VDI vs Windows 365 vs Laptops: Which Desktop Model Fits a Small or Mid-Size Company

The short version: For most small and mid-size companies, physical laptops managed with Intune stay the simplest choice. Windows 365 suits you when you want a Windows desktop in the cloud for specific people and prefer one fixed fee per user, plus possible network usage costs. Azure Virtual Desktop (AVD) suits you when you need shared multi-session desktops, custom images or tight control of the environment, and you have someone who can run it.

This guide is for the person deciding how to give staff a Windows desktop: office managers, finance heads and IT leads without a dedicated infrastructure team. By the end you will have a side-by-side view of the three options, decision rules you can apply to your own groups of users, and a short pilot plan.

Product facts below were checked against Microsoft Learn on 28 October 2026. We do not quote prices, because they change; use Microsoft's official Windows 365 and Azure Virtual Desktop pricing pages.

The three options in one line each

1. Physical laptops: each person gets a device, managed with Microsoft Intune. The desktop runs on the hardware in the user's hands.
2. Windows 365 Cloud PC: each person gets their own Windows PC hosted by Microsoft. Per Microsoft Learn, it is billed per user per month, and you reach it from any device.
3. Azure Virtual Desktop (AVD): a desktop and app virtualization service that runs in your own Azure subscription. You manage the image and the virtual machines.

Option 1: Physical laptops managed with Intune

1. How it works: a Windows laptop is enrolled in Intune, receives policies and apps, and is encrypted and patched centrally. See our guide to Intune plans.
2. Who manages what: you or your provider manage policies, apps and updates. The user's device holds the data unless you keep files in OneDrive or SharePoint.
3. Licensing and cost factors: hardware purchase and refresh cycle, courier and repair costs, imaging or Autopilot effort, the Intune licence, and secure disposal at end of life.
4. Suits: most office staff, travelling staff, anyone who needs a camera, headset and offline use.
5. Watch for: lost or stolen devices (encrypt and enforce a PIN), long hardware lead times, and staff using unmanaged personal laptops.

Option 2: Windows 365 Cloud PC

1. How it works: Microsoft Learn describes Windows 365 as a cloud service that automatically creates Cloud PCs for users. Each Cloud PC is assigned to one person as a dedicated Windows device. Assigning a licence starts provisioning and enrols the Cloud PC in Intune.
2. Who manages what: you manage it in Intune like any other Windows device. You do not build or host the virtual machine yourself. Admins do not create Cloud PCs manually.
3. Licensing and cost factors: a per-user, per-month fee, with extra network usage costs possible (Microsoft Learn). For Windows 365 Enterprise, users need licences for Windows E3, Intune, Microsoft Entra ID P1 and Windows 365. Windows 365 Business is aimed at companies of up to 300 seats.
4. Suits: contractors, offshore teams, temporary staff, staff who need a managed Windows environment from a device you do not manage, with the Intune policies you set, and any group where you want a predictable per-user cost.
5. Watch for: paying for a Cloud PC for someone who is rarely online, and expecting shared pooled desktops. Windows 365 gives one Cloud PC per user. Windows 365 Flex lets one licence provision up to three Cloud PCs for non-concurrent use.

Option 3: Azure Virtual Desktop

1. How it works: Microsoft Learn describes AVD as a desktop and app virtualization service that runs on Azure. It can deliver full desktops or individual apps (RemoteApp) from host pools.
2. Who manages what: you manage the image and the session-host virtual machines in your Azure subscription. Microsoft runs the gateway and broker, so you do not manage those roles.
3. Licensing and cost factors: the Azure resources you run (virtual machines, storage, network) plus a Windows entitlement. Microsoft Learn lists Microsoft 365 E3, E5, A3, A5, F3 and Business Premium, and Windows Enterprise E3 or E5, among the licences that entitle internal users to AVD. Autoscale can reduce cost by changing capacity with demand. Windows 11 Enterprise multi-session, which Microsoft describes as exclusive to AVD, lets several users share one virtual machine.
4. Suits: shared desktops for shift workers, line-of-business apps that must sit next to a server or database in Azure, and teams that need custom images.
5. Watch for: the work of keeping images, host pools and profiles (FSLogix) healthy. This needs someone with Azure skills, internal or from your provider.

How do you decide?

Apply these rules to each group of users, not to the whole company at once.

1. Staff who travel or need a headset, camera and offline access: laptops.
2. Contractors or offshore staff who should not hold company data on their own devices: Windows 365 first, AVD if you need shared sessions.
3. A business app that is slow over the internet because its database sits in Azure or a data centre: AVD, with the session hosts in the same Azure region as the data.
4. A small team with no one who knows Azure (our rule of thumb, not a Microsoft figure: under about 30 people): laptops, plus Windows 365 for the few cases above.
5. Peaks of seasonal staff: Windows 365 Flex or AVD with autoscale, whichever your provider can run.
6. Shift workers sharing a desk: AVD multi-session, or Windows 365 Flex if the use is non-concurrent.

Mixed estates are normal: laptops for most people, a Cloud PC or virtual desktop for one or two groups.

Checks before you pilot a virtual desktop

1. Identity: AVD always uses Microsoft Entra ID to authenticate users, and session hosts can be joined to Microsoft Entra ID or to an Active Directory domain.
2. Latency: Microsoft recommends round-trip latency from the user's network to the Azure region of less than 150 ms. Windows 365 lists East Asia (Hong Kong SAR) as a provisioning region.
3. Network: AVD uses outbound TCP port 443 and does not need inbound ports opened.
4. Management: decide who owns Intune policy for the Cloud PCs, including BitLocker, updates and apps. Our Intune pricing page and MDM and BYOD service explain the device side.
5. Support model: write down who answers a user who cannot connect. Remote desktop tickets need a clear owner.

Common mistakes

1. Choosing by headline monthly cost only. Include hardware refresh, repair, disposal and support time for laptops, and image and host pool upkeep for AVD.
2. Putting everyone on virtual desktops. Video calls, printing and USB devices need testing. Pilot first.
3. Expecting Windows 365 to behave like a shared pool. It is one dedicated Cloud PC per user.
4. Building AVD without anyone to run it. Images, scaling and profiles do not look after themselves.
5. Forgetting licences and identity prerequisites. Windows 365 Enterprise needs Windows E3, Intune and Entra ID P1 per user, and AVD needs an entitling licence and an Azure subscription.
6. No exit plan. Keep documents in OneDrive or SharePoint so users are not tied to one desktop.

How to check it worked

1. Pick 5 to 10 pilot users across your busiest groups and give them the new desktop for two weeks.
2. Measure sign-in time, video call quality and the speed of your slowest business app, and compare with their current laptop.
3. Count tickets raised by pilot users and compare with a similar group.
4. In the Microsoft Intune admin center, confirm each pilot device or Cloud PC shows as managed and has your encryption and update policies applied.
5. Ask pilot users what they could not do. Fix those gaps before you widen the rollout.

FAQ

What is virtual desktop infrastructure (VDI)?

VDI means desktops run as virtual machines on servers, in a data centre or in the cloud, and users see them through a client on their own device. AVD and Windows 365 are Microsoft's cloud ways to deliver this.

Is a VDI the same as a VM?

A VDI desktop runs on a virtual machine, but VDI is the whole service around it: the broker that connects users to desktops, the images, the profiles and the access control.

Is VDI the same as remote desktop?

No. Remote desktop is a way of connecting to a computer. A VDI service decides which virtual desktop a user gets and how it is managed. AVD users connect with Windows App or the Remote Desktop client.

VDI vs VPN: what is the difference?

A VPN extends your network to the user's device. VDI keeps the desktop in the cloud and sends only the screen. AVD connections are made outbound to the service on port 443, so no inbound ports are needed.

How does VDI work?

A broker connects each user to a virtual desktop that runs on a server in a data centre or in the cloud. The user's device runs a client that shows the screen and sends keyboard and mouse input. With AVD, users connect with Windows App or the Remote Desktop client, and the connection is outbound on port 443.

If you want help choosing and running a mixed desktop estate, see our managed IT cloud services.