{"id":874,"date":"2026-04-16T12:28:12","date_gmt":"2026-04-16T12:28:12","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-secure-desktops-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/"},"modified":"2026-04-16T12:28:12","modified_gmt":"2026-04-16T12:28:12","slug":"oracle-cloud-secure-desktops-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-secure-desktops-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/","title":{"rendered":"Oracle Cloud Secure Desktops Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Compute"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Compute<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Secure Desktops is an Oracle Cloud (OCI) <strong>Compute<\/strong> service designed to deliver <strong>managed, security-focused virtual desktops<\/strong> that run inside your Oracle Cloud tenancy instead of on end-user devices.<\/p>\n\n\n\n<p>In simple terms: <strong>users connect to a desktop in Oracle Cloud<\/strong>, do their work there, and the data stays in the cloud\u2014reducing the risk of sensitive files being copied to laptops, contractor machines, or unmanaged BYOD endpoints.<\/p>\n\n\n\n<p>Technically, Secure Desktops provisions and manages desktop instances (for example, Windows or Linux desktops, depending on what Oracle supports in your region) inside OCI networking (VCNs\/subnets), governed by OCI Identity and Access Management (IAM), compartments, and policies. It is intended to help you centralize desktop compute, standardize images, and enforce security controls around access, connectivity, and data movement.<\/p>\n\n\n\n<p>The problem Secure Desktops solves is common: organizations need to let employees, contractors, partners, or students access internal tools and sensitive datasets without exposing that data to endpoint compromise, loss\/theft, or uncontrolled copy\/exfiltration.<\/p>\n\n\n\n<blockquote>\n<p>Naming note: This article uses <strong>\u201cSecure Desktops\u201d<\/strong> as the service name in Oracle Cloud. Oracle occasionally updates product names and console navigation. If you see slightly different labels in the OCI Console (for example, \u201cOCI Secure Desktops\u201d), treat that as the same service and <strong>verify in the official docs<\/strong> for your tenancy\/region.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Secure Desktops?<\/h2>\n\n\n\n<p>Secure Desktops is an Oracle Cloud <strong>managed desktop-as-a-service (DaaS)<\/strong> offering in the <strong>Compute<\/strong> category that provides cloud-hosted desktops with an emphasis on security, isolation, and centralized administration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose (practical interpretation)<\/h3>\n\n\n\n<p>Secure Desktops exists to provide:\n&#8211; <strong>Centrally hosted desktops<\/strong> for users who should not run workloads locally\n&#8211; <strong>Security controls<\/strong> that reduce data exposure to endpoints\n&#8211; <strong>Simplified operations<\/strong> compared to building your own VDI stack on raw compute<\/p>\n\n\n\n<p>Because Oracle product positioning and feature sets can evolve, treat the exact wording of \u201cofficial purpose\u201d as something you should <strong>confirm in the Secure Desktops documentation<\/strong> for your tenancy and region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (what you should expect from the service)<\/h3>\n\n\n\n<p>Common Secure Desktops capabilities include:\n&#8211; Provisioning <strong>managed desktop instances<\/strong> for end users\n&#8211; <strong>Centralized desktop lifecycle<\/strong> (create, assign, rotate, delete)\n&#8211; <strong>Network placement<\/strong> into OCI VCNs\/subnets so desktops can reach private apps\/databases\n&#8211; <strong>IAM-governed access<\/strong> (who can administer; who can use desktops)\n&#8211; <strong>Image standardization<\/strong> (golden images \/ base images), depending on current product capabilities\n&#8211; Operational hooks into standard OCI governance (compartments, tagging, Audit events, monitoring of underlying resources)<\/p>\n\n\n\n<blockquote>\n<p>If a specific control (for example, clipboard\/file transfer restrictions, USB redirection policies, web client availability, session recording) is critical to your design, <strong>verify in official docs<\/strong> because these are often product- and edition-dependent features in DaaS\/VDI offerings.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual)<\/h3>\n\n\n\n<p>While names vary across console releases, Secure Desktops solutions typically involve:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Desktop pools or desktop definitions<\/strong>: A managed group\/template defining shape, image, network placement, and assignment model.<\/li>\n<li><strong>Desktop instances<\/strong>: The actual desktop compute instances users connect to.<\/li>\n<li><strong>Images<\/strong>: Base OS images and potentially custom images (golden images).<\/li>\n<li><strong>User assignments<\/strong>: Mapping users\/groups to desktop access.<\/li>\n<li><strong>Connection mechanism<\/strong>: A Secure Desktops client and\/or browser-based access (availability may vary).<\/li>\n<li><strong>OCI networking<\/strong>: VCN, subnet(s), route tables, security lists\/NSGs, NAT\/service gateways based on your design.<\/li>\n<li><strong>IAM\/Identity<\/strong>: Users and groups (often via OCI IAM Identity Domains), MFA, policies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type and scope<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service type<\/strong>: Managed desktop service (DaaS) in <strong>Oracle Cloud Compute<\/strong>.<\/li>\n<li><strong>Scope<\/strong>: Deployed and governed within an <strong>OCI tenancy<\/strong> and <strong>compartments<\/strong>.<\/li>\n<li><strong>Regionality<\/strong>: In OCI, most resources are <strong>regional<\/strong> but placed into <strong>availability domains<\/strong> (ADs) when backed by compute. Secure Desktops availability can be <strong>region-dependent<\/strong>. <strong>Verify availability in the OCI Console<\/strong> for your chosen region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into Oracle Cloud<\/h3>\n\n\n\n<p>Secure Desktops is most effective when used alongside:\n&#8211; <strong>OCI IAM \/ Identity Domains<\/strong> for user lifecycle and MFA\n&#8211; <strong>VCN<\/strong> for private access to internal services\n&#8211; <strong>Bastion<\/strong> (optional) for admin access without public IPs\n&#8211; <strong>Vault<\/strong> (optional) for secrets and keys used by your applications accessed from desktops\n&#8211; <strong>Logging\/Audit\/Monitoring<\/strong> for governance and operations\n&#8211; <strong>Cloud Guard<\/strong> (optional) for security posture management<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Secure Desktops?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce data leakage risk<\/strong> by keeping sensitive data in OCI instead of endpoints.<\/li>\n<li><strong>Speed onboarding\/offboarding<\/strong> for contractors and temporary staff: assign a desktop, revoke access, rotate images.<\/li>\n<li><strong>Standardize tooling<\/strong>: everyone uses the same curated desktop environment.<\/li>\n<li><strong>Enable remote work<\/strong> without distributing corporate laptops to every user persona.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Private access to cloud and on-prem resources<\/strong> via VCN connectivity (FastConnect\/VPN\/DRG patterns).<\/li>\n<li><strong>Centralized patching and image governance<\/strong> (depending on supported image workflows).<\/li>\n<li><strong>Consistent compute performance<\/strong> compared to endpoint variability.<\/li>\n<li><strong>Isolation<\/strong> between users and between desktops and the public internet (if you design it that way).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Fewer moving parts than self-managed VDI<\/strong> stacks (brokers, gateways, scaling logic, HA for controllers).<\/li>\n<li><strong>Compartment-based delegation<\/strong>: different teams can administer their desktops without tenancy-wide access.<\/li>\n<li><strong>Repeatable provisioning<\/strong>: pools\/templates reduce manual desktop builds.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Least privilege access<\/strong> via IAM policies.<\/li>\n<li><strong>Auditability<\/strong>: administrative actions in OCI are captured by <strong>OCI Audit<\/strong>.<\/li>\n<li><strong>Network segmentation<\/strong>: place desktops in dedicated subnets, restrict egress, and enforce private-only access.<\/li>\n<li>Supports compliance narratives such as <em>data residency<\/em> and <em>controlled access<\/em> (your compliance team must validate the full control set).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Scale user desktops<\/strong> by adding capacity (subject to region quotas).<\/li>\n<li>Choose <strong>desktop shapes<\/strong> appropriate for workloads (CPU\/memory; GPU shapes may be available depending on region\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose Secure Desktops<\/h3>\n\n\n\n<p>Choose Secure Desktops when:\n&#8211; You need secure access for <strong>contractors\/partners<\/strong>.\n&#8211; You are subject to <strong>regulated data handling<\/strong> requirements.\n&#8211; You want a <strong>managed<\/strong> approach rather than operating a full VDI platform.\n&#8211; You need <strong>private access<\/strong> to OCI resources (databases, internal apps) without exposing them publicly.\n&#8211; You want to reduce endpoint risk while still giving users a familiar desktop UI.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose Secure Desktops<\/h3>\n\n\n\n<p>Avoid (or reconsider) Secure Desktops when:\n&#8211; Users require <strong>offline<\/strong> work capability (cloud desktops require connectivity).\n&#8211; You need extensive <strong>USB\/peripheral redirection<\/strong> or niche hardware support (verify what is supported).\n&#8211; You need <strong>deep customization<\/strong> at the broker\/gateway layer (managed services intentionally abstract this).\n&#8211; Your workloads are primarily <strong>SaaS\/browser-based<\/strong> with no sensitive local processing; a hardened browser or zero-trust web access might be simpler.\n&#8211; Latency to OCI regions is high for your user base and user experience is unacceptable.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Secure Desktops used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (trading support, analysts, risk teams)<\/li>\n<li>Healthcare and life sciences (PHI access controls, research datasets)<\/li>\n<li>Government\/public sector (controlled environments, contractors)<\/li>\n<li>Education (computer labs, training environments)<\/li>\n<li>Technology and BPO\/call centers (rapid onboarding, policy enforcement)<\/li>\n<li>Legal and professional services (case files, client confidentiality)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security engineering \/ SOC analysts<\/li>\n<li>Data analysts \/ BI teams<\/li>\n<li>Developers needing secure access to source code and internal tools<\/li>\n<li>Contractors and third-party vendor staff<\/li>\n<li>Support teams handling customer data<\/li>\n<li>Students in training programs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Secure access to internal web apps and APIs<\/li>\n<li>Admin tools for cloud operations (without installing tools on endpoints)<\/li>\n<li>Analytics tools (Python\/R, SQL clients) against sensitive databases<\/li>\n<li>Secure browsing and document handling<\/li>\n<li>Privileged workflows (jump desktop pattern)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures and deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cloud-native<\/strong>: desktops in OCI VCNs accessing OCI databases\/services privately<\/li>\n<li><strong>Hybrid<\/strong>: desktops in OCI accessing on-prem systems via DRG + VPN\/FastConnect<\/li>\n<li><strong>Multi-cloud<\/strong>: desktops in OCI used as controlled access point to other clouds (carefully manage egress and identity)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: for regulated access, contractor environments, privileged jump desktops<\/li>\n<li><strong>Dev\/test<\/strong>: for training labs, temporary project teams, proof-of-concept environments<br\/>\n  (Keep dev\/test costs and data exposure controlled; do not use production datasets casually.)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic Secure Desktops use cases. Each includes the problem, why Secure Desktops fits, and a short scenario.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Contractor access to sensitive internal apps<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Contractors need access to internal systems, but you don\u2019t trust their endpoints.<\/li>\n<li><strong>Why Secure Desktops fits<\/strong>: Keep data and sessions inside OCI; centralize access control and deprovision quickly.<\/li>\n<li><strong>Scenario<\/strong>: A vendor developer accesses a private Jira\/Confluence and internal Git from a Secure Desktop in a locked-down subnet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Call center \/ customer support desktops<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Agents handle PII and payment-related data; endpoints are hard to standardize.<\/li>\n<li><strong>Why it fits<\/strong>: Central desktop images, reduced endpoint exposure, easier enforcement.<\/li>\n<li><strong>Scenario<\/strong>: Agents connect to a Secure Desktop to run CRM tools; desktops are rotated periodically.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Secure \u201cjump desktop\u201d for privileged admin work<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Admins use powerful credentials; endpoints are the weakest link.<\/li>\n<li><strong>Why it fits<\/strong>: Use Secure Desktops as a controlled admin workstation inside the management network.<\/li>\n<li><strong>Scenario<\/strong>: Cloud admins use Secure Desktops to access OCI Console, internal bastions, and private management APIs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Data analyst workspace for regulated datasets<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Analysts need dataset access; exports to laptops are a risk.<\/li>\n<li><strong>Why it fits<\/strong>: Data stays in OCI; desktops sit near data for performance.<\/li>\n<li><strong>Scenario<\/strong>: Analysts run SQL clients and Python notebooks on Secure Desktops to access a private Autonomous Database.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) M&amp;A \/ legal review clean room<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Sensitive documents must be reviewed by a limited set of users.<\/li>\n<li><strong>Why it fits<\/strong>: Controlled access, quick provisioning, revocation, segmentation.<\/li>\n<li><strong>Scenario<\/strong>: A dedicated compartment + VCN hosts Secure Desktops that can access only a document repository and nothing else.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Training labs and classroom desktops<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Students need consistent lab environments; local installs are slow and inconsistent.<\/li>\n<li><strong>Why it fits<\/strong>: Standard images and fast reset of environments.<\/li>\n<li><strong>Scenario<\/strong>: A training org provides Secure Desktops with preinstalled tools for a 2-day course.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Secure software development environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Source code and secrets should not live on laptops.<\/li>\n<li><strong>Why it fits<\/strong>: Development happens in the cloud; integrate with private CI\/CD and repos.<\/li>\n<li><strong>Scenario<\/strong>: Developers use Secure Desktops to access internal repos, build tools, and private artifact registries.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Third-party incident response \/ forensics access<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: External IR teams need access to logs and systems quickly, but you must constrain access.<\/li>\n<li><strong>Why it fits<\/strong>: Time-boxed desktops, network restrictions, rapid teardown.<\/li>\n<li><strong>Scenario<\/strong>: IR contractors get Secure Desktops in a restricted subnet that can reach only logging\/SIEM endpoints.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Regional data residency access point<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Data must stay in a specific geography; users are global.<\/li>\n<li><strong>Why it fits<\/strong>: Place desktops in the compliant region; users access remotely.<\/li>\n<li><strong>Scenario<\/strong>: EU data is processed only in an EU OCI region; global users connect to EU-hosted desktops.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Secure access to legacy apps that require desktop clients<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Some internal apps require Windows desktop clients and private connectivity.<\/li>\n<li><strong>Why it fits<\/strong>: Centralize desktop clients in OCI close to apps; avoid distributing installers.<\/li>\n<li><strong>Scenario<\/strong>: Finance users access an internal thick-client application from Secure Desktops.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Vendor-managed operational support<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: A vendor needs periodic access to internal systems for support.<\/li>\n<li><strong>Why it fits<\/strong>: Controlled access during service windows; revoke afterwards.<\/li>\n<li><strong>Scenario<\/strong>: Vendor support receives Secure Desktop access only during scheduled maintenance windows.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) High-performance workstation adjacent to cloud workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: Users need higher CPU\/RAM (and sometimes GPU) than laptops provide, near cloud data.<\/li>\n<li><strong>Why it fits<\/strong>: Pick larger shapes; reduce data movement; centralize access.<\/li>\n<li><strong>Scenario<\/strong>: Engineers run compute-heavy simulations on Secure Desktops near OCI storage and compute backends (GPU availability varies\u2014verify).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>This section focuses on practical, commonly expected Secure Desktops features. If any feature is a hard requirement, <strong>verify in official docs<\/strong> because availability can differ by region\/edition and the service evolves.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Managed desktop provisioning<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Creates and maintains desktop instances for users without you building a VDI control plane.<\/li>\n<li><strong>Why it matters<\/strong>: Cuts time to deliver desktops and reduces operational complexity.<\/li>\n<li><strong>Practical benefit<\/strong>: Faster onboarding and more consistent environments.<\/li>\n<li><strong>Caveats<\/strong>: Quotas\/capacity in a region may constrain rapid scale-out.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Desktop pools \/ templates (standardization)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Lets you define a standard configuration (shape, image, network placement) and replicate it across many desktops.<\/li>\n<li><strong>Why it matters<\/strong>: Consistency and predictable operations.<\/li>\n<li><strong>Practical benefit<\/strong>: One change process for many users (for example, rotate to a new image version).<\/li>\n<li><strong>Caveats<\/strong>: Pool features and lifecycle actions vary\u2014verify exact controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Integration with OCI compartments and tagging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Lets you scope Secure Desktops resources to compartments and apply tags.<\/li>\n<li><strong>Why it matters<\/strong>: Enables delegation, cost allocation, and governance.<\/li>\n<li><strong>Practical benefit<\/strong>: Separate contractor desktops from employee desktops; chargeback by cost center.<\/li>\n<li><strong>Caveats<\/strong>: Tagging policies and required tags should be enforced via governance processes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) VCN-based networking (private access)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Places desktops into your OCI network (VCN\/subnet), enabling private connectivity to OCI and hybrid resources.<\/li>\n<li><strong>Why it matters<\/strong>: You can keep apps private\u2014no public exposure required.<\/li>\n<li><strong>Practical benefit<\/strong>: Desktop-to-database connections stay on private IPs; simpler security posture.<\/li>\n<li><strong>Caveats<\/strong>: Network security lists\/NSGs and routing must be correct; misconfiguration can break connectivity or increase exposure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Identity and access control via OCI IAM \/ Identity Domains<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Controls who can administer Secure Desktops and who can use assigned desktops.<\/li>\n<li><strong>Why it matters<\/strong>: Least privilege and controlled onboarding\/offboarding.<\/li>\n<li><strong>Practical benefit<\/strong>: Use groups for role-based access; require MFA for interactive access.<\/li>\n<li><strong>Caveats<\/strong>: The exact mapping of \u201cuser can connect\u201d permissions should be verified in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Auditability through OCI Audit<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Records control-plane actions (create\/update\/delete resources, policy changes, etc.).<\/li>\n<li><strong>Why it matters<\/strong>: Supports incident response and compliance evidence.<\/li>\n<li><strong>Practical benefit<\/strong>: Trace who changed a desktop pool configuration and when.<\/li>\n<li><strong>Caveats<\/strong>: Audit covers OCI API events; it is not the same as session recording.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Compatibility with OCI security services (governance posture)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Enables you to apply Cloud Guard, Security Zones (where applicable), and IAM best practices around the environment.<\/li>\n<li><strong>Why it matters<\/strong>: Align desktops with broader cloud security.<\/li>\n<li><strong>Practical benefit<\/strong>: Detect overly permissive networking or risky configuration drift.<\/li>\n<li><strong>Caveats<\/strong>: Specific Secure Desktops resource coverage varies\u2014verify in Cloud Guard documentation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Shape-based performance selection<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Lets you choose CPU\/memory configurations suitable for user workloads.<\/li>\n<li><strong>Why it matters<\/strong>: Desktop UX depends heavily on CPU\/RAM and distance\/latency.<\/li>\n<li><strong>Practical benefit<\/strong>: Match developer desktops to heavier shapes while keeping call center desktops cost-efficient.<\/li>\n<li><strong>Caveats<\/strong>: Some shapes may be limited by quotas; GPU shapes (if supported) are region-dependent.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Cost control through centralized lifecycle management<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Allows you to reclaim unused desktops, standardize sizes, and enforce schedules (if supported).<\/li>\n<li><strong>Why it matters<\/strong>: Idle desktops can become a silent cost center.<\/li>\n<li><strong>Practical benefit<\/strong>: Deprovision quickly when a contract ends; rotate images without manual rebuild.<\/li>\n<li><strong>Caveats<\/strong>: Scheduling\/auto-stop behaviors are feature-dependent\u2014verify availability.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>Secure Desktops has a managed control plane (Oracle-managed) and resources deployed into your tenancy (your-managed boundary). At a practical level:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane<\/strong>: You define desktop pools, images, assignments, policies.<\/li>\n<li><strong>Data plane<\/strong>: Desktop instances run in your VCN\/subnet. Users connect via a Secure Desktops access method (client\/browser), which brokers a secure session to the desktop.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (typical)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Admin configures Secure Desktops resources (pools, networking, access) in OCI Console\/API.<\/li>\n<li>The service provisions desktop instances into your VCN\/subnet (based on configuration).<\/li>\n<li>A user authenticates (OCI identity) and starts a desktop session.<\/li>\n<li>The session traffic flows between the user client and the desktop, mediated by the Secure Desktops connectivity mechanism.<\/li>\n<li>Desktop accesses internal resources privately (databases, apps) using VCN routing.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related OCI services<\/h3>\n\n\n\n<p>Common integrations in real designs:\n&#8211; <strong>VCN, subnets, NSGs, route tables<\/strong>: network placement and segmentation\n&#8211; <strong>DRG + VPN\/FastConnect<\/strong>: hybrid connectivity to on-prem resources\n&#8211; <strong>OCI Bastion<\/strong> (optional): administrative access (SSH\/RDP) without public IPs, where applicable\n&#8211; <strong>OCI Vault<\/strong>: manage secrets\/keys for apps accessed from desktops\n&#8211; <strong>OCI Logging\/Audit\/Monitoring<\/strong>: operations and governance\n&#8211; <strong>Object Storage<\/strong> (optional): controlled file exchange patterns (be careful\u2014this can become an exfil path if not governed)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services (conceptual)<\/h3>\n\n\n\n<p>Secure Desktops typically depends on:\n&#8211; <strong>OCI Compute<\/strong> (desktop instances)\n&#8211; <strong>Block storage<\/strong> (boot volumes and potentially data volumes)\n&#8211; <strong>VCN<\/strong> (networking)\n&#8211; <strong>IAM<\/strong> (identity, policies)\n&#8211; <strong>Service-managed brokering\/connectivity components<\/strong> (Oracle-managed)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Admins<\/strong>: controlled by OCI IAM policies and compartment membership.<\/li>\n<li><strong>Users<\/strong>: authenticate via OCI identity (often Identity Domains). MFA is recommended.<\/li>\n<li><strong>Network<\/strong>: desktops ideally run in <strong>private subnets<\/strong>; avoid public IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model (recommended baseline)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Private subnet for desktops<\/li>\n<li>NAT gateway for outbound OS updates (if internet egress is permitted)<\/li>\n<li>Service gateway for private access to OCI services (Object Storage, etc.) without public internet<\/li>\n<li>Egress controls via NSGs + route tables + (optionally) network firewall patterns<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>OCI Audit<\/strong> for control plane actions.<\/li>\n<li>Use <strong>OCI Monitoring<\/strong> for underlying compute\/storage metrics where applicable.<\/li>\n<li>Use <strong>Logging<\/strong> for OS\/application logs (agent-based), if you install\/configure it.<\/li>\n<li>Use tags, budgets, and compartments for cost governance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (conceptual)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[End user device] --&gt;|Authenticate (OCI Identity)| ID[OCI Identity \/ IAM]\n  U --&gt;|Secure Desktop session| SD[Secure Desktops service]\n  SD --&gt;|Provision &amp; manage| DP[Desktop pool]\n  DP --&gt; DSK[Desktop instances in OCI]\n  DSK --&gt; VCN[VCN \/ Private Subnet]\n  VCN --&gt; APP[Private apps &amp; databases]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (more realistic)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph User_Side[\"User Side\"]\n    User[User laptop\/BYOD]\n    MFA[MFA]\n  end\n\n  subgraph Identity[\"Identity &amp; Access\"]\n    IDD[OCI Identity Domain]\n    IAM[OCI IAM Policies \/ Groups]\n  end\n\n  subgraph OCI_Network[\"OCI Networking (VCN)\"]\n    SUBP[Private subnet: Secure Desktops]\n    NSG[NSG \/ Security Lists]\n    NAT[NAT Gateway (optional)]\n    SGW[Service Gateway (optional)]\n    DRG[DRG to On-Prem (optional)]\n  end\n\n  subgraph SecureDesktops[\"Secure Desktops (Compute)\"]\n    CP[Secure Desktops control plane]\n    POOL[Desktop pools]\n    DESK[Desktop instances]\n  end\n\n  subgraph Shared_Services[\"Security &amp; Operations\"]\n    AUD[OCI Audit]\n    MON[OCI Monitoring]\n    LOG[OCI Logging (agent-based \/ service logs where available)]\n    CG[Cloud Guard (optional)]\n    VAULT[OCI Vault (optional)]\n  end\n\n  User --&gt; MFA --&gt; IDD --&gt; IAM --&gt; CP\n  CP --&gt; POOL --&gt; DESK --&gt; SUBP --&gt; NSG\n  SUBP --&gt; NAT\n  SUBP --&gt; SGW\n  SUBP --&gt; DRG\n\n  CP --&gt; AUD\n  DESK --&gt; MON\n  DESK --&gt; LOG\n  CP --&gt; CG\n  DESK --&gt; VAULT\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Before you start working with Secure Desktops in Oracle Cloud:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy \/ account requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>Oracle Cloud (OCI) tenancy<\/strong> with access to the <strong>OCI Console<\/strong><\/li>\n<li>Ability to create\/manage resources in a target <strong>compartment<\/strong><\/li>\n<li>Secure Desktops service must be available in your chosen region (availability can be regional)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM<\/h3>\n\n\n\n<p>You need permissions to:\n&#8211; Manage Secure Desktops resources in the compartment\n&#8211; Manage or use VCN\/subnet resources used for desktop placement\n&#8211; Assign users\/groups to desktops (identity permissions)<\/p>\n\n\n\n<p>Because IAM policy resource names and families can change, <strong>use the OCI Console policy builder<\/strong> and <strong>verify the exact policy syntax in the official Secure Desktops docs<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A paid tenancy or an account with billing enabled (free trial\/free tier may not cover all shapes\/services needed)<\/li>\n<li>Understand that desktops often incur costs while provisioned\/active (and sometimes while stopped\u2014depends on pricing model)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Console (sufficient for this tutorial)<\/li>\n<li>Optional: OCI CLI for general tenancy operations<br\/>\n  OCI CLI install guide: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm Secure Desktops is enabled in your region by checking the OCI Console navigation\/search.<\/li>\n<li>If you operate in multiple regions, decide if you need regional desktop pools.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Compute quotas (OCPU\/memory) and service limits can prevent desktop provisioning.<\/li>\n<li>Check <strong>Service Limits<\/strong> in OCI for Compute and any Secure Desktops-specific limits (if exposed).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VCN<\/strong> with appropriate subnet(s)<\/li>\n<li>Identity users\/groups in OCI (preferably via Identity Domains)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Pricing is one of the most important design dimensions for desktop services. Secure Desktops costs are typically a blend of:\n&#8211; A <strong>service charge<\/strong> for the desktop management layer (if Oracle prices it separately)\n&#8211; The <strong>underlying compute<\/strong> (shape hours) and <strong>storage<\/strong> (boot\/data volumes)\n&#8211; Potential OS licensing costs (for example, Windows licensing models vary\u2014verify)\n&#8211; Network egress costs (internet outbound, cross-region, etc.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions to validate<\/h3>\n\n\n\n<p>Use official Oracle sources to confirm current pricing for your region and service version:\n&#8211; Oracle Cloud Pricing: https:\/\/www.oracle.com\/cloud\/pricing\/\n&#8211; Oracle Cloud Price List: https:\/\/www.oracle.com\/cloud\/price-list\/\n&#8211; Oracle Cloud Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/p>\n\n\n\n<p>Key pricing dimensions often include:\n&#8211; <strong>Desktop-hours<\/strong> (per provisioned desktop per hour, or per active session hour\u2014verify)\n&#8211; <strong>Compute shape<\/strong> (OCPU, memory; GPU if used)\n&#8211; <strong>Boot volume size and performance tier<\/strong>\n&#8211; <strong>Block volume \/ file storage<\/strong> if attached for user data\n&#8211; <strong>Network egress<\/strong> (to internet; cross-region)\n&#8211; <strong>Optional security\/network services<\/strong> (NAT Gateway, Network Firewall, etc.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier (if applicable)<\/h3>\n\n\n\n<p>Oracle Free Tier may not cover Secure Desktops. Even when OCI has free resources, managed desktop services and the required shapes may not be free-tier eligible. <strong>Verify in the Oracle Free Tier and Secure Desktops pricing docs<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Main cost drivers<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Cost Driver<\/th>\n<th>Why it matters<\/th>\n<th>Typical optimization<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Number of desktops<\/td>\n<td>Scales linearly with headcount<\/td>\n<td>Use pools sized to demand; reclaim unused desktops<\/td>\n<\/tr>\n<tr>\n<td>Desktop runtime<\/td>\n<td>Always-on desktops can be expensive<\/td>\n<td>Stop\/deprovision when not needed (if supported)<\/td>\n<\/tr>\n<tr>\n<td>Shape size<\/td>\n<td>CPU\/RAM overprovisioning wastes spend<\/td>\n<td>Right-size by persona; pilot and measure<\/td>\n<\/tr>\n<tr>\n<td>Storage<\/td>\n<td>Large boot\/data volumes add monthly cost<\/td>\n<td>Use minimal boot sizes; separate shared data stores<\/td>\n<\/tr>\n<tr>\n<td>Network egress<\/td>\n<td>Internet downloads\/uploads can add cost<\/td>\n<td>Prefer service gateway\/private endpoints; restrict egress<\/td>\n<\/tr>\n<tr>\n<td>Windows licensing<\/td>\n<td>Can materially change TCO<\/td>\n<td>Validate licensing model early<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs to watch<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Idle desktops<\/strong> that remain provisioned<\/li>\n<li><strong>Outbound internet egress<\/strong> for patches, package installs, and browsing<\/li>\n<li><strong>Third-party tooling<\/strong> inside desktops (security agents, EDR, monitoring)<\/li>\n<li><strong>Storage snapshots\/backups<\/strong> if you implement them<\/li>\n<li><strong>Hybrid connectivity<\/strong> (FastConnect costs, partner fees)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Desktop UX improves when desktops are close to users, but data residency and private backend access may require specific regions.<\/li>\n<li>If users download data from desktops to the internet or external services, you can incur egress charges and increase exfil risk.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost optimization strategies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Define <strong>personas<\/strong> (task worker, developer, power user) and standardize shapes per persona.<\/li>\n<li>Use <strong>private subnets<\/strong> and restrict internet egress; use a service gateway for OCI services where possible.<\/li>\n<li>Rotate images rather than letting long-lived desktops drift (reduces ops time and incident risk).<\/li>\n<li>Use budgets and tagging:<\/li>\n<li><code>cost_center<\/code>, <code>env<\/code>, <code>owner<\/code>, <code>desktop_persona<\/code>, <code>project<\/code><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (method, not numbers)<\/h3>\n\n\n\n<p>A realistic way to estimate:\n1. Pick a small desktop shape (minimum supported).\n2. Choose the smallest practical boot volume size.\n3. Assume a small number of desktops (1\u20135) for a pilot.\n4. Estimate hours:\n   &#8211; Example: 8 hours\/day * 20 days\/month * N desktops\n5. Add network egress estimates if desktops reach the public internet.\n6. Validate in the <strong>OCI Cost Estimator<\/strong>.<\/p>\n\n\n\n<p>Because exact SKUs and rates vary by region and change over time, <strong>do not hardcode prices<\/strong>\u2014use the official price list and cost estimator.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>For production, your largest cost risks usually come from:\n&#8211; Many always-on desktops\n&#8211; Overprovisioned shapes\n&#8211; High storage allocations per user\n&#8211; Internet egress and uncontrolled downloads\n&#8211; Windows licensing assumptions made late<\/p>\n\n\n\n<p>A good production cost process:\n&#8211; Pilot \u2192 measure utilization \u2192 right-size shapes \u2192 set lifecycle rules \u2192 enforce tagging\/budgets.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab is designed to be <strong>realistic, low-risk, and beginner-friendly<\/strong> while staying honest about UI and feature variation across regions\/tenancies.<\/p>\n\n\n\n<p>Because Secure Desktops is a managed service and Oracle can update workflows, some button names and screens may differ. Use the OCI Console\u2019s <strong>search bar<\/strong> for \u201cSecure Desktops\u201d and <strong>verify in official docs<\/strong> if your console differs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Provision a minimal Secure Desktops environment in Oracle Cloud:\n&#8211; A dedicated compartment\n&#8211; A VCN with a private subnet suitable for desktops\n&#8211; A small Secure Desktops pool (or equivalent construct)\n&#8211; Assign a test user\n&#8211; Connect and validate basic access\n&#8211; Clean up all resources to control cost<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create a compartment and basic governance tags (optional).\n2. Create a VCN with a private subnet (wizard-based).\n3. Confirm IAM\/user prerequisites for desktop access.\n4. Create a Secure Desktop pool and one desktop.\n5. Connect to the desktop and validate network\/private access posture.\n6. Troubleshoot common failures.\n7. Delete resources (cleanup).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a compartment for Secure Desktops<\/h3>\n\n\n\n<p><strong>Why<\/strong>: Compartments isolate resources, access policies, and cost reporting.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the <strong>OCI Console<\/strong>.<\/li>\n<li>Open the navigation menu \u2192 <strong>Identity &amp; Security<\/strong> \u2192 <strong>Compartments<\/strong>.<\/li>\n<li>Click <strong>Create Compartment<\/strong>.<\/li>\n<li>Set:\n   &#8211; Name: <code>cmp-secure-desktops-lab<\/code>\n   &#8211; Description: <code>Secure Desktops lab resources<\/code>\n   &#8211; Parent: your root compartment (or a sandbox compartment)<\/li>\n<li>Click <strong>Create Compartment<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A new compartment exists and appears in the compartment list.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Switch the compartment selector (top-left in many OCI pages) to <code>cmp-secure-desktops-lab<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a VCN with a private subnet (VCN wizard)<\/h3>\n\n\n\n<p><strong>Why<\/strong>: Desktops should generally not have public IPs. A private subnet plus controlled egress is the usual baseline.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>Networking<\/strong> \u2192 <strong>Virtual Cloud Networks<\/strong>.<\/li>\n<li>Ensure you\u2019re in the <code>cmp-secure-desktops-lab<\/code> compartment.<\/li>\n<li>Click <strong>Create VCN<\/strong>.<\/li>\n<li>Choose a wizard option similar to:\n   &#8211; <strong>VCN with a private subnet and NAT gateway<\/strong> (recommended for labs)<\/li>\n<li>Configure:\n   &#8211; VCN name: <code>vcn-secure-desktops-lab<\/code>\n   &#8211; CIDR: choose a non-overlapping range (example: <code>10.10.0.0\/16<\/code>)<br\/>\n     (Use your organization\u2019s IP plan in real environments.)\n   &#8211; Private subnet name: <code>subnet-secure-desktops-private<\/code>\n   &#8211; Enable DNS (default)<\/li>\n<li>Create the VCN.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A VCN is created with a private subnet and a NAT gateway (and usually an internet gateway is not required for private subnet-only designs).<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Open the VCN \u2192 check:\n  &#8211; Subnets include <code>subnet-secure-desktops-private<\/code>\n  &#8211; A NAT gateway exists\n  &#8211; Route table for the private subnet routes <code>0.0.0.0\/0<\/code> to NAT (typical wizard behavior)\n&#8211; Confirm the subnet is marked <strong>Private<\/strong> (no direct public IP assignment).<\/p>\n\n\n\n<p><strong>Cost note<\/strong>\n&#8211; NAT Gateway can incur cost depending on Oracle\u2019s pricing model. If your desktops do not need outbound internet, you can design without NAT and use a service gateway + internal repos, but that increases setup complexity.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Prepare identity and access (user\/group readiness)<\/h3>\n\n\n\n<p>Secure Desktops access is identity-driven. You need:\n&#8211; An admin who can create Secure Desktops resources\n&#8211; A user who can be assigned a desktop<\/p>\n\n\n\n<p><strong>Option A (simplest for labs): Use your existing admin user<\/strong>\n&#8211; If you are a tenancy admin, you can proceed without creating additional policies.<\/p>\n\n\n\n<p><strong>Option B (recommended for realistic setups): Create a test user and group<\/strong>\nExact steps differ depending on whether your tenancy uses <strong>Identity Domains<\/strong>. In many tenancies:\n1. Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Domains<\/strong> (or Identity).\n2. Create a user: <code>sd-lab-user<\/code>\n3. Create a group: <code>grp-secure-desktops-users<\/code>\n4. Add <code>sd-lab-user<\/code> to that group.\n5. Ensure MFA is enabled\/required based on your security policy.<\/p>\n\n\n\n<p><strong>IAM policy note<\/strong>\nYou may need an IAM policy to allow the group to <em>use<\/em> Secure Desktops. Because the exact policy resource names can change, <strong>do one of the following<\/strong>:\n&#8211; Use the OCI Console policy builder for Secure Desktops, or\n&#8211; Follow the official Secure Desktops IAM policy examples (recommended)<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You have at least one user who can be assigned to a desktop.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm the user can sign in (if you intend to test actual login).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Secure Desktop pool (or equivalent) in the Console<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the OCI Console, use the search bar and type <strong>Secure Desktops<\/strong>.<\/li>\n<li>Open <strong>Secure Desktops<\/strong>.<\/li>\n<li>Ensure compartment is <code>cmp-secure-desktops-lab<\/code>.<\/li>\n<li>Click <strong>Create<\/strong> (pool \/ desktop pool \/ desktop definition\u2014label varies).<\/li>\n<li>Configure the desktop pool:\n   &#8211; Name: <code>sd-pool-lab<\/code>\n   &#8211; VCN: <code>vcn-secure-desktops-lab<\/code>\n   &#8211; Subnet: <code>subnet-secure-desktops-private<\/code>\n   &#8211; Desktop count: <code>1<\/code> (keep it minimal)\n   &#8211; Shape: choose the smallest practical shape offered\n   &#8211; Image\/OS: choose an available base image suitable for your lab<br\/>\n     (If Windows is offered, validate licensing implications before proceeding.)<\/li>\n<li>Create the pool.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The pool is created and begins provisioning a desktop instance.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Pool lifecycle state shows <strong>Provisioning<\/strong> then <strong>Active<\/strong> (names vary).\n&#8211; The desktop instance appears in the pool with a status like <strong>Available<\/strong>.<\/p>\n\n\n\n<p><strong>Common provisioning blockers<\/strong>\n&#8211; Insufficient compute quota (OCPU\/memory)\n&#8211; Capacity constraints in the AD\n&#8211; Missing permissions to use the subnet\/VCN\n&#8211; Unsupported region\/feature not enabled<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Assign a user to the desktop<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open your <code>sd-pool-lab<\/code> pool.<\/li>\n<li>Find <strong>Assignments<\/strong> or <strong>Users<\/strong> (label varies).<\/li>\n<li>Add <code>sd-lab-user<\/code> (or a group like <code>grp-secure-desktops-users<\/code>) to the pool\/desktop assignment.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The user is authorized to connect to the desktop.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Assignment list shows the user\/group.\n&#8211; Desktop shows an \u201cAssigned\u201d indicator (if exposed).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Connect to the Secure Desktop<\/h3>\n\n\n\n<p>Connection methods vary. The OCI Console typically provides a <strong>Connect<\/strong> action that may:\n&#8211; Launch a browser session, and\/or\n&#8211; Download a connection file \/ require a desktop client<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in as the assigned user (or test with an authorized account).<\/li>\n<li>Navigate to Secure Desktops \u2192 your assigned desktop.<\/li>\n<li>Click <strong>Connect<\/strong>.<\/li>\n<li>Follow prompts to authenticate and start the session.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You land on the remote desktop UI.<\/p>\n\n\n\n<p><strong>Verification inside the desktop<\/strong>\n&#8211; Open a terminal (Linux) or command prompt (Windows) and check IP\/network:\n  &#8211; Linux:\n    <code>bash\n    ip addr\n    ip route\n    curl -s https:\/\/ifconfig.me || true<\/code>\n  &#8211; Windows (PowerShell):\n    <code>powershell\n    ipconfig\n    route print<\/code>\n&#8211; Confirm the desktop has a <strong>private IP<\/strong> from your subnet range.\n&#8211; If you allowed outbound internet via NAT, <code>curl https:\/\/ifconfig.me<\/code> may return a public IP (the NAT egress). If your policy disallows internet, it should fail\u2014either is acceptable depending on your intended design.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Resource placement<\/strong>\n   &#8211; Desktop is in <code>cmp-secure-desktops-lab<\/code>\n   &#8211; Desktop VNIC is in <code>subnet-secure-desktops-private<\/code>\n   &#8211; Desktop has a <strong>private IP<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Access control<\/strong>\n   &#8211; Only the assigned user\/group can connect\n   &#8211; Admin actions appear in <strong>OCI Audit<\/strong> (Identity &amp; Security \u2192 Audit)<\/p>\n<\/li>\n<li>\n<p><strong>Network controls<\/strong>\n   &#8211; No public IP assigned to the desktop\n   &#8211; Egress matches your design (NAT or restricted)<\/p>\n<\/li>\n<li>\n<p><strong>Cost control<\/strong>\n   &#8211; Only one desktop was created\n   &#8211; You can identify resources by compartment and tags (if used)<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Symptom<\/th>\n<th>Likely cause<\/th>\n<th>Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Secure Desktops not visible in Console<\/td>\n<td>Region\/service availability<\/td>\n<td>Try another region; verify service availability in official docs<\/td>\n<\/tr>\n<tr>\n<td>Desktop stuck in provisioning<\/td>\n<td>Quota\/capacity\/permission issue<\/td>\n<td>Check limits\/quota; try different shape\/AD; confirm VCN\/subnet permissions<\/td>\n<\/tr>\n<tr>\n<td>User can\u2019t connect<\/td>\n<td>Missing assignment or IAM permission<\/td>\n<td>Verify the user\/group is assigned; verify IAM policies in official docs<\/td>\n<\/tr>\n<tr>\n<td>No outbound internet<\/td>\n<td>No NAT route \/ NSG egress blocked<\/td>\n<td>Check route table to NAT; check security list\/NSG egress rules<\/td>\n<\/tr>\n<tr>\n<td>Can\u2019t reach private app<\/td>\n<td>Route\/NSG\/DNS issue<\/td>\n<td>Confirm VCN routing; confirm app is reachable from subnet; verify DNS resolution<\/td>\n<\/tr>\n<tr>\n<td>High latency \/ poor UX<\/td>\n<td>User far from region, shape too small<\/td>\n<td>Use closer region; increase shape size; validate client\/network<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p><strong>Where to look first<\/strong>\n&#8211; OCI Console: resource lifecycle states and error details\n&#8211; <strong>Audit logs<\/strong> for denied actions\n&#8211; VCN route tables \/ security lists \/ NSGs\n&#8211; Service limits and quotas<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges, delete resources in the correct order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Delete the Secure Desktop pool\/desktops<\/strong>\n   &#8211; Secure Desktops \u2192 <code>sd-pool-lab<\/code> \u2192 Delete\n   &#8211; Wait until desktops and pool are fully terminated<\/p>\n<\/li>\n<li>\n<p><strong>Delete networking (VCN)<\/strong>\n   &#8211; Networking \u2192 VCNs \u2192 <code>vcn-secure-desktops-lab<\/code>\n   &#8211; Use <strong>Terminate<\/strong> \/ <strong>Delete VCN<\/strong> (OCI will prompt to delete dependent gateways\/subnets)<\/p>\n<\/li>\n<li>\n<p><strong>Delete compartment (optional)<\/strong>\n   &#8211; Only after confirming it contains no resources<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm no desktops remain provisioned.\n&#8211; Check billing\/cost analysis later for any residual charges (storage may persist if not removed).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>private subnets<\/strong> for desktops; avoid public IPs.<\/li>\n<li>Segment by persona:<\/li>\n<li>Separate subnets\/NSGs for contractors vs employees vs privileged admins.<\/li>\n<li>Use a <strong>hub-and-spoke<\/strong> VCN design for large enterprises: shared services in hub; desktops in spokes via DRG\/LPG patterns (verify your org\u2019s standard).<\/li>\n<li>Keep desktops close to data to reduce data movement and improve performance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>group-based assignment<\/strong> over individual user assignment for scale.<\/li>\n<li>Enforce <strong>MFA<\/strong> for desktop access.<\/li>\n<li>Use least privilege:<\/li>\n<li>Admins: manage pools\/images<\/li>\n<li>Operators: view status\/metrics<\/li>\n<li>Users: connect only<\/li>\n<li>Separate duties:<\/li>\n<li>Image builders \u2260 security policy admins \u2260 user lifecycle admins<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with a pilot and measure CPU\/memory usage before scaling.<\/li>\n<li>Right-size shapes per persona.<\/li>\n<li>Reclaim unused desktops quickly.<\/li>\n<li>Use tags for chargeback:<\/li>\n<li><code>owner<\/code>, <code>department<\/code>, <code>project<\/code>, <code>env<\/code>, <code>persona<\/code><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Choose a region near end users.<\/li>\n<li>Validate latency and packet loss; desktop UX is sensitive to network quality.<\/li>\n<li>Standardize image startup items and avoid unnecessary background processes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid single points of failure in hybrid connectivity (use redundant VPN\/FastConnect where required).<\/li>\n<li>Use multiple pools if you need separation across ADs or fault domains (verify service behavior).<\/li>\n<li>Maintain an image rollout strategy with rollback.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Patch OS and applications on a schedule.<\/li>\n<li>Use configuration management for desktop software (where feasible).<\/li>\n<li>Monitor:<\/li>\n<li>Desktop provisioning failures<\/li>\n<li>Capacity\/quota thresholds<\/li>\n<li>Security posture drift<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Naming convention example:<\/li>\n<li>Pools: <code>sd-pool-&lt;env&gt;-&lt;persona&gt;-&lt;region&gt;<\/code><\/li>\n<li>Networks: <code>vcn-sd-&lt;env&gt;-&lt;region&gt;<\/code><\/li>\n<li>Use tag defaults at compartment level where possible.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<p>Secure Desktops is usually adopted primarily for security outcomes. Treat it as a <em>security-sensitive<\/em> service and design accordingly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use OCI IAM and Identity Domains for:<\/li>\n<li>Authentication (SSO\/MFA)<\/li>\n<li>Authorization (policies, groups)<\/li>\n<li>Minimize who can:<\/li>\n<li>Create\/modify pools<\/li>\n<li>Create\/modify images<\/li>\n<li>Change network placement<\/li>\n<li>Assign users<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI typically encrypts storage at rest by default for many services, using Oracle-managed keys or customer-managed keys depending on configuration.<br\/>\n<strong>Verify Secure Desktops storage encryption specifics in official docs<\/strong>, especially if you need:<\/li>\n<li>Customer-managed keys (CMK)<\/li>\n<li>Key rotation requirements<\/li>\n<li>Per-volume encryption settings<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer private subnets.<\/li>\n<li>Restrict egress:<\/li>\n<li>Use NSGs to allow only necessary outbound destinations (package repos, internal APIs).<\/li>\n<li>Avoid opening inbound rules broadly (0.0.0.0\/0) to any desktop ports.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not embed secrets in images.<\/li>\n<li>Use OCI Vault for:<\/li>\n<li>Application secrets<\/li>\n<li>API keys<\/li>\n<li>Use short-lived credentials where possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable and review:<\/li>\n<li><strong>OCI Audit<\/strong> for admin actions<\/li>\n<li>OS and application logs using approved logging agents (where applicable)<\/li>\n<li>Centralize logs to a SIEM.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<p>Secure Desktops can support compliance goals (data residency, least privilege, audit trails), but compliance is not automatic:\n&#8211; Document controls: identity, network, encryption, logging, retention\n&#8211; Validate with your compliance team and the official Oracle compliance documentation for OCI.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Putting desktops in a public subnet \u201cfor convenience\u201d<\/li>\n<li>Allowing unrestricted internet egress (turns desktops into an exfil channel)<\/li>\n<li>Using shared local admin passwords across desktops<\/li>\n<li>Allowing image sprawl without approval or scanning<\/li>\n<li>No offboarding process (contractors keep access longer than needed)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use private subnets + controlled egress.<\/li>\n<li>Enforce MFA and strong conditional access (where available).<\/li>\n<li>Use separate compartments for:<\/li>\n<li>Images<\/li>\n<li>Pools\/desktops<\/li>\n<li>Network<\/li>\n<li>Treat desktop images like server images:<\/li>\n<li>Patch, scan, approve, version, roll out.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because Secure Desktops is a managed service, expect service-specific constraints. Validate each item for your region\/tenancy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations to plan for (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Regional availability<\/strong>: Secure Desktops may not be available in all OCI regions.<\/li>\n<li><strong>Quotas\/capacity<\/strong>: Desktop provisioning can be blocked by compute quotas or AD capacity.<\/li>\n<li><strong>Latency sensitivity<\/strong>: Remote desktops require stable network connectivity.<\/li>\n<li><strong>Peripheral support<\/strong>: USB redirection, printers, webcams, multi-monitor support vary by client and service features (<strong>verify<\/strong>).<\/li>\n<li><strong>Image and customization workflows<\/strong>: Some managed services restrict deep OS customization.<\/li>\n<li><strong>Session vs machine persistence<\/strong>: Understand whether desktops are persistent, non-persistent, or support both (feature-dependent\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NAT gateway and egress can add up in large fleets.<\/li>\n<li>Storage retained after desktop deletion (depending on lifecycle) can continue billing\u2014confirm cleanup behavior.<\/li>\n<li>Windows licensing costs can dominate if not planned early.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some enterprise apps require hardware drivers or dongles not supported in virtual desktops.<\/li>\n<li>MFA\/SSO integration may require identity domain configuration and group mapping.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Golden image updates without versioning can cause fleet inconsistency.<\/li>\n<li>Mixing contractor and employee desktops in the same network segment increases risk.<\/li>\n<li>Not having a standard method for file exchange encourages shadow IT.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Moving from legacy VDI (Citrix\/Horizon) requires mapping:<\/li>\n<li>Profile management<\/li>\n<li>App delivery<\/li>\n<li>Peripheral policies<\/li>\n<li>Identity and conditional access models<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Secure Desktops is not the only way to deliver secure work environments. Consider alternatives based on control vs convenience, cost, and integration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Oracle Cloud Secure Desktops<\/strong><\/td>\n<td>Managed secure desktops in OCI<\/td>\n<td>Integrated with OCI IAM\/VCN, managed lifecycle, strong governance alignment<\/td>\n<td>Feature set and regional availability may vary; less control than self-managed<\/td>\n<td>You want OCI-native managed desktops with strong security posture<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Compute + self-managed VDI components<\/strong><\/td>\n<td>Teams needing full customization<\/td>\n<td>Maximum control over brokers\/gateways\/policies<\/td>\n<td>High ops burden, HA complexity, patching, scaling<\/td>\n<td>You need features not offered by Secure Desktops and can operate VDI<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Bastion + locked-down admin workstations<\/strong><\/td>\n<td>Privileged admin access only<\/td>\n<td>Very controlled access to private resources<\/td>\n<td>Not a full desktop fleet solution<\/td>\n<td>You only need secure admin access paths<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS WorkSpaces<\/strong><\/td>\n<td>AWS-first organizations<\/td>\n<td>Mature managed desktop service<\/td>\n<td>Cross-cloud integration adds complexity if apps\/data are in OCI<\/td>\n<td>Your workloads\/data are primarily in AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Virtual Desktop (AVD)<\/strong><\/td>\n<td>Microsoft ecosystem \/ Windows-heavy<\/td>\n<td>Strong Windows integration, flexible scaling<\/td>\n<td>More components to manage than some fully managed services<\/td>\n<td>You\u2019re heavily invested in Microsoft identity and Windows workloads<\/td>\n<\/tr>\n<tr>\n<td><strong>Windows 365<\/strong><\/td>\n<td>Simple cloud PC for knowledge workers<\/td>\n<td>Predictable packaging, Microsoft-managed experience<\/td>\n<td>Less control over VCN-style private networking to OCI<\/td>\n<td>You want simplified Windows cloud PCs more than deep OCI integration<\/td>\n<\/tr>\n<tr>\n<td><strong>Citrix \/ VMware Horizon (self-managed)<\/strong><\/td>\n<td>Enterprises with existing VDI expertise<\/td>\n<td>Very feature-rich<\/td>\n<td>High cost and operational complexity<\/td>\n<td>You already run VDI and need advanced features<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Regulated contractor access to internal financial systems<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: A bank uses contractors for analytics projects. Data is regulated and cannot be copied to contractor endpoints. The contractors are global.<\/li>\n<li><strong>Proposed architecture<\/strong><\/li>\n<li>OCI region aligned to data residency requirements<\/li>\n<li>Secure Desktops in private subnets<\/li>\n<li>DRG connectivity to on-prem core systems (VPN\/FastConnect)<\/li>\n<li>Identity Domain groups for contractor access with MFA<\/li>\n<li>Egress restricted to only required internal endpoints and approved update repositories<\/li>\n<li>Central logging and audit review<\/li>\n<li><strong>Why Secure Desktops was chosen<\/strong><\/li>\n<li>Managed fleet reduces VDI ops overhead<\/li>\n<li>Private networking integrates naturally with OCI and hybrid connectivity<\/li>\n<li>Compartment governance and Audit support compliance evidence<\/li>\n<li><strong>Expected outcomes<\/strong><\/li>\n<li>Reduced data exfil risk<\/li>\n<li>Faster contractor onboarding\/offboarding<\/li>\n<li>Clear audit trail for admin actions<\/li>\n<li>More consistent desktop environments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: Secure developer desktops for IP protection<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong>: A startup with distributed engineers wants to protect source code and secrets. Laptops are unmanaged and contractors come and go.<\/li>\n<li><strong>Proposed architecture<\/strong><\/li>\n<li>Single OCI region close to most developers<\/li>\n<li>One Secure Desktop pool for developers (right-sized shape)<\/li>\n<li>Private subnet with NAT for controlled outbound updates<\/li>\n<li>Access controlled by group membership; MFA enforced<\/li>\n<li>Git and CI systems reachable via private endpoints<\/li>\n<li><strong>Why Secure Desktops was chosen<\/strong><\/li>\n<li>Faster than building custom VDI<\/li>\n<li>Keeps code in OCI environment<\/li>\n<li>Easy to remove access when contracts end<\/li>\n<li><strong>Expected outcomes<\/strong><\/li>\n<li>Reduced IP loss risk<\/li>\n<li>Standardized dev toolchain<\/li>\n<li>Predictable onboarding process<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Secure Desktops the same as running RDP on an OCI Compute instance?<\/strong><br\/>\nNo. Secure Desktops is a managed service intended to provide a controlled desktop experience and centralized lifecycle. A raw compute instance with RDP\/SSH is more DIY and increases operational\/security burden.<\/p>\n\n\n\n<p>2) <strong>Do Secure Desktops run in my VCN?<\/strong><br\/>\nTypically, yes\u2014desktops are placed into your OCI networking so they can access private resources. Verify exact networking behavior in official docs.<\/p>\n\n\n\n<p>3) <strong>Can I put Secure Desktops in a private subnet with no public IP?<\/strong><br\/>\nThat is a common best practice. Ensure required egress (updates, identity, etc.) is available via NAT\/service gateway or private routes.<\/p>\n\n\n\n<p>4) <strong>How do users authenticate?<\/strong><br\/>\nUsually via OCI identity (often Identity Domains). MFA is strongly recommended. Verify supported identity integrations in your tenancy.<\/p>\n\n\n\n<p>5) <strong>Can I use my own custom desktop image?<\/strong><br\/>\nMany desktop services support golden images; the exact workflow varies. Verify Secure Desktops image management in official docs.<\/p>\n\n\n\n<p>6) <strong>Does Secure Desktops support Windows and Linux?<\/strong><br\/>\nSupport can vary by region and offering. Check the Secure Desktops creation wizard in your region and the official documentation.<\/p>\n\n\n\n<p>7) <strong>How is pricing calculated?<\/strong><br\/>\nTypically via desktop-hours and underlying compute\/storage\/network usage. Use Oracle\u2019s price list and cost estimator for your region.<\/p>\n\n\n\n<p>8) <strong>What are the biggest cost risks?<\/strong><br\/>\nAlways-on desktops, oversized shapes, large per-user storage, and internet egress.<\/p>\n\n\n\n<p>9) <strong>Can Secure Desktops access on-prem resources?<\/strong><br\/>\nYes, if your OCI network has connectivity (DRG + VPN\/FastConnect) and routing\/security rules allow it.<\/p>\n\n\n\n<p>10) <strong>How do I prevent data exfiltration?<\/strong><br\/>\nUse layered controls: IAM\/MFA, private networking, restrict egress, govern file exchange paths, and apply endpoint controls. Feature-level controls (clipboard\/file transfer) must be verified in Secure Desktops docs.<\/p>\n\n\n\n<p>11) <strong>Do I still need EDR\/antivirus on Secure Desktops?<\/strong><br\/>\nOften yes\u2014treat desktops like endpoints\/servers from a security operations perspective. Confirm organizational requirements.<\/p>\n\n\n\n<p>12) <strong>How do I monitor Secure Desktops health?<\/strong><br\/>\nUse OCI Audit for control plane actions, and monitor underlying compute\/network metrics. Add OS-level monitoring\/logging agents where appropriate.<\/p>\n\n\n\n<p>13) <strong>What happens when a user leaves?<\/strong><br\/>\nBest practice: remove from groups, revoke sessions, deprovision the desktop, and rotate images\/secrets if needed.<\/p>\n\n\n\n<p>14) <strong>Can I use Secure Desktops for privileged admin access?<\/strong><br\/>\nYes, as a \u201cjump desktop\u201d pattern. Keep it in a dedicated management network segment with strict IAM.<\/p>\n\n\n\n<p>15) <strong>Is Secure Desktops suitable for graphics-intensive workloads?<\/strong><br\/>\nPotentially, if GPU-capable desktop shapes are offered. Verify available shapes and client support in your region.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Secure Desktops<\/h2>\n\n\n\n<p>Because Oracle documentation URLs can change by service\/version, the safest approach is to start from official portals and search within them for <strong>\u201cSecure Desktops\u201d<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation portal<\/td>\n<td>OCI Documentation Home \u2014 https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/home.htm<\/td>\n<td>Starting point to find Secure Desktops docs and related networking\/IAM guidance<\/td>\n<\/tr>\n<tr>\n<td>Official tutorials<\/td>\n<td>OCI \u201cLearn\u201d tutorials \u2014 https:\/\/docs.oracle.com\/en\/learn\/<\/td>\n<td>Step-by-step labs across OCI; search for Secure Desktops and VCN patterns<\/td>\n<\/tr>\n<tr>\n<td>Official architecture center<\/td>\n<td>Oracle Architecture Center \u2014 https:\/\/docs.oracle.com\/solutions\/<\/td>\n<td>Reference architectures for secure networking, identity, logging, governance<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Oracle Cloud Pricing \u2014 https:\/\/www.oracle.com\/cloud\/pricing\/<\/td>\n<td>Overview of OCI pricing approach and service pages<\/td>\n<\/tr>\n<tr>\n<td>Official price list<\/td>\n<td>Oracle Cloud Price List \u2014 https:\/\/www.oracle.com\/cloud\/price-list\/<\/td>\n<td>Region\/SKU-based list pricing; confirm Secure Desktops SKUs here<\/td>\n<\/tr>\n<tr>\n<td>Official cost estimator<\/td>\n<td>Oracle Cloud Cost Estimator \u2014 https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<td>Build an estimate for desktop fleet costs and networking dependencies<\/td>\n<\/tr>\n<tr>\n<td>Official security guidance<\/td>\n<td>OCI Security documentation (start here) \u2014 https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Security\/home.htm<\/td>\n<td>Security building blocks: IAM, Vault, Cloud Guard, Security Zones<\/td>\n<\/tr>\n<tr>\n<td>Official networking guidance<\/td>\n<td>OCI Networking docs (start here) \u2014 https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/overview.htm<\/td>\n<td>VCN\/subnet\/NSG\/routing patterns that Secure Desktops relies on<\/td>\n<\/tr>\n<tr>\n<td>Videos (official)<\/td>\n<td>Oracle Cloud Infrastructure YouTube \u2014 https:\/\/www.youtube.com\/@OracleCloudInfrastructure<\/td>\n<td>Look for Secure Desktops sessions, demos, and security best practices<\/td>\n<\/tr>\n<tr>\n<td>Community learning<\/td>\n<td>Oracle Cloud Customer Connect \u2014 https:\/\/community.oracle.com\/customerconnect\/categories\/oci<\/td>\n<td>Practical discussions and announcements; validate against official docs<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The following are training providers to explore. Availability, course outlines, and delivery modes can change\u2014confirm on their websites.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>Engineers, DevOps, architects<\/td>\n<td>Cloud\/DevOps fundamentals, hands-on labs, automation<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate<\/td>\n<td>DevOps, SCM, CI\/CD concepts<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Ops\/Cloud engineers<\/td>\n<td>Cloud operations, monitoring, reliability practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs and platform teams<\/td>\n<td>Reliability engineering, SLOs, incident response<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops and automation teams<\/td>\n<td>AIOps concepts, automation, operational analytics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>These sites may list trainers, services, or training offerings. Verify the exact specialization and credentials directly on each platform.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud guidance (verify specific scope)<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training and coaching<\/td>\n<td>DevOps engineers and students<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps services\/training (verify)<\/td>\n<td>Teams needing flexible help<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and consulting-style help (verify)<\/td>\n<td>Ops\/DevOps teams<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>These organizations may offer consulting services relevant to Secure Desktops, OCI architecture, DevOps, and operations. Confirm service scope and references directly with each provider.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify offerings)<\/td>\n<td>Implementation support, automation, operations<\/td>\n<td>Landing zone setup, IAM\/network design review, migration planning<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>Training + consulting (verify)<\/td>\n<td>Enablement and delivery assistance<\/td>\n<td>Secure desktop rollout plan, ops runbooks, skills uplift workshops<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify offerings)<\/td>\n<td>CI\/CD, automation, cloud ops<\/td>\n<td>Standardization, monitoring\/logging setup, operational readiness<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Secure Desktops<\/h3>\n\n\n\n<p>To be effective with Secure Desktops in Oracle Cloud, learn:\n&#8211; OCI foundations: compartments, regions, availability domains\n&#8211; OCI IAM: users, groups, policies, Identity Domains, MFA\n&#8211; OCI networking: VCN, subnets, NSGs, route tables, NAT\/service gateways, DRG\n&#8211; Basic endpoint\/desktop security principles (least privilege, patching, logging)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Secure Desktops<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advanced OCI security:<\/li>\n<li>Cloud Guard, Security Zones (where applicable), Vault, key management<\/li>\n<li>Hybrid networking:<\/li>\n<li>DRG architectures, FastConnect, DNS patterns<\/li>\n<li>Operational maturity:<\/li>\n<li>Monitoring strategy, logging pipelines, SIEM integration, incident response<\/li>\n<li>Cost governance:<\/li>\n<li>Budgets, tagging policies, showback\/chargeback<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use Secure Desktops<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Solutions Architect (OCI)<\/li>\n<li>Cloud\/Platform Engineer<\/li>\n<li>Security Engineer \/ Cloud Security Architect<\/li>\n<li>EUC\/VDI Engineer (transitioning to cloud desktops)<\/li>\n<li>SRE \/ Operations Engineer<\/li>\n<li>IT Administrator for contractor\/workforce access<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle certifications change over time. A practical path is:\n&#8211; Start with OCI foundations certification paths\n&#8211; Add OCI Architect and OCI Security-focused certifications as relevant<br\/>\nVerify current Oracle certification tracks here: https:\/\/education.oracle.com\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a secure contractor desktop compartment with least privilege IAM and private-only networking.<\/li>\n<li>Implement an egress-restricted desktop subnet that can only reach approved internal endpoints.<\/li>\n<li>Create a golden image process (patch \u2192 validate \u2192 roll out) and document rollback steps.<\/li>\n<li>Produce an operational runbook: onboarding, offboarding, incident response, cost review.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI (Oracle Cloud Infrastructure)<\/strong>: Oracle Cloud\u2019s core IaaS\/PaaS platform.<\/li>\n<li><strong>Secure Desktops<\/strong>: OCI managed secure desktop service (DaaS) in the Compute category.<\/li>\n<li><strong>Compartment<\/strong>: Logical isolation boundary in OCI for resources, access, and cost tracking.<\/li>\n<li><strong>VCN (Virtual Cloud Network)<\/strong>: Your private network in OCI.<\/li>\n<li><strong>Subnet<\/strong>: A subdivision of a VCN where resources get IP addresses.<\/li>\n<li><strong>NSG (Network Security Group)<\/strong>: Virtual firewall rules applied to VNICs\/resources.<\/li>\n<li><strong>Security List<\/strong>: Subnet-level firewall rules (older model; still used).<\/li>\n<li><strong>NAT Gateway<\/strong>: Allows outbound internet access from private subnets without inbound exposure.<\/li>\n<li><strong>Service Gateway<\/strong>: Private access from VCN to OCI services without using the public internet.<\/li>\n<li><strong>DRG (Dynamic Routing Gateway)<\/strong>: Connects VCNs to on-prem or other networks.<\/li>\n<li><strong>IAM Policy<\/strong>: Authorization rules defining what users\/groups can do in OCI.<\/li>\n<li><strong>Identity Domain<\/strong>: OCI identity store for users\/groups, often integrated with SSO\/MFA.<\/li>\n<li><strong>Golden Image<\/strong>: A standardized base OS\/application image used to create desktops consistently.<\/li>\n<li><strong>Egress<\/strong>: Outbound network traffic from desktops to other destinations.<\/li>\n<li><strong>Audit log<\/strong>: OCI record of API\/control-plane actions for governance and investigations.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Secure Desktops in Oracle Cloud is a <strong>Compute<\/strong> service that provides <strong>managed, security-focused cloud desktops<\/strong> inside your OCI tenancy. It matters because it helps organizations reduce endpoint risk, centralize desktop operations, and provide controlled access to sensitive systems and data.<\/p>\n\n\n\n<p>Architecturally, Secure Desktops fits best when you combine it with OCI\u2019s strengths: <strong>VCN private networking<\/strong>, <strong>IAM\/Identity Domains<\/strong>, and governance services like <strong>Audit<\/strong>, tagging, and (optionally) Cloud Guard. Cost-wise, focus on the biggest drivers\u2014desktop count, runtime, shape sizing, storage, and network egress\u2014and always validate current SKUs in the official Oracle pricing pages and cost estimator.<\/p>\n\n\n\n<p>Use Secure Desktops when you need secure, centralized desktops for contractors, regulated work, or privileged access patterns. Avoid it when offline work, heavy peripheral requirements, or deep VDI control-plane customization is mandatory.<\/p>\n\n\n\n<p>Next step: open the OCI docs portal and architecture center, search for <strong>Secure Desktops<\/strong>, and run a small pilot with one pool and one user\u2014then iterate your IAM\/network\/cost model before scaling.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Compute<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,62],"tags":[],"class_list":["post-874","post","type-post","status-publish","format-standard","hentry","category-compute","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/874","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=874"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/874\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=874"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=874"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=874"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}