Which work can move from a virtual desktop to the browser

A virtual desktop (VDI) runs a computer’s desktop on a server and sends the screen to the person’s device. The work that moves off it most easily is work done entirely in web apps, where no file gets opened on the device. Work that opens files in local software can move once you decide how those files are handled. Work that needs installed desktop software stays on the virtual desktop.

Here, “the browser” means using web apps directly in the browser on the person’s own device. Azure Virtual Desktop, Microsoft’s cloud virtual desktop, can also be opened in a browser, but that’s still a virtual desktop.

What a virtual desktop protects

NIST SP 800-46, NIST’s guide to telework and personal-device security, puts virtual desktops in its portal category. The apps and their data sit on the server, which sends the device screen images. So data typically stays on the device far more briefly than when the device runs the apps itself. When a session ends, the virtual desktop is discarded and the next person gets a clean one. NIST says this helps on personal devices, which are less likely to meet a company’s security rules.

Products add finer controls. In Azure Virtual Desktop, an admin decides which of the person’s local resources the remote session can use. Redirection, Microsoft’s term for this, covers the clipboard (whatever you’ve copied), local drives and USB storage, printers and more. Screen capture protection hides the remote desktop in screenshots and screen sharing on supported apps. Microsoft says it isn’t the strong protection of DRM (copy-protection software). Watermarking lays QR codes over the remote desktop. Each code carries the connection’s ID, so if someone photographs the screen, admins can look up which session it was. Whether you can drop the virtual desktop depends on which of these protections each kind of work relies on.

On cost, Microsoft says Azure Virtual Desktop can share one machine among several people. Its autoscale adds or removes capacity as demand changes, so moving people to the browser may let you run fewer machines.

Sort the work into three kinds

Work done entirely in web apps

This is work that happens on a cloud app’s screens, such as entering data or changing settings. NIST calls this direct application access: the browser connects straight to the app, and the app handles its own security. NIST also warns that some of these apps let people download files to the device, and that browser caches can store data by accident. It says all data sent to a remote worker should fall under the organization’s rules for where data may go and how long it’s kept.

Downloads the virtual desktop used to stop now have to be stopped in the app’s own permissions or in the browser. How to block or limit file downloads from SaaS apps covers both.

Work that moves between web apps and local files

An example is exporting a report as a spreadsheet file, editing it in desktop software and importing it back. The file sits on the device for a while. If the spreadsheet work can also happen in a web app, this moves into the first kind. If it needs local software, you have two choices. Accept the file on the device, with rules on where it goes and when it’s deleted, or keep this work on the virtual desktop.

Work that needs installed desktop software

Some work runs in software installed on the computer. Azure Virtual Desktop can host those programs, including line-of-business software built for Windows. If the program has no version that runs in a browser, a browser can’t replace the virtual desktop.

What the browser side can control

Compare each virtual desktop control with what a managed browser offers. Google lists these in its paid Chrome Enterprise Premium. Copy and paste controls stand in for clipboard redirection, download and upload controls for drive redirection, and print controls for printer redirection. It also lists watermarks and screenshot protection.

These controls apply only to use through the managed browser. If someone opens the same app in another browser or on their phone, none of them apply. What is a secure browser (enterprise browser)? explains how these browsers work.

What stays on the computer

On a virtual desktop, the work runs on the server and the device receives the screen. In a browser, the device keeps browsing history, cookies, passwords saved in the browser and downloaded files. Cookies are small files sites save, including the ones that keep you signed in.

Closing the window doesn’t remove files. Chrome’s help says that once every incognito window closes, site data and the list of sites visited are gone, but downloaded files and bookmarks stay. What work data stays on a personal computer, and how to keep it off goes through each item.

Running both

You don’t have to choose one for everything. Move the first kind of work to the browser, keep the third on the virtual desktop, and decide the second task by task.

Checks before you switch off the virtual desktop