I have a blog post about creating a Windows 365 Cloud PC Provisioning Policy using PowerShell. In this post blog, I will demonstrate how to create the provisioning policy using PowerShell and MS Graph API with beta modules for Windows 365 Cloud PC – Frontline Workers.
Introduction
I will not attempt to explain Frontline, but the best explanation is here: What is Windows 365 Frontline? | Microsoft Learn.
Example – Each Windows 365 Frontline license can be shared with up to three employees. This means that if you have 30 employees, you only need to purchase 10 licenses to provision the CloudPC for all 30 employees with access over the day. However, note you are buying the frontline license based on the active sessions. You must purchase the license accordingly if you have more than 10 active workers in a shift.
What happens when license are exhausted?
In my demo tenant, I have two licenses for Frontline workers. When I try to log in to the third one (Note I have already logged into 2 active sessions and running them.) Get the following message.
Connect to MS Graph API
Step 1 – Install the MS Graph Powershell Module
#Install Microsoft Graph Beta Module
PS C:WINDOWSsystem32> Install-Module Microsoft.Graph.BetaStep 2 – Connect to scopes and specify which API you wish to authenticate to. If you are only doing read-only operations, I suggest you connect to “CloudPC.Read.All” in our case, we are creating the policy, so we need to change the scope to “CloudPC.ReadWrite.All”
#Read-only
PS C:WINDOWSsystem32> Connect-MgGraph -Scopes "CloudPC.Read.All" -NoWelcome
Welcome To Microsoft Graph!
OR
#Read-Write
PS C:WINDOWSsystem32> Connect-MgGraph -Scopes "CloudPC.ReadWrite.All" -NoWelcome
Welcome To Microsoft Graph!
Step 3 – Check the User account by running the following beta command.
#Beta APIs
PS C:WINDOWSsystem32> Get-MgBetaUser -UserId admin@wdomain.com
Create Provisioning Policy (Frontline Worker)
We are creating a provisioning policy that involves the following: avdwin365mem/win365frontlineCreateProvPolicy at main · askaresh/avdwin365mem · GitHub
- Azure AD Joined Cloud PC desktops
- The region for deployment – Australia East
- Image Name – Windows 11 Enterprise + Microsoft 365 Apps 22H2 (from the Gallery)
- Language & Region – English (United States)
- Network – Microsoft Managed
- Cloud PC Naming format – FLW-%USERNAME:5%-%RAND:5% (FLW – Frontline Worker)
$params = @{
displayName = "Demo-FrontLine"
description = "Front Line Workers Prov Policy"
provisioningType = "shared"
managedBy = "windows365"
imageId = "MicrosoftWindowsDesktop_windows-ent-cpc_win11-22h2-ent-cpc-m365"
imageDisplayName = "Windows 11 Enterprise + Microsoft 365 Apps 22H2"
imageType = "gallery"
microsoftManagedDesktop = @{
type = "starterManaged"
profile = $null
}
enableSingleSignOn = $true
domainJoinConfigurations = @(
@{
type = "azureADJoin"
regionGroup = "australia"
regionName = "automatic"
}
)
windowsSettings = @{
language = "en-US"
}
cloudPcNamingTemplate = "FLW-%USERNAME:5%-%RAND:5%"
}
New-MgBetaDeviceManagementVirtualEndpointProvisioningPolicy -BodyParameter $paramsNote – Post provisioning, you need to add the assignment of a AAD group consisting of all the frontline users. In the future I can demonstrate the API call for assignments. You can also use Andrew Taylors post around using Graph to create the Windows 365 Group – Creating Windows 365 Groups and assigning licenses using Graph and PowerShell
Powershell Output
Policy will show up in the MEM Portal
Optional Properties
If you are doing on-premise network integration (Azure Network Connection) , then the following additional property and value is required. In my lab, I am leveraging the Microsoft Managed Network, so this is not required.
OnPremisesConnectionId = "4e47d0f6-6f77-44f0-8893-c0fe1701ffff"I hope you will find this helpful information for creating a frontline worker provisioning policy using PowerShell. Please let me know if I have missed any steps or details, and I will be happy to update the post.
Thanks,
Aresh Sarkari
Recent Comments