Welcome back to our monthly roundup of Windows 365 and Azure Virtual Desktop updates, bringing what’s new, why it matters, and how to get started together in one place.
October's updates cover connectivity in Azure Government, session continuity for Windows 365 Flex, external identity and redirection controls, and new Intune settings for configuring and targeting Cloud PCs, including Reserve auto-deprovisioning that just lands in public preview.
Seamless user experience
A seamless Cloud PC experience means staying connected and picking up work without interruption. This month's updates focus on making connections more resilient and reconnects smoother.
RDP Multipath and RDP Shortpath
In the September recap, we shared that RDP Shortpath with TURN relay and RDP Multipath with TCP paths were rolling out in phases in Azure Government. Both are now generally available. RDP Multipath improves connection resiliency by maintaining multiple network paths and automatically switching to an available path when network conditions change. RDP Shortpath with TURN relay provides relayed UDP connectivity when a direct connection isn't possible. Together, they help users stay productive with fewer session interruptions, even as network conditions change or direct connections are unavailable.
For Azure Government, TURN relay uses the dedicated IP range 20.140.236.0/22 over UDP port 3478. Ensure your network configuration allows this range to use RDP Shortpath with TURN relay.
Session State Retention for Windows 365 Flex in dedicated mode
Session State Retention for eligible Windows 365 Flex dedicated Cloud PCs (Generally Available) lets users pick up where they left off. Previously, a Flex dedicated Cloud PC powered off when the user disconnected. Now, an eligible Cloud PC hibernates after a set idle period instead, so when users reconnect, their apps and work are just as they left them. Session State Retention works alongside Intelligent pre-start, which learns each user's sign-in pattern and starts the Cloud PC before they need it. Together, they make connecting and reconnecting faster and more seamless.
Security and reliability
A seamless experience also needs secure, flexible access. October's updates expand access for external users, tighten control over redirections and host pool identities.
Windows App iOS support for external identities is now generally available
In the September recap, we shared that Windows App was expanding access for external users with iOS support for external identities in preview. This capability is now generally available. External users, such as contractors, vendors, and partners, can now sign in to their Cloud PCs from Windows App on iPhone or iPad. With this release, external identities are supported in Windows App on Windows, macOS, iOS, and Android, and in a web browser in the commercial cloud.
Azure Virtual Desktop adds stronger security controls
Managed identity support for Azure Virtual Desktop host pools (Generally Available) lets IT admins give a host pool its own Azure identity. That identity carries the permissions Azure Virtual Desktop needs to manage virtual machines, key vaults, and networks on the admin's behalf. Features that use it include session host configuration, autoscale, Start VM on Connect, and Azure Virtual Desktop for Azure Local. Admins can grant each host pool only the access it needs, instead of relying on the shared Azure Virtual Desktop service principal. This gives them a more secure setup with tighter control over permissions. Action required: In a future service update, host pools that use a session host configuration will need a managed identity before you can add session hosts to them. Set one up now to avoid disruption.
RemoteApp support for context-based redirections (Preview) extends context-based redirections in Azure Virtual Desktop to RemoteApp sessions. Context-based redirections let IT decide when users can use their clipboard, drives, printers, and USB devices in a remote session. The decision is based on Microsoft Entra Conditional Access conditions such as device compliance, user role, or network location. IT configures it once on the host pool, and the policy applies to both desktop and RemoteApp sessions. With this feature, users get the access they need on trusted devices, and sensitive data stays protected everywhere else.
Easy manageability
Behind every seamless user experience is an IT team responsible for configuring, deploying, and managing it. October’s updates focus on giving admins more flexibility in how Cloud PCs are configured and targeted, while simplifying common management tasks at scale.
More flexible Cloud PC Settings in Intune
Default display settings for Cloud PCs (Generally Available) let IT set a default display experience for Cloud PCs, either a single display or all displays. Users can still override the default with their own display preferences in Windows App, giving IT a consistent starting point while preserving flexibility for individual users.
At the same time, assign Cloud PC settings to all users or all devices (Public Preview) enables Cloud PC configurations and Windows App settings to target user groups or all users, and remote connection experience settings can target device groups or all devices. This helps IT roll out a consistent baseline across the organization faster, while still allowing group-level targeting where it's needed.
New deprovisioning options: Bulk and automated deprovisioning
Bulk deprovisioning for Windows 365 Enterprise and Windows 365 Flex dedicated Cloud PCs in grace period (Generally Available) lets admins deprovision multiple Windows 365 Enterprise and Flex dedicated Cloud PCs in grace period at once, instead of waiting out the seven-day grace period or ending it one Cloud PC at a time. Admins can start it from the provisioning policy view or the Intune Bulk Action Wizard. This saves time when offboarding users, reorganizing teams, or cleaning up unused Cloud PCs, and reduces the repetitive manual work of removing them one by one.
Windows 365 Reserve auto-deprovisioning (Public Preview) is an optional setting that automatically deprovisions Reserve Cloud PCs that are provisioned but not actively connected to, based on a threshold configured by the IT admin. Once deprovisioned, the Cloud PCs must be reprovisioned before they can be used again. Any remaining Reserve Cloud PC access days are preserved and can be used after reprovisioning. Like user-initiated provisioning, this feature is disabled by default and fully governed by IT admin. To enable it, IT admins update the Cloud PC configuration settings for Windows 365 Reserve in Microsoft Intune, scope it to specific Microsoft Entra ID user groups, and can update the setting at any time.
Auto-deprovisioning helps organizations maximize the value of each user's 10-day Reserve Cloud PC entitlement, so access days aren't spent on Cloud PCs that sit unused.
Figure 1: configure Reserve auto-deprovisioning in Microsoft Intune admin centerWindows 11, version 26H2 images are now available for Windows 365 and Azure Virtual Desktop
Windows 11 Enterprise, version 26H2 images are now available for new Cloud PCs and session hosts, so organizations can deploy the latest Windows release from day one.
- Windows 365: select a 26H2 image from the gallery in your provisioning policy. The options are Windows 11 Enterprise 26H2, Windows 11 Enterprise + Microsoft 365 Apps 26H2, and Windows 11 Enterprise Developer Configuration + Microsoft 365 Apps 26H2.
- Azure Virtual Desktop: deploy session hosts from the Windows 11 Enterprise 26H2 or Windows 11 Enterprise + Microsoft 365 Apps 26H2 images in Azure Marketplace.
Partner news
EfficientEther helps IT teams and partners migrate to Windows 365 and manage Cloud PCs afterwards, using EtherInsights for sizing, cost and idle machines and EtherApps Forge to package legacy apps as MSIX. Free MSIX and EtherApps Forge training and certification is at etherapps.ai/training, and the new Windows 365 management pages are at efficientether.co.uk and https://efficientether.co.uk/products/etherinsights/windows-365.
Documentation updates
A good experience also depends on clear guidance for the IT teams who deploy and manage it. This month's documentation updates add requirements for Azure storage accounts used with Windows 365, and bring context-based redirection guidance for Windows 365 and Azure Virtual Desktop into one place.
Understand Azure storage requirements for Windows 365
A new Requirements for Azure storage accounts used with Windows 365 article outlines requirements for storage accounts used by Windows 365 features that copy Cloud PC snapshots to customer Azure storage accounts, including scenarios such as digital forensics, compliance, and disaster recovery.
Configure context-based redirections
The Configure context-based redirections article has been updated to bring Windows 365 and Azure Virtual Desktop guidance together in one resource. It includes updated guidance and screenshots for configuring context-based redirections using Microsoft Entra authentication context.
Figure 2: Configure context-based redirections for Windows 365 in Microsoft Intune.
Continue the conversation at Microsoft Ignite. Join us November 17–20 in San Francisco or online to explore the latest Windows innovations, connect with the experts behind them, and go deeper with sessions, demos, and hands-on experiences. Explore Microsoft Ignite and plan your experience. Then, keep the conversation going: join the Windows Tech Community and follow Windows IT Pro for the latest updates, insights, and best practices.
Microsoft