and a few of the doors, storage above all, only swing one way.
[W365 1] What Windows 365 Actually Is, and the Decision It Represents
Windows 365 is not VDI with a friendlier price sheet. It is a decision about who operates your desktop platform, and everything about the product follows from that division of responsibility.
[12.4] The Operational Layer: Remote Help, Advanced Analytics, and Tunnel for MAM
The operational capabilities the July 2026 change folded into Microsoft 365 E3: Remote Help built on your identity, Advanced Analytics with Device Query, and Tunnel for MAM. What each one is, where its boundary sits, and why these are the easy yes of the Suite.
[12.3] Microsoft Cloud PKI: A Managed Certificate Authority for Your Endpoints
Microsoft Cloud PKI retires the NDES, connector, and on-premises issuing CA you run purely to hand certificates to your endpoints. What it removes, the cloud-root versus bring-your-own-CA decision, what it will and will not issue, and the boundary that keeps it honest as an endpoint issuer rather than an enterprise PKI.
[12.2] Endpoint Privilege Management: Retiring Standing Local Admin
Endpoint Privilege Management runs users as standard and elevates specific tasks by policy. How the isolated-virtual-account model works, the spectrum of elevation types, why the reporting is the migration path, the Windows-only scope, and how it is now licensed through E5.
