diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 79e34999caa4..bdc7908fa18e 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -391,7 +391,7 @@ stages:
               path: $(Build.StagingDirectory)/repository_cache
             continueOnError: true
           - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
-            displayName: "Run Windows CI"
+            displayName: "Run Windows msvc-cl CI"
             env:
               CI_TARGET: "windows"
               ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
@@ -415,6 +415,41 @@ stages:
               artifactName: windows.release
             condition: always()
 
+      - job: clang_cl
+        timeoutInMinutes: 120
+        pool:
+          vmImage: "windows-latest"
+        steps:
+          - task: Cache@2
+            inputs:
+              key: '"windows.release" | ./WORKSPACE | **/*.bzl'
+              path: $(Build.StagingDirectory)/repository_cache
+            continueOnError: true
+          - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
+            displayName: "Run Windows clang-cl CI"
+            env:
+              CI_TARGET: "windows"
+              ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
+              SLACK_TOKEN: $(SLACK_TOKEN)
+              REPO_URI: $(Build.Repository.Uri)
+              BUILD_URI: $(Build.BuildUri)
+              ENVOY_RBE: "true"
+              BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-clang-cl --jobs=$(RbeJobs) --flaky_test_attempts=2"
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          - task: PublishTestResults@2
+            inputs:
+              testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
+              testRunTitle: "clang-cl"
+              searchFolder: $(Build.StagingDirectory)/tmp
+            condition: always()
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/envoy"
+              artifactName: windows.clang-cl
+            condition: always()
+
       - job: docker
         dependsOn: ["release"]
         timeoutInMinutes: 120
diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
index 221ebc725ea5..edb099578f79 100644
--- a/bazel/envoy_internal.bzl
+++ b/bazel/envoy_internal.bzl
@@ -69,8 +69,10 @@ def envoy_copts(repository, test = False):
                ],
                repository + "//bazel:gcc_build": ["-Wno-maybe-uninitialized"],
                # Allow 'nodiscard' function results values to be discarded for test code only
-               # TODO(envoyproxy/windows-dev): Replace with /Zc:preprocessor for cl.exe versions >= 16.5
-               repository + "//bazel:windows_x86_64": ["-wd4834", "-experimental:preprocessor", "-Wv:19.4"] if test else ["-experimental:preprocessor", "-Wv:19.4"],
+               # TODO(envoyproxy/windows-dev): Replace /Zc:preprocessor with /experimental:preprocessor
+               # for msvc versions between 15.8 through 16.4.x. see
+               # https://docs.microsoft.com/en-us/cpp/build/reference/zc-preprocessor
+               repository + "//bazel:windows_x86_64": ["-wd4834", "-Zc:preprocessor", "-Wv:19.4"] if test else ["-Zc:preprocessor", "-Wv:19.4"],
                repository + "//bazel:clang_cl_build": ["-Wno-unused-result"] if test else [],
                "//conditions:default": [],
            }) + select({
diff --git a/ci/windows_ci_steps.sh b/ci/windows_ci_steps.sh
index 3a8f5bb3ae12..466b5b771f8b 100755
--- a/ci/windows_ci_steps.sh
+++ b/ci/windows_ci_steps.sh
@@ -62,6 +62,11 @@ mkdir -p "${ENVOY_BUILD_DIR}"
 ENVOY_DELIVERY_DIR="${ENVOY_BUILD_DIR}"/source/exe
 mkdir -p "${ENVOY_DELIVERY_DIR}"
 
+FAIL_GROUP=windows
+if [[ "${BAZEL_BUILD_EXTRA_OPTIONS[*]}" =~ "clang-cl" ]]; then
+  FAIL_GROUP=clang_cl
+fi
+
 # Test to validate updates of all dependency libraries in bazel/external and bazel/foreign_cc
 # bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //bazel/... --build_tag_filters=-skip_on_windows
 
@@ -75,15 +80,13 @@ cp -f bazel-bin/source/exe/envoy-static.exe "${ENVOY_DELIVERY_DIR}/envoy.exe"
 tar czf "${ENVOY_BUILD_DIR}"/envoy_binary.tar.gz -C "${ENVOY_DELIVERY_DIR}" envoy.exe
 
 # Test invocations of known-working tests on Windows
-bazel "${BAZEL_STARTUP_OPTIONS[@]}" test "${BAZEL_BUILD_OPTIONS[@]}" //test/... --test_tag_filters=-skip_on_windows,-fails_on_windows,-flaky_on_windows --build_tests_only
+bazel "${BAZEL_STARTUP_OPTIONS[@]}" test "${BAZEL_BUILD_OPTIONS[@]}" //test/... --test_tag_filters=-skip_on_windows,-fails_on_${FAIL_GROUP} --build_tests_only
 
 echo "running flaky test reporting script"
 "${ENVOY_SRCDIR}"/ci/flaky_test/run_process_xml.sh "$CI_TARGET"
 
-# Build tests that are known-flaky or known-failing to ensure no compilation regressions
-bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //test/... --test_tag_filters=-skip_on_windows,fails_on_windows,flaky_on_windows --build_tests_only
+# Build tests that are known flaky or failing to ensure no compilation regressions
+bazel "${BAZEL_STARTUP_OPTIONS[@]}" build "${BAZEL_BUILD_OPTIONS[@]}" //test/... --test_tag_filters=-skip_on_windows,fails_on_${FAIL_GROUP} --build_tests_only
 
-# Summarize tests bypasssed to monitor the progress of porting to Windows
-echo "Tests bypassed as skip_on_windows: $(bazel "${BAZEL_STARTUP_OPTIONS[@]}" query 'kind(".*test rule", attr("tags", "skip_on_windows", //test/...))' 2>/dev/null | sort | wc -l) known unbuildable or inapplicable tests"
-echo "Tests bypassed as fails_on_windows: $(bazel "${BAZEL_STARTUP_OPTIONS[@]}" query 'kind(".*test rule", attr("tags", "fails_on_windows", //test/...))' 2>/dev/null | sort | wc -l) known incompatible tests"
-echo "Tests bypassed as flaky_on_windows: $(bazel "${BAZEL_STARTUP_OPTIONS[@]}" query 'kind(".*test rule", attr("tags", "flaky_on_windows", //test/...))' 2>/dev/null | sort | wc -l) known unstable tests"
+# Summarize known unbuildable or inapplicable tests (example)
+# bazel "${BAZEL_STARTUP_OPTIONS[@]}" query 'kind(".*test rule", attr("tags", "skip_on_windows", //test/...))' 2>/dev/null | sort
diff --git a/test/common/network/BUILD b/test/common/network/BUILD
index 539ba78aff39..3909f129b1f4 100644
--- a/test/common/network/BUILD
+++ b/test/common/network/BUILD
@@ -135,6 +135,10 @@ envoy_cc_test(
         # Used in createDnsResolver to force creation of DnsResolverImpl when running test on macOS.
         "--runtime-feature-disable-for-tests=envoy.restart_features.use_apple_api_for_dns_lookups",
     ],
+    # TODO(envoyproxy/windows-dev): Under winsock2 this is behaving unusually for windows, even as
+    # 127.0.0.1 and ::1 are explicitly added to `c:\windows\system32\drivers\etc\hosts` ... see:
+    # https://gist.github.com/wrowe/24fe5b93b58bb444bce7ecc134905395
+    tags = ["fails_on_clang_cl"],
     deps = [
         "//include/envoy/event:dispatcher_interface",
         "//include/envoy/network:address_interface",
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/BUILD b/test/extensions/filters/http/dynamic_forward_proxy/BUILD
index bf2a85ad0146..85b2553f2e33 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/BUILD
+++ b/test/extensions/filters/http/dynamic_forward_proxy/BUILD
@@ -51,6 +51,9 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_name = "envoy.filters.http.dynamic_forward_proxy",
+    # TODO(envoyproxy/windows-dev): Diagnose failure shown on clang-cl build, see:
+    #   https://gist.github.com/wrowe/a152cb1d12c2f751916122aed39d8517
+    tags = ["fails_on_clang_cl"],
     deps = [
         "//source/extensions/clusters/dynamic_forward_proxy:cluster",
         "//source/extensions/filters/http/dynamic_forward_proxy:config",
diff --git a/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD b/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD
index 66d033ebfb87..4fa3f7db3569 100644
--- a/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD
+++ b/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD
@@ -33,6 +33,9 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_name = "envoy.filters.network.sni_dynamic_forward_proxy",
+    # TODO(envoyproxy/windows-dev): Diagnose failure shown only on clang-cl build, see:
+    #   https://gist.github.com/wrowe/12b0b7579791c541c789c98563999a2e
+    tags = ["fails_on_clang_cl"],
     deps = [
         "//source/extensions/clusters/dynamic_forward_proxy:cluster",
         "//source/extensions/filters/listener/tls_inspector:config",
diff --git a/test/extensions/quic_listeners/quiche/integration/BUILD b/test/extensions/quic_listeners/quiche/integration/BUILD
index 998625c54e72..1f5ad0d2e807 100644
--- a/test/extensions/quic_listeners/quiche/integration/BUILD
+++ b/test/extensions/quic_listeners/quiche/integration/BUILD
@@ -13,13 +13,16 @@ envoy_cc_test(
     size = "medium",
     srcs = ["quic_http_integration_test.cc"],
     data = ["//test/config/integration/certs"],
-    # TODO(envoyproxy/windows-dev): Diagnose why opt build test under Windows GCP RBE
+    # TODO(envoyproxy/windows-dev): Diagnose failure shown only on clang-cl build, see:
+    #   https://gist.github.com/wrowe/a152cb1d12c2f751916122aed39d8517
+    # TODO(envoyproxy/windows-dev): Diagnose timeout, why opt build test under Windows GCP RBE
     # takes 10x as long as on linux (>300s vs ~30s). Shards = 2 solves for windows, see:
     #   https://github.com/envoyproxy/envoy/pull/13713/files#r512160087
     # Each of these tests exceeds 20s;
     # QuicHttpIntegrationTests/QuicHttpIntegrationTest.MultipleQuicConnections[With|No]BPF*
     tags = [
-        "flaky_on_windows",
+        "fails_on_clang_cl",
+        "fails_on_windows",
         "nofips",
     ],
     deps = [
diff --git a/test/integration/BUILD b/test/integration/BUILD
index e3e1549221ca..c133a1330e9c 100644
--- a/test/integration/BUILD
+++ b/test/integration/BUILD
@@ -1129,7 +1129,10 @@ envoy_cc_test(
     # TODO(envoyproxy/windows-dev): The key rotation in SdsDynamicKeyRotationIntegrationTest via
     # TestEnvironment::renameFile() fails on Windows. The renameFile() implementation does not
     # correctly handle symlinks.
-    tags = ["fails_on_windows"],
+    tags = [
+        "fails_on_clang_cl",
+        "fails_on_windows",
+    ],
     deps = [
         ":http_integration_lib",
         "//source/common/config:api_version_lib",