This is an interesting one. First off, most will gravitate to the price point. $20 per user per year to cover my essential staff under our BCDR plan? Sounds great! Most disaster recovery plans we read are infrastructure focused and as we know, if the users can’t access those applications, there is no point. They cover the backup datastore, the failover site, the SQL replication, the network re-routing. They are quiet on the laptop sitting on someone's kitchen table that just got encrypted by ransomware, the executive on a Tuesday-morning flight whose device was stolen at the gate, or the new hire who has been waiting four days for IT to overnight a replacement. Microsoft's Windows 365 Reserve, generally available this month, looks to that gap directly.
What Windows 365 Reserve is
Windows 365 Reserve is a Cloud PC that you license once a year, per user, and activate when needed. Each license grants up to 10 days of Cloud PC access annually, billed up front, used as the situation requires. This is an insurance policy. The Cloud PC is pre-configured with your corporate apps, Intune policy, and security baseline, ready to come online the moment a user needs it. Provisioning, image management, and assignment happen through Intune, the same console your team already uses for endpoint management. If you have OneDrive and all those tools already ready to go, it’s a break-glass, use in case of emergency, secure desktop with your apps, files, and accessible with only an internet connection.
How it works
You configure a provisioning policy in Intune that defines the Reserve image: corporate apps, sensitivity labels, security tooling, anything you want the standby desktop to look like. When a user needs the Cloud PC, IT activates it from Intune, the user signs into the Windows App on whatever device they have available (Windows, macOS, iOS, Android, or the web), and they are working again in minutes. The hardware shipping cycle drops out of the equation. Licensing prerequisites match Windows 365 Enterprise and Windows 365 Frontline, so most organizations already running those tiers will not need a new entitlement model.
Why this matters
Most DR plans cover infrastructure and forget about the endpoint. Servers, storage, and network failover are well-rehearsed for any organization with a real BCDR program. Endpoint recovery is usually "we have spare laptops in a closet" or "shipping ETA 24 to 48 hours." For a user who is the difference between hitting a board deadline and missing it, that gap is expensive.
Ransomware changed the threat model. When a user's laptop gets compromised, the old playbook was "wipe and rebuild over the weekend." That timeline does not work when the user has client-facing work due Monday morning. A Reserve Cloud PC lets you isolate the compromised device, hand the user a clean and policy-compliant desktop in minutes, and let your IR team work on the original at the right pace.
The cost shape matches reality. Most users will never trigger Reserve. The ones who do will use it for a few days a year. At $20 per user per year, every user in your organization carries immediate continuity coverage for less than the loaded cost of one overnight laptop replacement. For a 1,000-seat org, that is $20,000 annually to give every employee a same-day fallback path, with the 10-day cap enough to bridge nearly any single incident.
Endpoint BCDR that lives inside the M365 trust boundary. Same Entra ID, same conditional access, same Defender coverage, same Purview labeling. Your full security posture rides with the recovery desktop. A loaner laptop pulled from a closet starts from a clean slate that someone has to rebuild before you can hand it to a user. Easy to do with Intune and Autopilot, but takes time nonetheless.
Where it fits, and where it doesn't
Best fit: regulated industries with strict continuity requirements, organizations with mobile workforces who cannot wait for hardware shipping, executive and field-leader populations whose downtime carries direct revenue impact, IT teams looking to retire their loaner-device program, and any environment that has experienced an endpoint-impacting incident in the last 24 months.
Worst fit: Honestly, it fits most organizations that value disaster recovery or revenue depends on continual productivity. However,,organizations without Windows 365 licensing prerequisites in place, environments with bandwidth-constrained users who cannot reliably stream a Cloud PC (global edge cases like non-profits?), and organizations whose existing endpoint replacement processes already meet their continuity SLAs. Kinda reaching here for scenarios it isn’t a good backup plan.
How eGroup helps
Endpoint recovery belongs in your BCDR plan, and Windows 365 Reserve is the cleanest way to put it there. We help clients map their current continuity gaps, model where Reserve fits in the response playbook, and integrate it with their existing Intune, Entra ID, and Defender configurations. If you are reviewing your continuity posture, evaluating an alternative to a loaner-device program, or building a response plan for an endpoint-impacting incident, a discovery conversation with our practice is the right next step.