Skip to content

Commit ae14972

Browse files
ErikjeMSErikjeMS
authored
Merge pull request #8648 from MicrosoftDocs/release-win365-gcc
move release win365 gcc to main
2 parents 9b19392 + bdd7536 commit ae14972

5 files changed

Lines changed: 317 additions & 5 deletions

File tree

‎windows-365/enterprise/TOC.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,10 @@ items:
8383
href: add-device-images.md
8484
- name: Convert image to Gen 2
8585
href: device-images-convert-generation-2.md
86+
- name: Prepare for Windows 365 Government
87+
items:
88+
- name: Set up tenants for Windows 365 Government
89+
href: set-up-tenants-windows-365-gcc.md
8690
- name: Provisioning
8791
items:
8892
- name: Create and assign provisioning policy

‎windows-365/enterprise/introduction-windows-365-government.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
# required metadata
3+
title: What is Windows 365 Government?
4+
titleSuffix:
5+
description: Learn about Windows 365 Government.
6+
keywords:
7+
author: ErikjeMS
8+
ms.author: erikje
9+
manager: dougeby
10+
ms.date: 10/3/2022
11+
ms.topic: overview
12+
ms.service: cloudpc
13+
ms.subservice:
14+
ms.localizationpriority: high
15+
ms.technology:
16+
ms.assetid:
17+
18+
# optional metadata
19+
20+
#ROBOTS:
21+
#audience:
22+
23+
ms.reviewer:
24+
ms.suite: ems
25+
search.appverid: MET150
26+
#ms.tgt_pltfrm:
27+
ms.custom: intune-azure; get-started
28+
ms.collection: M365-identity-device-management
29+
---
30+
31+
# What is Windows 365 Government?
32+
33+
Windows 365 Government is cloud-based service that automatically creates virtual machines (Cloud PCs) for US government users. This service spans across a regulated US Government Community Cloud (GCC) and a public facing cloud. It meets federal, state, and local US government needs to securely stream Windows apps, data, content, and settings on Cloud PCs from regulated clouds to any device at any time.
34+
35+
Windows 365 Government customers are government agencies or public entities that qualify to use services hosted in GCC and GCC High. The services in the GCC and GCC High clouds must meet specific requirements and pass rigorous audit reviews before customers are allowed to use them.
36+
37+
For GCC environments, users that access Windows 365 Government Cloud PCs have an identity in the public cloud while the underlying resources and content are secured in a regulated US government cloud.
38+
39+
Windows 365 Government supports this scenario in a secure, scalable, and transparent manner. It provides flexibility to administrators to manage users in the public cloud, resources in the government cloud, and the dynamic relationship between the two.
40+
41+
Windows 365 Government is available GCC and GCC High customers in the US, as well as contractors (in US entities) holding or processing data on behalf of US government agencies.
42+
43+
For more information about Cloud PCs and Windows 365, see [What is Windows 365?](..\overview.md) For more information about purchasing, see [How to buy Windows 365 Government](https://aka.ms/win365).
44+
45+
## Features not yet supported Windows 365 Government
46+
47+
The following features are not yet supported for Windows 365 GCC and/or GCCH.
48+
49+
| Feature | GCC | GCCH |
50+
|:----|:----|:----|
51+
|Windows 11 support|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
52+
|Provision Cloud PCs with Secure Boot and vTPM|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
53+
|Configure installed language and region for provisioning Cloud PCs|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
54+
|Digital forensics and placing a Cloud PC under review|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
55+
|Unified dashboard|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
56+
|Virtualization-based workloads|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
57+
|Endpoint analytics support|![Check](./media/manage-rdp-device-restrictions/checkmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
58+
|Windows 365 Security baseline|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
59+
|RDP Shortpath for public networks|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
60+
|Windows 365 System based alerting on Microsoft Endpoint Manager for Cloud PCs|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
61+
|User initiated feedback in End User Portal and Windows 365 Web Client|![X](./media/manage-rdp-device-restrictions/xmark.png)|![X](./media/manage-rdp-device-restrictions/xmark.png)|
62+
63+
## Next steps
64+
65+
To learn more about Windows 365, see [What is Windows 365?](..\overview.md)

‎windows-365/enterprise/requirements-network.md‎

Lines changed: 96 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,9 @@ Each customer has its specific requirements based on the workload they use to pr
3939
4040
## General network requirements
4141

42-
To use your own network and provision Azure AD joined Cloud PCs, you must meet the following requirements:
42+
### [Windows 365 Enterprise](#tab/enterprise)
43+
44+
To use your own network and provision Azure Active Directory (Azure AD) joined Cloud PCs, you must meet the following requirements:
4345

4446
- Azure virtual network: You must have a virtual network (vNET) in your Azure subscription in the same region as where the Windows 365 desktops are created.
4547
- Network bandwidth: See [Azure’s Network guidelines](/windows-server/remote/remote-desktop-services/network-guidance).
@@ -50,8 +52,33 @@ To use your own network and provision Hybrid Azure AD joined Cloud PCs, you must
5052
- The Azure virtual network must be able to resolve DNS entries for your Active Directory Domain Services (AD DS) environment. To support this resolution, define your AD DS DNS servers as the DNS servers for the virtual network.
5153
- The Azure vNet must have network access to an enterprise domain controller, either in Azure or on-premises.
5254

55+
### [Windows 365 Government](#tab/government)
56+
57+
All of the Windows 365 Enterprise requirements apply to [Windows 365 Government](introduction-windows-365-government.md) with the following additions:
58+
59+
#### Azure Active Directory joined Cloud PCs
60+
61+
To use your own network and provision Azure AD joined Cloud PCs, you must meet the following requirements:
62+
63+
- The customer must have a subscription in the Azure Government environment.
64+
- Azure virtual network: You must have a virtual network (vNET) in your Azure Government subscription in the same region as where the Windows 365 Cloud PCs are created. For Government Community Cloud (GCC) and Government Community Cloud High (GCCH), this will be a US Gov region.
65+
- Network bandwidth: See [Azure’s Network guidelines](/windows-server/remote/remote-desktop-services/network-guidance).
66+
- A subnet within the vNet and available IP address space.
67+
68+
#### Hybrid Azure AD joined Cloud PCs
69+
70+
To use your own network and provision Hybrid Azure AD joined Cloud PCs, you must meet the above requirements, and the following requirements:
71+
72+
- The customer must have a subscription in the Azure Government environment.
73+
- The Azure virtual network must be able to resolve DNS entries for your Active Directory Domain Services (AD DS) environment. To support this resolution, define your AD DS DNS servers as the DNS servers for the virtual network.
74+
- The Azure vNet must have network access to an enterprise domain controller, either in Azure or on-premises.
75+
76+
---
77+
5378
## Allow network connectivity
5479

80+
### [Windows 365 Enterprise](#tab/ent)
81+
5582
You must allow traffic in your Azure network configuration to the following service URLs and ports:
5683

5784
- [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints)
@@ -101,12 +128,78 @@ You must allow traffic in your Azure network configuration to the following serv
101128
- enterpriseregistration.windows.net
102129
- global.azure-devices-provisioning.net (443 & 5671 outbound)
103130
- hm-iot-in-prod-preu01.azure-devices.net (443 & 5671 outbound)
104-
- hm-iot-in-prod-prap01.azure-devices.net (443 & 5671 outbound)
105-
- hm-iot-in-prod-prna01.azure-devices.net (443 & 5671 outbound)
131+
- hm-iot-in-prod-prap01.azure-devices.net (443 & 5671 outbound)
132+
- hm-iot-in-prod-prna01.azure-devices.net (443 & 5671 outbound)
106133
- hm-iot-in-prod-prau01.azure-devices.net (443 & 5671 outbound)
107134

108135
All endpoints connect over port 443.
109136

137+
### [Windows 365 Government](#tab/gov)
138+
139+
You must allow traffic in your Azure network configuration to the service URLs and ports listed in this section. All endpoints connect over port 443 unless specified otherwise.
140+
141+
- GCC: [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints).
142+
- GCC: [Azure Virtual Desktop required URL list](/azure/virtual-desktop/safe-url-list).
143+
- GCCH: [Microsoft Intune network endpoints for US government deployments](/mem/intune/fundamentals/intune-us-government-endpoints).
144+
- GCCH: [Required URLs for Azure Virtual Desktop for US government deployments](/azure/virtual-desktop/safe-url-list?tabs=azure-for-us-government).
145+
146+
#### Cloud PC required URLs
147+
148+
| Address:Port | Required for |
149+
| --- | --- | --- |
150+
| 168.63.129.16:80 | GCC, GCCH |
151+
| 168.63.129.16:32526 | GCC, GCCH |
152+
| 168.63.129.16:53 | GCC, GCCH |
153+
| https://ghp01.ghp.cpcgateway.usgovtrafficmanager.net | GCCH |
154+
| https://gcp01.gcp.cpcgateway.usgovtrafficmanager.net | GCC |
155+
| TBD cmd agents / hermes related endpoint | |
156+
| 168.63.129.16:80 | GCC, GCCH |
157+
| cpcstprovghpghp01.blob.core.usgovcloudapi.net:443<br>cpcsaamssa1ghpghp01.blob.core.usgovcloudapi.net:443<br>cpcstcnryghpghp01.blob.core.usgovcloudapi.net:443<br>cpcsacnrysa1ghpghp01.blob.core.usgovcloudapi.net:443<br> | GCCH |
158+
| cpcstprovgcpgcp01.blob.core.usgovcloudapi.net:443<br>cpcsaamssa1gcpgcp01.blob.core.usgovcloudapi.net:443<br>cpcstcnrygcpgcp01.blob.core.usgovcloudapi.net:443<br>cpcsacnrysa1gcpgcp01.blob.core.usgovcloudapi.net:443 | GCC |
159+
160+
#### Intune-dependent URLs
161+
162+
| Address:Port | Required for |
163+
| --- | --- | --- |
164+
| portal.manage.microsoft.us:443 | GCCH |
165+
|m.manage.microsoft.us:443 | GCCH |
166+
| mam.manage.microsoft.us:443 | GCCH |
167+
| wip.mam.manage.microsoft.us:443 | GCCH |
168+
| Fef.FXPASU01.manage.microsoft.us:443 | GCCH |
169+
| portal.manage.microsoft.com:443 | GCC |
170+
| m.manage.microsoft.com:443 | GCC |
171+
| fef.msuc03.manage.microsoft.com:443 | GCC |
172+
| mam.manage.microsoft.com:443 | GCC |
173+
| wip.mam.manage.microsoft.com:443 | GCC |
174+
175+
#### Azure Active Directory-dependent URLs
176+
177+
| Address:Port | Required for |
178+
| --- | --- | --- |
179+
| login.microsoftonline.us | GCCH |
180+
| enterpriseregistration.microsoftonline.us:443 | GCCH |
181+
| login.live.com:443 | GCCH, GCC |
182+
| login.microsoftonline.com:443 | GCC |
183+
| enterpriseregistration.windows.net:443 | GCC |
184+
185+
#### Azure Virtual Device-dependent URLs
186+
187+
| Address:Port | Required for |
188+
| --- | --- | --- |
189+
| rdweb.wvd.azure.us:443 | GCCH |
190+
| rdbroker.wvd.azure.us:443 | GCCH |
191+
| rdweb.wvd.microsoft.com:443 | GCC |
192+
| rdbroker.wvd.microsoft.com:443 | GCC |
193+
194+
#### Localization package
195+
196+
| Address:Port | Required for |
197+
| --- | --- | --- |
198+
| download.microsoft.com:443 | GCCH, GCC |
199+
| software-download.microsoft.com:443 | GCCH, GCC |
200+
201+
---
202+
110203
### Remote Desktop Protocol (RDP) broker service endpoints
111204

112205
Direct connectivity to Azure Virtual Desktop RDP broker service endpoints is critical for remoting performance to a Cloud PC. These endpoints affect both connectivity and latency. To align with the [Microsoft 365 network connectivity principles](/microsoft-365/enterprise/microsoft-365-network-connectivity-principles#new-office-365-endpoint-categories), you should categorize these endpoints as **Optimize** endpoints. We recommend that you use a direct path from your Azure virtual network to those endpoints.
@@ -115,7 +208,6 @@ To make it easier to configure network security controls, use Azure Virtual Desk
115208

116209
Changing the network routes of a Cloud PC (at the network layer or at the Cloud PC layer like VPN) might break the connection between the Cloud PC and the Azure Virtual Desktop RDP broker. If so, the end user will be disconnected from their Cloud PC until a connection be re-established.
117210

118-
119211
## DNS requirements
120212

121213
As part of the Hybrid Azure AD Join requirements, your Cloud PCs must be able to join on-premises Active Directory. That requires that the Cloud PCs be able to resolve DNS records for your on-premises AD environment.

‎windows-365/enterprise/requirements.md‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ keywords:
77
author: ErikjeMS
88
ms.author: erikje
99
manager: dougeby
10-
ms.date: 08/30/2022
10+
ms.date: 10/03/2022
1111
ms.topic: how-to
1212
ms.service: cloudpc
1313
ms.subservice:
@@ -34,6 +34,8 @@ To use Cloud PCs, you must meet the following requirements:
3434

3535
## Azure requirements
3636

37+
### [Windows 365 Enterprise](#tab/enterprise)
38+
3739
None, if you plan on provisioning Azure AD joined Cloud PCs on a Microsoft hosted network.
3840

3941
If you choose to provision Cloud PCs on your own network, an active Azure subscription with the following configurations is required:
@@ -43,6 +45,18 @@ If you choose to provision Cloud PCs on your own network, an active Azure subscr
4345
- Network contributor permissions on the resource group.
4446
- A network contributor role on the vNet.
4547

48+
### [Windows 365 Government](#tab/government)
49+
50+
All of the Windows 365 Enterprise requirements apply with the following additions.
51+
52+
A subscription in Azure Government is required for Windows 365 Government customers who would like to use any of the following capabilities:
53+
54+
- Hybrid AADJ
55+
- AADJ and with the customer providing their own network
56+
- Custom Images
57+
58+
---
59+
4660
## Azure Active Directory and Intune requirements
4761

4862
- A valid and working Intune and Azure Active Directory tenant.
@@ -76,6 +90,8 @@ You must use [Microsoft Endpoint Manager admin center](https://admin.microsoft.c
7690

7791
## Supported Azure regions for Cloud PC provisioning
7892

93+
### [Windows 365 Enterprise](#tab/ent)
94+
7995
Windows 365 manages the capacity and availability of underlying Azure resources as part of the service. Windows 365 partners closely with Azure to select regions that meet our Windows 365 service requirements for availability and capacity. On availability, we use features like availability zones in Azure to provide in-region resiliency as built-in value to the service. You can create a virtual network or use the Microsoft hosted network for provisioning Cloud PCs in the following Azure regions:
8096

8197
- US Central
@@ -99,6 +115,13 @@ Windows 365 manages the capacity and availability of underlying Azure resources
99115
- Switzerland North
100116
- UK South
101117

118+
### [Windows 365 Government](#tab/gov)
119+
120+
- US Gov Virginia
121+
- US Gov Arizona
122+
123+
---
124+
102125
<!-- ########################## -->
103126
## Next steps
104127

0 commit comments

Comments
 (0)