Azure Virtual Desktop and Windows 365 for Sovereign Remote Access to Clinical Systems

Aged care providers increasingly depend on distributed and agency workforces who need to reach clinical and line-of-business applications from locations the organisation does not control. Staff may work across multiple facilities, log in from personal devices, or connect from home between shifts, and each of these scenarios introduces risk if resident data is cached, downloaded, or synchronised to an endpoint. The governing concern is not only whether access is possible, but whether it can be delivered in a way that keeps data resident in Australia, prevents local persistence, and remains auditable against the provider's compliance obligations.

Microsoft offers two native cloud desktop models that address this requirement directly, namely Azure Virtual Desktop and Windows 365. Both deliver a Windows experience that runs in the cloud and streams only pixels and input to the user, so clinical records and application data stay within the hosted environment rather than landing on the device in front of the clinician. Understanding where each model fits, and how they differ in control, cost predictability, and operational overhead, allows aged care decision makers to choose an approach that matches their workforce patterns and risk appetite.

Why no local data persistence matters in aged care

Aged care providers hold sensitive personal and health information that attracts obligations under the Privacy Act and sector specific expectations around care records and clinical safety. When an agency nurse opens a care management system on a shared or personal device, any data written to local storage, browser caches, or synchronised folders becomes a potential breach vector that the provider can neither see nor remediate quickly. A hosted desktop model removes that exposure by keeping the application session inside a managed Australian region and returning only a visual stream to the endpoint.

This separation also simplifies the response when a device is lost, stolen, or left with a departing contractor, because there is no resident data to recover and no endpoint to wipe at the file level. The provider can disable the user's identity, revoke the session, and reassign the Cloud PC or host pool access without touching the hardware. Combined with Microsoft Entra ID and Conditional Access, this approach lets organisations enforce consistent controls regardless of who owns the device or where it physically sits.

The Azure Virtual Desktop model

Azure Virtual Desktop is a desktop and application virtualisation service that runs on infrastructure the provider manages within its own Azure subscription. Administrators create host pools, size the underlying virtual machines, and choose between multi-session Windows for pooled workloads and personal desktops for users who need dedicated environments. This granular control makes Azure Virtual Desktop well suited to larger aged care groups that want to optimise cost by packing multiple concurrent users onto shared session hosts and scaling capacity up and down against predictable shift patterns.

The flexibility carries a corresponding operational responsibility, because the provider or its partner must manage image lifecycle, autoscaling rules, capacity planning, and patching of the session hosts. Deploying host pools into an Australian Azure region keeps the compute and the profile data resident in country, and FSLogix profile containers can be stored on Azure Files within the same region to maintain that boundary. For organisations with fluctuating agency demand, the ability to schedule capacity and to charge consumption back against actual usage can make Azure Virtual Desktop an efficient foundation, provided there is the engineering discipline to tune it.

The Windows 365 model

Windows 365 delivers a personal Cloud PC to each licensed user on a fixed per user, per month subscription, which removes much of the sizing and scaling work that Azure Virtual Desktop requires. Each clinician or agency worker receives a dedicated, always allocated Windows environment that persists their settings and applications between sessions, accessed through a browser or the Windows App. The predictable licensing and simplified administration make this model attractive to providers that value cost certainty and a lower management burden over fine grained infrastructure control.

Because each Cloud PC is dedicated rather than pooled, Windows 365 suits workforces where consistent, individualised environments matter more than squeezing concurrency out of shared hosts. Provisioning policies, geography settings, and integration with Microsoft Intune allow the organisation to pin Cloud PCs to an Australian region and to apply the same compliance baselines used across its managed fleet. The trade off is less flexibility to rebalance capacity dynamically, so providers with highly variable agency numbers should model the per user cost against expected utilisation before standardising on this approach.

Choosing a model and governing it well

Many aged care providers will find that the two models are complementary rather than mutually exclusive, with Windows 365 serving steady, named clinical staff and Azure Virtual Desktop handling fluctuating agency or seasonal demand. The decisive factors are usually workforce volatility, the appetite for infrastructure management, and the degree of control required over the operating environment. Mapping user cohorts to the model that fits their access pattern tends to produce a better outcome than forcing every scenario into one technology.

Whichever model is selected, the governing controls remain largely the same and should be designed in from the outset. Conditional Access policies, multifactor authentication, device compliance signals from Microsoft Intune, and session recording or monitoring where appropriate all contribute to a defensible posture, and aligning the design with the Australian Cyber Security Centre's guidance strengthens the case at audit. Keeping compute, profiles, and backups within an Australian Azure region, and documenting that residency clearly, gives providers the evidence they need to demonstrate that remote access to clinical systems meets their obligations.

References

• What is Azure Virtual Desktop? - Microsoft Learn
• What is Windows 365? - Microsoft Learn
• Essential Eight - Australian Cyber Security Centre