I set out to run Windows 365 from my homelab so I could keep local resources under control while still using cloud desktops where they made sense. The useful bit is keeping the setup tight: identity, provisioning, privacy, automation, and a clear split for any Cloud PC that touches AI features.
Start with identity and provisioning. Use an Azure AD account for the Cloud PC identity. Assign the Windows 365 licence and create a provisioning policy in Intune or Microsoft Endpoint Manager. Pick an image that matches your needs; for light development and testing I use 2 vCPU and 8GB RAM images, which feel snappy without blowing costs. Set the provisioning policy with the OS image, one or two apps, and an assignment filter so only designated accounts get Cloud PCs. For network, choose split tunnelling so most internet traffic goes direct but sensitive traffic can route through your VPN back to the homelab. That lets a Cloud PC reach a local NAS or Pi without exposing everything to the cloud. Lock down local resource access with Intune device configuration profiles and app restrictions rather than broad firewall rules. For storage, decide if OneDrive is the main home for files. If it is, use Intune policies to control sync behaviour and file types so your NAS does not get pushed aside by cloud storage.
Tidy up privacy settings from the start. Turn down diagnostic data collection in Azure AD device settings and in the provisioning image. Disable automatic sharing of telemetry where you can. Limit camera and microphone access through group policies and app permission policies. If you are experimenting with AI integration, keep a separate policy for Cloud PCs that will use Copilot or similar features. Keep those Cloud PCs away from sensitive file shares or local services. I tag mine so automation can treat them differently. That way the AI bits get the data they need to be useful, without full read access to my home machines.
Automate the boring parts so the setup stays repeatable. Use Microsoft Graph and PowerShell for bulk licence assignment and provisioning policy deployment. My flow is simple: a small script assigns a licence, tags the account, and applies the provisioning policy. Then a scheduled task checks idle Cloud PCs and shuts them down overnight. That saves compute and keeps the homelab tidy. For monitoring and tuning, use the built-in metrics for CPU, memory and disk. Set alerts for storage thresholds and unexpected CPU spikes. If a Cloud PC shows sustained high I/O, move it to a larger disk or change the image. If you want to test AI workloads, spin up a Cloud PC with extra RAM for short runs, then tear it down automatically.
There are trade-offs. Cloud computing gives you convenience and removes the faff of local installs, but it leaves you with a vendor dependency and recurring costs. If absolute privacy and tight hardware control matter more than convenience, keep some workloads on local VMs or a Linux host. For my homelab I keep development, backups and sensitive device management local, and put session-heavy, disposable desktops into Windows 365. That keeps the home network under control, lets me test AI integration, and keeps the bills from wandering off.
