Windows 365 Cloud PC provisioning failed: finding the cause, fixing the ANC and retrying

You assigned the licence and the provisioning policy, waited, and the Cloud PC landed in Failed. Windows 365 provisioning is a chain of Azure, Active Directory, Microsoft Entra ID and Intune steps, and the error text usually tells you which link broke if you know where to look. In this post I'll cover how provisioning works, how to read the Azure network connection health checks, the failure reasons Microsoft documents, and the right way to retry.

Symptoms#

• Devices › All Cloud PCs shows the device with status Failed and a link to the failure details, or Provisioned with warnings when a non-critical step failed.
• The user has a Windows 365 licence but the row says Not provisioned: no provisioning policy is targeted at them yet. This is informational, not an error.
• New Cloud PCs sit in Pending because every licence is tied to an existing Cloud PC, including ones In grace period.
• On Devices › Provision Cloud PCs › Azure network connection, the connection shows Checks failed or Checks successful with warnings.

Why it happens#

Provisioning starts automatically when a user holds a Windows 365 licence and is a member of a group assigned to a provisioning policy (Devices › Provision Cloud PCs › Provisioning policies); for Windows 365 Enterprise, only the first assigned policy is used. The policy defines the join type and network: Microsoft Entra join on a Microsoft hosted network needs no Azure subscription or domain at all, while Microsoft Entra join on an Azure network connection (ANC) or Hybrid Microsoft Entra join plugs the Cloud PC's virtual NIC into your own virtual network and, for hybrid, joins it to your Active Directory domain. Users need Windows E3, Intune, Microsoft Entra ID P1 and Windows 365 licences; you need the Intune Administrator or Windows 365 Administrator role.

The service performs a device-based MDM enrollment, so your default enrollment restrictions must allow Windows (MDM) corporate enrollment. When a step fails, Windows 365 retries twice; after three failures it marks the Cloud PC Failed and shows the error, and about three hours later it cleans up the Intune object, the Microsoft Entra device object and the vNIC (on-premises computer accounts are disabled, not deleted). For ANC-based policies the service also runs health checks every six hours and blocks provisioning while the connection is unhealthy. These are the documented checks:

• DNS can resolve Active Directory domain
• Active directory domain join
• Endpoint connectivity
• Microsoft Entra device sync (warning)
• Azure subnet IP address usage
• Azure tenant readiness
• Azure virtual network readiness
• First party app permissions exist on Azure subscription, resource group and virtual network
• Environment and configuration are ready
• Intune enrollment restrictions allow Windows enrollment
• Localization language package readiness
• UDP connection check
• Single sign-on configuration

How to fix it#

1. Read the error, not just the status. Select the Failed link on the Cloud PC and match the message against the table below. For a policy-wide view, open the provisioning policy and look at Action Status.

   Documented error	What it means	Where to look
   Azure network connection isn't healthy	The ANC failed its checks, or a six-hourly refresh failed mid-provisioning	Fix the failed check, retry the ANC, then retry provisioning
   Domain join failed	Domain, OU, credentials or domain controller reachability from the subnet	Test Add-Computer from a VM in the same subnet with the ANC credentials
   Microsoft Entra hybrid join failed	The computer object didn't reach Microsoft Entra ID within 90 minutes	Microsoft Entra Connect sync interval (30 minutes recommended, no more than 60), OU in sync scope, AD replication
   Microsoft Entra ID service connection point misconfigured	No SCP for the forest the Cloud PC joins	Configure the SCP with Microsoft Entra Connect
   Intune enrollment failed	Intune endpoints blocked, enrollment restrictions, unhealthy tenant, or Configuration Manager client push targeting the Cloud PC OU	Enrollment restrictions, firewall and proxy rules on the vNet
   Not enough IP addresses available	Each attempt allocates a new vNIC and IP; three attempts can exhaust a small subnet	Subnet size, leftover vNICs, resource locks
   Request disallowed by policy	An Azure Policy blocks the resources Windows 365 creates	Policy events in the Azure portal
   License not found / User not found / Provisioning policy not found	Something was removed while provisioning was in progress	Restore the licence, user or policy and retry

   Warnings such as Disk allocation error, Local administrator permissions error, Microsoft Teams optimization error, Time zone redirection error, Windows reset error or Windows Autopatch enrollment error leave the Cloud PC usable; Microsoft's fix for most of them is to retry provisioning.
2. Repair the Azure network connection. On the ANC, select View details for each failed check. Common causes:
   • DNS: the vNet's DNS servers must be internal servers that resolve the AD domain and its _ldap._tcp SRV records, not your public domain.
   • Domain join: the health check creates a disabled computer object named like CPC-Hth in the OU on every run. The join account needs rights on that OU and must not be limited by the default 10-computer join quota. A changed password is a classic cause.
   • Endpoint connectivity: no proxy between the subnet and the internet, no TLS inspection, and all Windows 365, Intune, Microsoft Entra ID and Azure Virtual Desktop endpoints allowed. Test from a VM on the same subnet with Test-NetConnection <host> -Port 443.
   • First party app permissions: the Windows 365 service principal needs Reader on the subscription, Windows 365 Network Interface Contributor on the resource group and Windows 365 Network User on the virtual network, assigned as Azure RBAC roles rather than classic administrator roles.
   • Subnet IP usage: use a dedicated subnet, remove unused vNICs, and check for CanNotDelete locks that stop failed attempts from releasing their NICs.
   • Microsoft Entra device sync is a warning, not a blocker; if it appears right after a sync and provisioning works, no action is needed.
   After fixing the cause, select Retry on the ANC (Intune Administrator or Windows 365 Administrator role required) and wait for Checks successful; the list refreshes every five minutes.
3. Retry the provisioning. Once the root cause is resolved, use the Retry button in the error dialog of the failed Cloud PC. If the Cloud PC had partially provisioned, or you changed the image, network or region in the policy, use the Reprovision remote action instead: it deletes the Cloud PC and recreates it with the policy's current settings.
4. Don't confuse grace period with failure. A Cloud PC In grace period lost its licence or policy assignment, often because a dynamic group changed. You have seven days to restore the assignment, or select End grace period deliberately to free the licence.
5. Check what runs after provisioning. The ANC checks validate infrastructure, not the policies you deploy afterwards. A VPN client pushed by Intune can break Azure Virtual Desktop connectivity, and the attack surface reduction rule that blocks process creation from PSExec and WMI commands is documented to stop language pack installation.

Verify the fix#

• The ANC shows Checks successful, or Checks successful with warnings for the device sync check only.
• Devices › All Cloud PCs moves the device from Provisioning to Provisioned, and it appears in Devices › All devices as an enrolled Windows device.
• Devices › Monitor › Cloud PC actions shows your Reprovision or Retry with status Succeeded; the report keeps 90 days of actions and offers Retry on failed ones.
• The user can sign in from the Windows App or the web portal, and for hybrid joined Cloud PCs the computer object is enabled in the right OU and synced to Microsoft Entra ID.

Prevent it next time#

• Prefer Microsoft Entra join on a Microsoft hosted network when nothing requires line of sight to a domain controller; it removes the domain join, hybrid join and ANC failure classes entirely.
• Size ANC subnets for three retries per Cloud PC plus disaster recovery headroom, and never bind firewall rules to a Cloud PC's private IP.
• Use a dedicated group for provisioning policy assignment rather than the licence group, and watch Devices › Cloud PC Overview for provisioning status and ANC health summaries.
• Keep a small Azure VM in the Cloud PC subnet for connectivity tests, and configure Windows 365 alerts so a grace period or a failed ANC check reaches you by email instead of as a user ticket.

References#

• Troubleshoot provisioning errors - Windows 365
• Azure network connection health checks in Windows 365
• Provisioning in Windows 365