Windows 365 Provisioning Failure Due to Intune Policy Conflict
A Windows 365 enrollment failure caused by overlapping Intune policy assignments, with the fix centered on separating Cloud PC enrollment scopes from legacy baselines.
Overview
During Windows 365 provisioning, affected users failed at the enrollment stage and Cloud PCs remained in Provisioning failed. Investigation showed conflicting Intune policy assignments applying incompatible enrollment and compliance settings to the same user scope.
Problem Statement
Cloud PC provisioning failed consistently during enrollment, preventing users from receiving their Windows 365 desktop despite valid licensing and successful policy targeting.
Symptoms
- Cloud PC status switched from Provisioning to Provisioning failed in under 15 minutes.
- Enrollment errors appeared in Endpoint Manager and Windows 365 provisioning diagnostics.
- The same user failed repeatedly even after reprovisioning attempts.
- Device object creation succeeded, but post-enrollment policy processing failed.
Environment
| Component | Value | Why it mattered |
|---|---|---|
| Endpoint | Windows 365 Cloud PC | The failure occurred during Cloud PC enrollment and provisioning. |
| Management plane | Intune + Windows 365 admin center | Used to inspect policy assignments and provisioning diagnostics. |
| Recovery method | Policy redesign and scope separation | Removed the conflicting assignment overlap. |
Root Cause
The tenant had overlapping Intune assignments that pushed incompatible enrollment and compliance requirements to the same users during provisioning.
Investigation Process
- Validated user licensing and Windows 365 provisioning policy assignment.
- Collected provisioning diagnostics from Windows 365 admin center.
- Correlated enrollment failures with Intune device configuration and compliance assignments.
- Compared policy target groups and identified assignment overlap in dynamic user groups.
- Excluded pilot users from the legacy compliance baseline and retested provisioning.
Policies identified during investigation:
- Configuration Profile (Endpoint Security Baseline): 9e4f56be-6a5b-4d34-9b0c-12f0a5d1f801
- Configuration Profile (Cloud PC Enrollment Controls): 5b2d91a1-2ef0-47f2-a1b0-9478cb0ac4d6
- Compliance Policy (Strict Legacy Template): d3f7bf19-cc9e-4820-8bd7-c605f8a9e213
These overlapping policies created contradictory requirements during enrollment, causing the provisioning sequence to abort.
Solution
- Created a dedicated Cloud PC security group and excluded it from legacy device compliance profiles.
- Updated the provisioning policy with separated configuration profile assignments.
- Retriggered provisioning for the affected user pool.
Validation
- Provisioning completed successfully across all test users within 25 minutes.
- Intune device enrollment status reported healthy with zero assignment conflicts.
Lessons Learned
Always separate Cloud PC policy scopes from physical workstation baselines using dedicated dynamic device groups (e.g. device.deviceModel -contains "Cloud PC").