Windows 365 and AVD October 2026 Updates: Cloud PC Hibernation, Host Pool Identity and RDP Resilience

Here's what changed, which products and versions it applies to, and where the catches are.

Azure Government gets full RDP Shortpath and Multipath​

In September, Microsoft said RDP Shortpath with TURN relay and RDP Multipath with TCP paths were rolling out in phases in Azure Government. The October recap says both are now generally available.

• RDP Shortpath with TURN relay gives you relayed UDP connectivity when a direct connection can't be made.
• RDP Multipath keeps several network paths open and switches to a working one when conditions change.

The networking action item is simple: in Azure Government, TURN relay uses the dedicated range 20.140.236.0/22 over UDP port 3478. If your firewalls don't allow that range, Shortpath can't use the relay.

Microsoft Learn's Windows 365 RDP Multipath page, updated October 23, fills in what the recap leaves out:

The same page has a capacity warning that's easy to miss. Each active session can open up to five outbound paths: three UDP and two TCP. Plan firewall rules, NAT capacity and port-exhaustion limits for that. Ten thousand users can mean up to fifty thousand flows. Microsoft also recommends making RDP Shortpath the primary transport to get the full Multipath benefit. When UDP is blocked, connections fall back to TCP 443.

Section summary: Government tenants should allow the 20.140.236.0/22 range, update Windows App to 2.0.1069.0 or later, and check NAT capacity before turning this on at scale.

Flex dedicated Cloud PCs now hibernate instead of shutting down​

Session State Retention is now generally available for eligible Windows 365 Flex Cloud PCs in dedicated mode. Microsoft's Flex overview describes the old behavior plainly: when a user disconnected, the Cloud PC powers off, closing open apps and risking unsaved work. Now an eligible Cloud PC hibernates after an idle period, and the user reconnects to their open apps and windows.

How it works:

• Microsoft's change log says that after a user has been disconnected for a set idle period (default: 2 hours), an eligible Cloud PC preserves the session state instead of powering off.
• It works alongside Intelligent pre-start, which learns when each user signs in and starts the Cloud PC before they need it.

Limitations from Microsoft Learn:

• Cloud PCs that aren't hibernation-eligible continue to power off.
• Resizing to a size that doesn't support hibernation makes a Cloud PC ineligible.
• Some events, such as Windows Updates that require a reboot, start a Cloud PC fresh, so the previous session isn't preserved.

A note on timing: Microsoft's change log first listed the feature as public preview in the week of September 21. The October recap is the official announcement of GA.

WindowsForum's earlier coverage of Microsoft's eligibility rules adds more detail:

• Machines need at least 4 vCPU, 16 GB RAM and 128 GB; two-vCPU sizes are excluded, and retention is "best-effort."
• The image must be Windows 11 24H2 or newer from the gallery. Custom images aren't supported yet.
• Watch your hardening scripts. Anything that runs powercfg /h off or sets HibernateEnabled to 0 will quietly turn the feature off.

Section summary: Check your Flex dedicated machines against the sizing and image rules, and audit power-related hardening baselines before telling users their tabs will survive overnight.

External users on iPhone and iPad​

Windows App support for external identities on iOS is now generally available. Contractors, vendors and partners can sign in to their Cloud PCs from an iPhone or iPad. Microsoft says external identities now work in Windows App on Windows, macOS, iOS and Android, and in a web browser in the commercial cloud.

Note the wording: browser support is stated for the commercial cloud only. Don't assume it covers sovereign clouds.

AVD host pools get their own managed identities (action required)​

Managed identity support for Azure Virtual Desktop host pools is now generally available. A host pool can have its own Azure identity, which holds the permissions AVD needs to manage virtual machines, key vaults and networks. Features that use it:

• Session host configuration
• Autoscale
• Start VM on Connect
• Azure Virtual Desktop for Azure Local

This is a real least-privilege improvement. You grant each host pool only the access it needs, instead of relying on the shared AVD service principal.

The deadline: Microsoft says a future service update will require a managed identity on any host pool that uses session host configuration before you can add session hosts to it. No date has been announced. Set it up now, so scale-out doesn't fail during a busy week.

Context-based redirection reaches RemoteApp (preview)​

Context-based redirection now covers RemoteApp sessions in AVD, in preview. It lets IT decide when users get clipboard, drive, printer and USB redirection, based on Microsoft Entra Conditional Access conditions such as:

• device compliance
• user role
• network location

You configure it once on the host pool, and it applies to both desktop and RemoteApp sessions. Previously, published apps were a gap in this control. A user could be blocked from copying data out of a full desktop session but not out of a RemoteApp session.

Microsoft also merged the Windows 365 and AVD guidance into one "Configure context-based redirections" article. It's built on Entra authentication context and has updated Intune screenshots.

Intune: display defaults and broader targeting​

• Default display settings (GA): set the Cloud PC default to a single display or all displays. Users can still override it in Windows App.
• Assign Cloud PC settings to all users or all devices (public preview): Cloud PC configurations and Windows App settings can target user groups or All users. Remote connection experience settings can target device groups or All devices.

The user/device split matters. Remote connection experience settings, which include the redirection controls above, target devices. Assigning them to a user group won't apply them.

Deprovisioning: bulk and automatic​

Bulk deprovisioning in grace period (GA) covers Windows 365 Enterprise and Flex dedicated Cloud PCs. Instead of waiting out the seven-day grace period or ending it one machine at a time, you can deprovision many at once. Start it from the provisioning policy view or the Intune Bulk Action Wizard.

This is the delete button for Cloud PCs that will be gone once the grace period ends anyway. Confirm your selection and tell affected users first.

Windows 365 Reserve auto-deprovisioning (public preview) is an optional setting:

1. It's off by default.
2. Enable it in the Cloud PC configuration settings for Windows 365 Reserve in Microsoft Intune.
3. Scope it to specific Microsoft Entra ID user groups.
4. Set an idle threshold. Reserve Cloud PCs that are provisioned but not connected to for that long are deprovisioned automatically.
5. To use one again, provision it again. Any unused access days are kept.

Why it matters: each Reserve user gets 10 days of Cloud PC access, and Microsoft says the feature exists so those days aren't used up by Cloud PCs nobody is using.

Windows 11 26H2 images are available​

Windows 11 Enterprise, version 26H2 images are available for new Cloud PCs and session hosts:

• Windows 365 gallery:
  • Windows 11 Enterprise 26H2
  • Windows 11 Enterprise + Microsoft 365 Apps 26H2
  • Windows 11 Enterprise Developer Configuration + Microsoft 365 Apps 26H2
• AVD (Azure Marketplace):
  • Windows 11 Enterprise 26H2
  • Windows 11 Enterprise + Microsoft 365 Apps 26H2

This only applies to new deployments. Existing Cloud PCs and session hosts don't upgrade themselves. Test your app compatibility on a pilot provisioning policy before switching the main one.

Documentation and the fine print​

• There's a new Microsoft Learn article on Azure storage account requirements for Windows 365 features that copy Cloud PC snapshots to your own storage, for forensics, compliance and disaster recovery.
• The recap's "Partner news" section is a vendor plug for EfficientEther's sizing and MSIX packaging tools. Treat it as marketing, not a recommendation.
• Microsoft Ignite runs November 17–20 in San Francisco and online. That's where the next round of features is likely to show up.

Bottom line​

October's recap is about operations: connections that stay up, sessions that survive a disconnect, tighter identity scoping, and less manual cleanup. If you only do one thing this week, set up managed identities on your AVD host pools before Microsoft makes them mandatory. Government tenants should also allow 20.140.236.0/22 on UDP 3478 so TURN relay works.