Which one should you choose?
All five options below can keep offshore staff working on desktops hosted in Australia, so the data stays onshore and only an encrypted picture of the screen travels overseas. The right one depends mostly on where your systems already run and how much platform you want to operate.
- Your systems are on Azure or Microsoft 365: Azure Virtual Desktop with pooled, non-persistent hosts. Cheapest to run and the most control, but the most to build.
- You want no infrastructure to run: Windows 365 Flex in Shared mode. One licence per concurrent session, and user data is deleted when each person signs out.
- Your systems are on AWS: Amazon WorkSpaces Applications. Clipboard, file transfer and printing are switches on the stack, and sessions are non-persistent by default.
Avoid starting a new build on Amazon WorkSpaces Pools: it stopped accepting new customers on 31 July 2026.
What offshore compliance needs from a desktop
When a contract, client or auditor says data must stay in Australia, the desktop platform has to do more than run in a Sydney region. We judge each option on six things:
- Australian region. The desktop, and anything it stores, runs in Australia.
- Nothing persists. The desktop is rebuilt or wiped between sessions, so no local copy of data builds up.
- No data out. Clipboard, local drives, USB and printing to the offshore device can be switched off.
- Screen capture. Screenshots and screen recording on the offshore device can be blocked, and a watermark makes photos of the screen traceable.
- Identity. Sign-in goes through your identity provider, with MFA and conditional access.
- Evidence. Sign-ins, sessions and blocked events can be logged and handed to an auditor.
Side by side
| Azure Virtual Desktop (pooled) | Windows 365 Flex, Shared mode | Windows 365 Enterprise | WorkSpaces Applications | WorkSpaces Personal | |
|---|---|---|---|---|---|
| Australian region | Yes Australia East | Yes Australia East | Yes | Yes Sydney | Yes Sydney |
| Nothing persists | Yes hosts rebuilt from an image | Yes user data deleted at sign-out | No one persistent PC per user | Yes unless you turn on home folders | No one persistent desktop per user |
| Block clipboard, drives, USB, printing | Yes RDP properties | Yes Intune policy | Yes Intune policy | Yes stack settings | Yes Group Policy |
| Screen capture protection | Built in | Built in | Built in | Not built in | Built in Windows, DCV only |
| Watermark | Built in | Built in | Built in | Partner tools | Partner tools |
| How you pay | Compute by the hour | Per concurrent session, monthly | Per named user, monthly | By the hour while streaming, plus a per-user licence | Per desktop, monthly or hourly |
| Build and run effort | Heaviest | Lightest | Lightest | Moderate | Light |
Screen capture protection has limits
On Azure Virtual Desktop and Windows 365, the Windows App blocks screenshots, recording and screen sharing of the remote session on Windows and macOS devices. Phones, tablets and the web client need an Intune app protection policy as well. Microsoft is clear that this is not DRM-level protection, and nothing stops someone photographing the screen, which is why the QR-code watermark matters: it identifies the session a photo came from.
WorkSpaces Personal added screen capture protection in early 2026 for Windows WorkSpaces using the DCV protocol. It doesn’t cover Linux clients, web access or PCoIP.
What it costs for five offshore users
Indicative monthly run cost for five users on one shift in an Australian region, at list price. The assumptions are the same as in our sovereign desktops deep dive.
| Option | Per month | Per user |
|---|---|---|
| Azure Virtual Desktop, pooled | $90 | $18 |
| WorkSpaces Applications | ~$157 | ~$31 |
| WorkSpaces Personal | ~$200 | ~$40 |
| Windows 365 Enterprise | $205 | $41 |
| Windows 365 Flex | $210 | $42 |
At five users the spread is about $1,440 a year, less than two days of build effort, so choose on how simple the platform is to operate. Past about thirty concurrent users, pooled Azure Virtual Desktop and WorkSpaces Applications become clearly cheaper. Windows 365 Flex gets cheaper when shifts are staggered, because you pay for concurrent sessions, not headcount.
How to choose
Put the desktops next to your systems
The link between the desktop and your applications matters more than the link between the offshore user and the desktop. If your line-of-business systems run on AWS, a Microsoft desktop in Azure adds a cross-cloud hop to every click, and the reverse is also true.
Check the licences you already pay for
Microsoft 365 E3, E5 and Business Premium include the user rights for Azure Virtual Desktop, which is a large part of why it is the cheapest to run.
Decide who runs it
Azure Virtual Desktop gives the most control, but someone has to own the host pool, the golden image and autoscaling. If nobody on your team will, Windows 365 Flex in Shared mode removes almost all of that.
Decide what devices offshore staff use
If staff connect from personal Windows or Mac computers, the Microsoft options block screen capture through the Windows App without managing the device. On WorkSpaces Applications, plan for managed laptops or thin clients instead.
What changed in 2026
- Windows 365 Frontline is now Windows 365 Flex. Dedicated mode gives each licence up to three Cloud PCs with one active session. Shared mode gives each licence one Cloud PC that a group shares, one person at a time, with user data deleted at sign-out.
- WorkSpaces Pools is closing. No new customers from 31 July 2026, and support ends on 31 December 2027. AWS points customers to WorkSpaces Applications (formerly AppStream 2.0), which can import Pools images.
- WorkSpaces Personal gained screen capture protection for Windows WorkSpaces on DCV.
Common questions
Is Windows 365 Flex the same as Windows 365 Frontline?
Yes. Microsoft renamed Windows 365 Frontline to Windows 365 Flex in 2026. It still licenses concurrent sessions rather than named users, and still has a Dedicated mode and a Shared mode.
Which option is cheapest for a small offshore team?
At list price, pooled Azure Virtual Desktop is cheapest, at about US$18 per user a month for five users on one shift. The difference is small at that size, so ease of running it usually matters more.
Do all of these keep data in Australia?
All of them can run in an Australian region. Whether data actually stays onshore depends on configuration: blocking clipboard, drives, USB and printing, controlling internet egress, and keeping profiles and logs in Australian storage.
Can offshore staff use their own computers?
Yes. Session controls apply on any device. On Azure Virtual Desktop and Windows 365, the Windows App also blocks screen capture on personal Windows and Mac computers. Nothing blocks a phone camera, which is what the watermark is for.
Should we still use Amazon WorkSpaces Pools?
Not for a new build. It closed to new customers on 31 July 2026 and support ends on 31 December 2027. Use WorkSpaces Applications instead.
Sources
Checked against vendor documentation on 1 October 2026.
Next step
Not sure which one fits?
Tell us where your systems run and how many offshore staff you have. On a 30-minute call we’ll recommend a platform and give you a rough monthly cost.