Sovereign desktops for offshore teams

Staff overseas, data onshore

The requirement usually arrives as one line in a client contract, an audit finding or a board policy: customer data must stay in Australia. At the same time, the business depends on an offshore team that needs to work with that data every day.

The usual setup, a company laptop and a VPN, cannot meet it. The VPN brings the data to the laptop, and once it is there, nothing stops it being saved, synced, copied or photographed. You also cannot prove to an auditor where it went.

The fix is to move the work, not the data. Offshore staff sign in to a desktop that runs in an Australian cloud region, next to your systems. Only an encrypted picture of the screen travels overseas. The keyboard and mouse come back. Files never leave.

How a sovereign desktop works

Desktops are pooled and non-persistent. Each one is built from a golden image when a user signs in and destroyed when they sign out. Nothing carries over between sessions, which is the strongest answer to a no-local-data requirement.

Desktops go next to the data, not next to the users. Latency between the desktop and your applications is felt far more sharply than latency between the user and the desktop. So the region is chosen by where your systems run, and an existing ExpressRoute or Direct Connect circuit into one cloud is a strong argument for building there.

Patching works differently too. A pooled fleet is patched by replacing the image, not by patching running desktops. That is a real security advantage, provided someone owns the image pipeline and the maintenance window doesn’t collide with an offshore shift.

Choosing a platform

All three mainstream options enforce the control set to an equivalent standard. The choice comes down to where your data already sits, what licensing you already pay for, and which cloud your team can operate. For a fuller comparison, including screen capture protection, see Azure Virtual Desktop vs Windows 365 vs Amazon WorkSpaces.

Every control, and where it is enforced

Not every control can be delivered by the desktop platform alone. Each row below is tagged with where it is enforced: in the session, in the app or on the endpoint. Pick the device your offshore staff use to see what you can actually enforce.

Managed laptop (Intune or Jamf): every control can be enforced, including screen-capture protection through the device agent.

“Nobody prints” is almost never true

One legitimate exception forks the design into an approved-export path with a named approver and logging. We look for it in discovery, not during user testing.

Controls as code

Every setting in the table is written in Terraform or Intune configuration in your repository, not clicked together in a portal. That changes how compliance works day to day:

• A control change is a pull request, with a reviewer, a reason and a record.
• Drift is caught. A scheduled plan flags any control changed by hand, so a quiet exception can’t become permanent.
• Evidence is a by-product. The repository history and drift reports show what each control was and when it changed, without a scramble before the audit.

resource "azurerm_virtual_desktop_host_pool" "offshore" {
  name                = "hp-offshore-syd"
  location            = "australiaeast"
  resource_group_name = azurerm_resource_group.avd.name
  type                = "Pooled"
  load_balancer_type  = "BreadthFirst"

  # Session controls: no clipboard out, no drive, printer or USB redirection
  custom_rdp_properties = join(";", [
    "redirectclipboard:i:0",
    "drivestoredirect:s:",
    "redirectprinters:i:0",
    "usbdevicestoredirect:s:",
  ])
}

Identity is the real boundary

The desktop is only as strong as the sign-in in front of it. Entra ID with Conditional Access, or Okta with device and location policies, gives the gate an auditor will ask about.

• Accounts in your own tenant give full policy control and clean offboarding.
• Guest accounts from a BPO’s tenant mean someone else controls the password and MFA registration. We design for that explicitly when it applies.
• Avoid a managed directory where the apps allow it. Entra ID join for AVD, or SAML federation for WorkSpaces Applications. A managed AD is often the most expensive line on a small build.

What survives between sessions

The single biggest design question in a pooled build. Our default is that nothing persists, which only works if your applications save work server-side. We confirm that with the application owners, not just the sponsor.

Latency and bandwidth

A technically perfect desktop feels broken above roughly 150 ms round trip, or on a consumer link with jitter and packet loss. We measure from each offshore site before committing to a region.

Budget roughly 150-400 kbps per user for standard office work, more for video. Plan internet egress from the desktops as part of the control set. A locked desktop with open internet can still upload anywhere.

What it costs to run

Indicative monthly run cost for five offshore users on one shift in an Australian region, at list price.

At small scale, run cost is not the decision. The spread from cheapest to dearest is about $1,440 a year, less than two days of build effort. Choose on how simple it is to operate. Pooled AVD or WorkSpaces Applications become clearly cheaper past about thirty concurrent users, so if five is a pilot for two hundred, we build the larger architecture from day one.

Supporting services that can cost more than the desktops

Where sovereignty programmes actually fail

• SaaS outside Australia. A perfectly locked desktop in front of a US-hosted SaaS tenant, backed up offshore or supported by an overseas vendor team, does not meet the requirement. We check every tenant’s region, backups and support location.
• Internet-facing apps. Anything reachable from the internet can be opened from a personal device, outside the desktop entirely. That access has to close at go-live.
• Licensing on throwaway machines. Software that activates against a machine ID, MAC address or hostname fails or burns licences when every desktop is new. We ask every vendor in writing.
• Audio for contact centres. Voice routed through the session instead of optimised on the device is the most common reason offshore desktop rollouts fail on user experience.

What you can hand an auditor

Reporting is a deliverable, designed up front rather than retrofitted.

• Architecture and data-flow diagrams showing where data is stored and processed.
• The control matrix above, with the code that enforces each row and drift reports showing it hasn’t changed.
• Sign-in, session and blocked-event logs streamed to your SIEM, with retention you set.
• Joiner, mover and leaver runbooks, including profile deletion.
• A documented exceptions register with named approvers.

How we deliver it

Common questions