Golden Images

This section of the Management Portal is where you go to designate the virtual machines that will be deployed across your organization. You can deploy multiple golden images.

Note: To learn how to prepare a virtual machine for deployment, please refer to this section of the guide. The result should be a .pvmp file containing a virtual machine and a .txt file containing the SHA-256 checksum for it.

If you are configuring your Parallels Desktop Enterprise Edition setup for the first time, the Golden Images section in your Parallels Management Portal will look like this:

Use the Create Golden Image button and follow the instructions below.

Note: Prior to the February 2025 update, Parallels Desktop Enterprise Edition only allowed two virtual machine images per organization, one for Apple silicon Macs and one for Intel Macs.

The update results in those two images listed as one Golden Image, suitable for two architectures, with the option to add more.

Each golden image can be assigned to one or several groups of users. Starting from the September 2025 update, Golden Images are assigned to user groups as part of policies.

Each Golden Image card contains the list of policies in which this image is provisioned and the number of virtual machines provisioned with it:

Note: Currently, each group of users can have only one golden image assigned to it (for up to two processor architectures).

Adding a virtual machine golden image for deployment

First, fill out the following fields when adding a golden image record:

1. Name. Give the virtual machine a descriptive, easy-to-read name, e.g., {company_name} Windows 11 Pro for Arm. This name will be shown to your users.

2. [OPTIONAL] Description. Feel free to add a more detailed description that helps to understand the specific purpose or setup of each image, e.g., This image is for the accountants to run Excel for Windows. This description will be shown to your users.

With the December 2025 update, Parallels Management Portal allows two distinct deployment methods: the traditional one that involves preparing a fully-fledged virtual machine golden image and uploading it to a cloud location, and the so-called declarative method that is based on the latest standard Enterprise image from Microsoft or a custom ISO file.

Declarative deployment (Windows VMs)

As mentioned above, declarative deployment eliminates the need to store, update, and distribute a multi-gigabyte virtual machine image by relying on the latest Enterprise images from Microsoft. It also drastically simplifies Intune enrollment.

Note: Declarative deployment requires Parallels Desktop for Mac version 26.2 or newer.

In this method, your users still receive appropriately customized Windows virtual machines because the Out-of-the-Box Experience (OOBE) is completed based on the host Mac's existing user information, while the resulting virtual machine can be enrolled in Intune based on the accompanying profile.

To configure declarative deployment:

1. Switch the Deployment method parameter to Declarative.

2. Under Installation source, choose one of the following:

   • Windows Enterprise for the latest Enterprise image directly from Microsoft.

   • Custom ISO for your own custom image, for which you'll have to provide two distinctive DIRECT URLs with checksums for Intel and Apple silicon Macs. To find the checksum for an ISO file, open macOS Terminal and use the shasum -a 256 {ISO_file_path} command to obtain it.

   Note: Once you have selected one of the available sources and saved the Golden Image configuration, you WILL NOT be able to change the source later.

3. Under Install options, you may optionally configure unattended installation based on the user profile data from the host Mac, matching the user account information and other out-of-the-box options. Note: If your custom ISO already contains any kind of unattended.xml answer file, activating these options will lead to a conflict, and the user will have to go through the OOBE experience manually.

4. Under Provisioning profile, you can add a provisioning package to automatically enroll Windows virtual machines into your company's Intune setup. To create such a package, follow the instructions outlined in this chapter. You can add the resulting .ppkg file by uploading it (if up to 100KB in size) or designating a DIRECT URL if, e.g., its size exceeds 100KB, or you wish to set up an automated job to keep the profile dynamically updated with fresh network access information or other changing parameters.

5. Click Add to finish creating the Golden Image.

Standard image-based deployment

This method relies on the traditional way of preparing a virtual machine image file and distributing it from a network destination.

To configure VM image deployment:

1. Switch the Deployment method parameter to VM image.

2. Enable for {architecture}. You may provide golden images for one specific processor type or both. Note: You may choose not to add one of the images if your organization only uses Macs with one processor architecture.

3. Download URL for {architecture}. Upload your virtual machine .pvmp file to a server location that supports direct links and is accessible to all the machines where you plan on deploying it, and share the file. Optionally, you may use a URL shortener. Apple silicon Macs and Intel Macs will require two separate image files. Make sure the files are accessible without authentication. Before proceeding, verify the link works. Note: A local network file share may be a suitable solution, provided the remote machines can connect via VPN.

4. Checksum (SHA-256). When packaging a virtual machine (right-click on it in the Control Center and choose Prepare for Transfer), the resulting .pvmp file is accompanied by a .txt file containing a SHA-256 checksum for it. Copy and paste the contents of that file in this field. Note: If you have the .pvmp virtual machine file but not the .txt file with its checksum, you can quickly find it by following these steps:

   1. Right-click on the .pvmp file while holding down the Option key and choose Copy {file_name} as Pathname.

   2. Open macOS Terminal.

   3. Type in shasum -a 256 {file_path}, pasting the copied pathname from Step a, and hit Enter.

   The output will look similar to the following:

   63a90c3c38cc8c354221da339069fc1292b10bf7c00ed8149787b0e6079d706b /Users/parallels/Parallels/Windows11Pro.pvmp.

5. Click Add to finish creating the Golden Image.

Editing or removing a virtual machine golden image

To change the settings for a golden image, click Edit on the golden image's card and change the settings as described above.

Note: Changing the golden image type (i.e., from Declarative to VM image) and source (i.e., from Microsoft Enterprise to ) in an existing golden image is not possible.

Mind that changing the link will not update the virtual machines already provisioned from that Golden Image, and both old and subsequently provisioned new VMs will count as provisioned from that image.

To remove a golden image, select the one you want to delete, click Edit on the golden image's card, click Delete Golden Image in the bottom left corner of the window, and confirm the deletion.

Warning: Deleting a golden image is irreversible. If you have deleted a golden image by mistake, you will have to create it again. If the groups that were assigned that image, were also restricted to provisioned virtual machines only, the users in those groups wouldn't be able to install new virtual machines until assigned another golden image.

If you attempt to delete a Golden Image that has virtual machines provisioned from it, you will get a warning message prompting you to remove those virtual machines first. Without removing them, you won't be able to delete the Golden Image as otherwise, you would lose administrative control over them. If you don't want users to install new virtual machines based on the image, it is easier to remove the image from the policy or policies where it's provisioned.