Why Fraport left classic VDI
Fraport operates Frankfurt Airport and manages airport services at 30 locations on four continents. Microsoft says it supports more than 20,000 employees, from apron crews to office staff.
For years, those users worked on a conventional on-premises VDI in a data center. According to the story, the environment had become complex, costly and hard to maintain. Core software and the applications that depended on it were also nearing end of support.
Thorsten Fronzek, Senior Manager Digital Workplace, said provisioning a workstation could take hours. He also said adapting a physical hardware landscape was always a challenge, and that too much effort went into keeping the infrastructure alive. The wider workplace program also pushed toward cloud-managed endpoints and Zero Trust security.
The reliability worry
Fronzek said there was initial caution about reliability and operational continuity. In his words, downtime at an airport is not an option. Fraport says it evaluated whether a cloud approach could meet its availability and security requirements before committing. It prioritized resilience, centralized control and consistent security across endpoints.
This is the question most enterprise admins would ask first. The story doesn't publish uptime figures or outage statistics, so the case says nothing measurable about resilience. It only says the evaluation happened.
What was built
Under Project Sunrise, Fraport's internal teams designed and implemented a cloud-managed workplace on Windows 365 Cloud PCs and Intune. Microsoft partner glueckkanja joined later, through a Microsoft-funded consulting initiative. Its scope was narrower than the whole program:
- It covered about 500 Windows 365 licenses and selected Intune Suite capabilities.
- It reviewed the existing approach, validated selected architectural and operational decisions, and evaluated Intune Suite features.
- Microsoft explicitly says the broader transformation was led and implemented by Fraport's own teams.
The resulting model has centralized endpoint management and consistent Zero Trust policies. Employees can sign in from any device and reach a configured, cloud-hosted workspace within minutes, with no physical setup.
Windows 365 Link for frontline staff
For shared and shift-based roles, Fraport added Windows 365 Link devices. Per Microsoft, these are compact, Intune-managed devices that only connect to a Cloud PC. They sit in secure shared locations, and apron crews can sign in to their own Cloud PC from them. They reach HR information, company communications and role-specific apps without needing a laptop.
Microsoft Learn's security documentation for Link explains why this suits shared spaces:
- Link runs a small, purpose-built Windows-based operating system called Windows CPC. That claim comes from Microsoft Learn's Link security page in the evidence packet, not from the search results above.
- All administration goes through Intune, with no local applications installed and no local admin users.
- End users can't reach the device's local storage, so enterprise data can't be saved on it.
- Sign-in is passwordless, using a FIDO2 security key or web sign-in. Link only connects to Cloud PCs configured for single sign-on.
The Learn page describes the product in general. It doesn't say how many Link devices Fraport deployed or how they are configured.
How the provisioning mechanism works
Microsoft's documentation explains why a cloud model can be faster than racking hardware. Windows 365 automatically provisions Cloud PCs for licensed users in a provisioning policy's Entra groups. After the policy is created, the service handles the rest. Intune is the management surface. Admins can watch provisioning status and Cloud PC health there.
Provisioning behavior that matters if you try this yourself:
- For Enterprise and Reserve, a user assigned to several provisioning policies gets only the first one. The others are ignored.
- If provisioning fails, it retries automatically twice. Admins can then use the Reprovision action on a failed Cloud PC.
- A user with a license but no assigned policy gets no Cloud PC. Intune shows a "Not provisioned" status.
- An Autopilot device preparation policy linked to the provisioning policy makes Windows 365 wait until the specified apps and scripts finish installing. That keeps the essential software ready before first sign-in. It also means that time counts toward the provisioning window.
None of this proves Fraport's 20-minute figure. It only shows the mechanics a cloud-provisioned model rests on.
The reported results
Microsoft reports these outcomes:
- Device provisioning fell from hours to roughly 20 minutes, an estimated reduction of more than 80%.
- More than 16,500 endpoints are managed centrally through Intune.
- 1,800 Windows 365 Cloud PCs are in operation, replacing the legacy on-premises infrastructure.
- Onboarding for employees and contractors is faster, and total operating costs are reduced.
The story frames these as results of the whole Project Sunrise program, not of the 500-license partner workstream.
What to take from it, and what not to
Reasonable takeaways:
- A hosted-desktop model with centralized Intune management can cut hardware-dependent provisioning steps. A Cloud PC doesn't need a physical build before someone can work.
- Pairing Cloud PCs with thin, locked-down access devices is a credible pattern for shift-based and shared-terminal staff.
- Zero Trust policies applied centrally, with passwordless sign-in, fit that model.
Cautions:
- The 20-minute figure is Fraport's. The story doesn't give the old baseline, the measurement method, the network design or the licensing mix.
- No cost numbers are published. "Reduced operational costs" is a claim without a dollar, euro or percentage figure.
- Cloud PC counts (1,800) are small next to the 16,500 managed endpoints. The story doesn't break down what the other endpoints are.
- Microsoft chose to publish this story. Customer stories tend to emphasize wins, and the 2025 Partner of the Year Cloud Endpoints award it mentions is not an independent audit of results.
What's next at Fraport
The story says Fraport is in negotiations to grow Windows 365 toward 3,000 to 5,000 seats and to extend the model to more departments. That is a target, not a completed rollout. It is also exploring AI workflows on Azure, including a proposed "lighthouse" AI agent for business processes. Microsoft 365 Copilot is already used extensively there. Those items are future plans, and the story doesn't tie them to the provisioning gains.
Bottom line for IT admins
If you run an aging VDI estate, Fraport's story is a useful example of the Cloud PC and Intune approach at airport scale. Don't copy the 20-minute number into your own business case. Pilot with your own images, apps, network paths and Autopilot device preparation settings, and time it yourself.