A new hire starts Monday. She lives two hours from the office, and she needs Outlook, Teams, your client files, and the one Windows program your bookkeeper refuses to give up. Do you ship her a laptop, or do you give her a desktop that lives in the cloud?
Microsoft gives you three ways to answer that question: Microsoft Intune with Windows Autopilot vs Windows 365 vs Azure Virtual Desktop. All three can be secured properly. This isn’t a question of which one is safer. It is a question of where the work happens, who owns the screen your staff work on, and how you want to pay for it.
Three Ways to Give Your Team a Secure Windows Desktop
The IT industry calls this end user computing: how your staff get a working desktop, their apps, and their files, wherever they sit. The three Microsoft options solve the same problem from different directions.
Option 1: The Laptop Is the Workplace (Intune and Autopilot)
Your company buys Windows laptops. Each one is registered with Windows Autopilot before it ships, so it can go straight from the supplier to your employee’s door. She opens the box, connects to her home internet, and signs in with her work account. The laptop then largely configures itself with your apps, your security policies, and your settings. In Microsoft’s words, “the only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated.” (Microsoft Learn, 2026)
Now, that is a bit of an over reach for most business users. There are usually a few apps that have not yet been automated by your IT admin, or need a hands on approach. Nevertheless, the device is mostly pre-provisioned and ready to go, in no time.
From then on, Microsoft Intune keeps the laptop patched, encrypted, and compliant with your policies. If it is lost or stolen, it is wiped remotely. Work happens on the laptop itself, so it runs at full speed, handles Teams video calls well, and keeps working on a plane or in a cottage with weak internet. Our guide to endpoint management explains what that day-to-day management looks like.
Option 2: A Personal Windows PC in the Cloud (Windows 365)
Windows 365 gives each person a Cloud PC: their own Windows desktop, hosted by Microsoft, opened from a laptop, a Mac, an iPad, or a web browser. Their desktop, apps, and settings are there every time, on whatever device they pick up.
The appeal is predictability. Microsoft bills Cloud PCs “in a per-user per-month cost model,” so “your organization doesn’t have to manage the variability of compute and storage costs of a traditional hosted desktop model.” (Microsoft Learn, 2026) Windows 365 Business is built for companies of up to 300 users. In Canada, plans currently list from CAD $42.90 to CAD $85.90 per user per month, depending on processing power and memory. That fee sits on top of your Microsoft 365 licensing.
Option 3: Shared Virtual Desktops You Control (Azure Virtual Desktop)
Azure Virtual Desktop runs in your own Azure subscription. Instead of one cloud machine per person, several staff can share one virtual machine. You can also publish a single application rather than a full desktop, so a user on a Mac opens just the accounting program in a window. Machines can shut down after hours, so you stop paying for computing power nobody is using.
The rights to use Azure Virtual Desktop are included with Microsoft 365 Business Premium. The Azure virtual machines and storage underneath it are billed separately, based on what you use (Microsoft Learn, 2026). It is the most flexible of the three options and the one that needs the most design work. We cover where that work pays off in When Azure Virtual Desktop Makes Sense for Small Business.
Side by Side: How the Three Options Compare
The table below compares the three options on the points owners ask us about most.
| What you are deciding | Intune and Autopilot | Windows 365 | Azure Virtual Desktop |
|---|---|---|---|
| Where the work happens | On a managed company laptop | On a personal Cloud PC hosted by Microsoft | On virtual machines in your own Azure subscription, often shared by several users |
| Where company data sits | On the laptop, encrypted, and synced to OneDrive and SharePoint | In the Cloud PC, not on the device used to connect | In Azure, not on the device used to connect |
| How you pay | Microsoft 365 licensing plus hardware every few years | Microsoft 365 licensing plus a fixed monthly fee per user | Microsoft 365 licensing plus Azure computing and storage, billed by use |
| New staff setup | Laptop ships to the employee and configures itself at first sign-in | Cloud PC is created when a licence is assigned | User is added to an existing virtual desktop pool |
| Personal devices | App protection keeps work data inside work apps | Staff connect from a personal device; company data stays in the Cloud PC | Staff connect from a personal device; IT controls copy, save and print |
| Works offline | Yes | No | No |
| Legacy Windows apps for Mac or iPad users | No | Yes, through a full Windows desktop | Yes, as a full desktop or a single published app |
| Design and management effort | Low to moderate | Low | Highest |
| Best fit | Most small business teams on company laptops | Contractors, mixed devices, predictable cost per person | Shared legacy apps, server replacement, strict data control |
All three options still need Conditional Access, endpoint detection and response, and ongoing patching.
Which One Fits Your Business?
Choose Intune and Autopilot when your staff work on company laptops, spend a lot of time on Teams video, travel or work offline, and run Microsoft 365 and web-based apps. This is the right answer for most of the teams we support, and it is where we start every conversation.
Choose Windows 365 when you want each person to have a full Windows desktop they reach from any device, with a predictable monthly price. It fits contractors on a project of a few months, staff who switch between an office PC and a home Mac, and teams who want virtual desktops without designing the infrastructure underneath.
Choose Azure Virtual Desktop when many people share one Windows application that cannot move to the web, when you are retiring an office server, or when your clients require that their data never sits on an employee’s device. Its shared machines also bring the per-person cost down as more users share the same capacity.
Most Businesses Mix Them
You do not have to pick one for everyone. A common setup is Intune and Autopilot on every company laptop, with a virtual desktop for one group: contractors, a branch office, or the three people who use the legacy line-of-business program. A law office we support moved its office server to Azure and gave staff virtual desktops they could reach from any device, and enrolled its computers in Microsoft Entra ID with access set by job function. You can read how it worked in our AVD case study for a law office.
Whichever mix you choose, remember that a Cloud PC or a virtual desktop is still a Windows computer. It needs patching, endpoint detection and response (EDR), and Conditional Access rules, the same as a laptop on a desk. We manage virtual desktops to the same standard as physical devices. Intune, Conditional Access, and EDR are part of our baseline for every client, whichever option you choose.
And a word about the people using them. Nobody gets excited about a new way to open their desktop. People like their own laptop, with their wallpaper and their files exactly where they left them. If you move a team to virtual desktops, plan for some patience in the first couple of weeks, and choose the option that asks the least of them for the job they do.
What Each Option Costs You
The three options are billed in different ways, and that difference matters more than any single price.
With Intune and Autopilot, you buy hardware every few years and pay for Microsoft 365 Business Premium, which includes Intune, Autopilot, and the Entra ID features behind Conditional Access. Your monthly cloud cost is the lowest of the three, and your hardware cost is the highest. Our post on whether Microsoft 365 Business Premium is worth it breaks down what that licence adds.
With Windows 365, you add a fixed monthly fee per person on top of Microsoft 365. Staff still need a secure device to connect from, but it does not need much power.
With Azure Virtual Desktop, you pay for Microsoft 365 plus Azure computing and storage, which rise and fall with the number of users and the hours they work. It needs more planning up front, and it rewards that planning with the lowest cost per person at scale.
None of these is a one-time purchase. Each one needs ongoing management, monitoring, and updates to keep working and stay secure.
FAQ
What is the difference between Intune and Azure Virtual Desktop?
Intune manages and secures the physical devices your staff use, while Azure Virtual Desktop runs Windows desktops in Microsoft’s cloud that staff open from any device. With Intune, work and data live on a managed company laptop. With Azure Virtual Desktop, work happens on a virtual machine in Azure, and the local device only displays it. Many businesses use both: Intune on every company device, and virtual desktops for specific users or applications.
Is Windows 365 the same as Azure Virtual Desktop?
No. Both put a Windows desktop in Microsoft’s cloud, but they are priced and managed differently. Windows 365 gives each user a dedicated Cloud PC for a fixed monthly fee, and Microsoft runs the infrastructure. Azure Virtual Desktop runs in your own Azure subscription, lets several users share one machine, and bills by usage. Windows 365 is simpler to run, and Azure Virtual Desktop is more flexible.
Do we still need Intune if we use virtual desktops?
Yes. The device someone uses to open a virtual desktop is still the front door to your data, and malware on that device can capture passwords and screen content. Intune manages company devices, protects work apps on personal devices, and feeds Conditional Access rules that block unhealthy devices. The virtual desktops themselves also need patching and security policies.
Do virtual desktops work without internet?
No. Windows 365 and Azure Virtual Desktop both need a steady internet connection, because the desktop runs in Microsoft’s data centres. If your staff travel often or work from places with poor connections, a managed laptop with Intune is the better fit, since it works offline and syncs when it reconnects.
Not Sure Which One Fits?
The right choice depends on how your team works, which applications you run, and where your data needs to stay. Here at TUCU, we manage and support both physical and virtual desktop solutions for small business and non-profit teams across Toronto and Durham Region. Book a free consultation, and we will look at all three with you. Sometimes the answer is a virtual desktop. Often it is the company laptops you already own, managed properly. Contact us today to book a free discovery call.
