I'm looking for advice on deploying and managing Microsoft 365 Cloud PCs in an enterprise environment. Ideally, I'd like an infrastructure-as-code approach that works with tools such as Terraform or Ansible and integrates with a CI/CD pipeline. Is it practical to automate Cloud PC management this way, or would a PowerShell-based CI/CD solution be simpler and more appropriate? I'm especially interested in guidance on what should be automated, such as provisioning policies, networking, images, user assignment, joiner/mover/leaver workflows, and reprovisioning.
3 Answers
A full PowerShell deployment workflow would probably be overkill for the normal provisioning process. Cloud PCs are designed to follow policies, so focus automation on the policies, licensing, user lifecycle processes, and reprovisioning rather than trying to manage every machine directly. PowerShell can still be useful for joiner/mover/leaver workflows or one-off operational tasks.
Terraform or OpenTofu with a CI/CD system such as GitHub Actions can work well, especially for the Azure resources around the Cloud PCs. Treat Terraform and Ansible as complementary rather than interchangeable: use declarative infrastructure tooling for repeatable resource and policy configuration, and use scripts or Ansible for operational workflows where needed. Before committing, verify that the provider or module supports the specific Cloud PC and Microsoft Graph resources you need, since coverage may not be as mature as it is for Azure Virtual Desktop.
Cloud PCs are largely policy- and license-driven rather than individually created through a deployment script. Once the provisioning policy, network configuration, and image settings are in place, assigning the appropriate license and policy to a user triggers provisioning automatically. Infrastructure-as-code can still be useful for the surrounding Azure resources, networking, images, and policy configuration. The best approach depends on what problem you’re trying to solve, but there usually isn’t much value in scripting the creation of each Cloud PC.
That matches my understanding. Cloud PCs are assigned through licensing, with the provisioning policy handling the actual deployment. Some of the policy configuration may be automatable through Microsoft Graph, but individual Cloud PC creation generally isn’t necessary.
That makes sense for the supporting infrastructure. I’ve used Terraform successfully for larger Azure Virtual Desktop environments, but I’d want to confirm the current Cloud PC module and provider coverage before building the pipeline around it.