{"id":98,"date":"2026-04-12T19:51:54","date_gmt":"2026-04-12T19:51:54","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/alibaba-cloud-workspace-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-end-user-computing\/"},"modified":"2026-04-12T19:51:54","modified_gmt":"2026-04-12T19:51:54","slug":"alibaba-cloud-workspace-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-end-user-computing","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/alibaba-cloud-workspace-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-end-user-computing\/","title":{"rendered":"Alibaba Cloud Workspace Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for End User Computing"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>End User Computing<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Alibaba Cloud Workspace is an End User Computing service designed to deliver managed desktops (and, depending on region\/edition, potentially application access) from Alibaba Cloud to end users through a secure client.<\/p>\n\n\n\n<p>In simple terms: instead of giving every employee a physical PC that stores business data locally, you create cloud desktops in Alibaba Cloud and let users connect to them from almost any device. The desktop runs in the cloud; the user sees a streamed desktop experience.<\/p>\n\n\n\n<p>Technically, Alibaba Cloud Workspace is a control plane for provisioning, assigning, and operating cloud desktop resources integrated with Alibaba Cloud networking and identity. You create a \u201cworkspace\/directory\u201d for identities, place desktops into a VPC, define desktop specifications and images, apply policies, and let users connect using a supported client. Administrative access is controlled via Alibaba Cloud RAM (Resource Access Management), while end-user sign-in is typically managed through the directory mechanism provided by Workspace (and can optionally integrate with enterprise identity such as AD\u2014verify in official docs for your region).<\/p>\n\n\n\n<p><strong>What problem it solves:<\/strong> secure, centrally managed end-user desktops for remote work, contractors, BYOD, regulated environments, and scenarios where you want to keep data in the cloud and simplify endpoint operations.<\/p>\n\n\n\n<blockquote>\n<p>Naming note (verify for your region): Alibaba Cloud has used multiple brands for cloud desktops historically (for example, WUYING in some markets). In the international console and documentation, the service is commonly presented as <strong>Alibaba Cloud Workspace<\/strong>. Always confirm the exact feature set and supported options from the current official documentation for your selected region.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Alibaba Cloud Workspace?<\/h2>\n\n\n\n<p><strong>Official purpose (service intent):<\/strong> Alibaba Cloud Workspace provides a managed platform to create and deliver cloud desktops to end users with centralized administration, policy control, and cloud-based security boundaries.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (what it does)<\/h3>\n\n\n\n<p>At a practical level, Alibaba Cloud Workspace typically enables you to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create and manage cloud desktops (Desktop-as-a-Service)<\/li>\n<li>Organize users through a workspace directory\/identity construct<\/li>\n<li>Assign desktops to users and control user access<\/li>\n<li>Manage desktop \u201cimages\u201d (base OS + patches + apps) and lifecycle (create, start\/stop, rebuild\/replace\u2014exact operations vary)<\/li>\n<li>Integrate with Alibaba Cloud VPC networking to control connectivity<\/li>\n<li>Apply security and operational policies (for example: session controls, peripheral redirection controls, clipboard\/file transfer controls\u2014availability depends on edition\/region; verify in official docs)<\/li>\n<li>Monitor usage and audit administrative actions via Alibaba Cloud governance tools (for example ActionTrail for API auditing; metrics integration may vary\u2014verify in official docs)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (conceptual model)<\/h3>\n\n\n\n<p>While Alibaba Cloud Workspace terminology can vary by region\/edition, most deployments involve:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Workspace \/ Directory<\/strong>: The identity boundary for end users and desktops. Some consoles present multiple directory types (for example, a simple directory vs. AD integration).  <\/li>\n<li><strong>Cloud Desktops<\/strong>: The actual desktop instances users connect to. These desktops have CPU\/memory specs, system disk, data disk, and network placement.<\/li>\n<li><strong>Images<\/strong>: Templates for desktops. Images can be vendor-provided or custom (golden image approach).<\/li>\n<li><strong>Policies<\/strong>: Configuration rules applied to desktops\/users (session, security, device redirection, etc.\u2014verify exact policy catalog).<\/li>\n<li><strong>Clients \/ Access methods<\/strong>: User connection applications and\/or web access options (availability depends on offering; verify in official docs).<\/li>\n<li><strong>Networking (VPC)<\/strong>: Desktops reside in a VPC and subnets\/vSwitches; connectivity is controlled by route tables, security groups, NAT, VPN, or Express Connect.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed End User Computing \/ DaaS<\/strong> control plane with cloud-hosted desktop compute.<\/li>\n<li>Uses Alibaba Cloud infrastructure primitives (VPC, storage, security).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope: regional vs. global<\/h3>\n\n\n\n<p>Alibaba Cloud services are generally <strong>regional<\/strong>, meaning resources (directories, desktops) are created in a specific region and tied to that region\u2019s networking and capacity.<br\/>\n<strong>Verify<\/strong> the exact resource scope (region-bound vs. global directory concepts) in the official docs for Alibaba Cloud Workspace.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Alibaba Cloud ecosystem<\/h3>\n\n\n\n<p>Alibaba Cloud Workspace typically connects to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VPC<\/strong> for desktop network placement and segmentation<\/li>\n<li><strong>RAM<\/strong> for administrator access control<\/li>\n<li><strong>ActionTrail<\/strong> for audit logging of API events<\/li>\n<li><strong>CloudMonitor<\/strong> (and\/or other monitoring integrations) for operational visibility (verify Workspace\u2019s exact metrics support)<\/li>\n<li><strong>NAT Gateway \/ VPN Gateway \/ Express Connect<\/strong> for controlled outbound internet and private access to on-prem systems<\/li>\n<li><strong>Storage and backup services<\/strong> depending on your user profile strategy (for example, separating OS and user data disks; backing up user data using enterprise tooling\u2014verify supported approaches)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Alibaba Cloud Workspace?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster onboarding\/offboarding:<\/strong> Create or revoke desktops and access centrally without shipping devices.<\/li>\n<li><strong>Remote work enablement:<\/strong> Users can access corporate desktops from home or while traveling.<\/li>\n<li><strong>Data locality and governance:<\/strong> Keep sensitive data in Alibaba Cloud instead of endpoints.<\/li>\n<li><strong>Contractor\/third-party access:<\/strong> Provide controlled desktops with least-privilege connectivity to internal systems.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Standardized desktop environments:<\/strong> Use images to keep OS\/app versions consistent.<\/li>\n<li><strong>Elastic capacity model:<\/strong> Add\/remove desktops as headcount changes (commercial terms may be subscription or pay-as-you-go depending on region\/edition; verify pricing model).<\/li>\n<li><strong>Network-controlled access:<\/strong> Put desktops in private subnets; access apps\/databases over private links.<\/li>\n<li><strong>Separation of concerns:<\/strong> Endpoint becomes a \u201cviewer,\u201d while compute and data stay centralized.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Central patching via golden images:<\/strong> Update once, roll out many.<\/li>\n<li><strong>Reduced endpoint troubleshooting:<\/strong> Many issues become \u201crebuild desktop\u201d or \u201creset image,\u201d depending on how you operate.<\/li>\n<li><strong>Easier policy enforcement:<\/strong> Session and device controls can be applied uniformly (verify policy catalog).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Centralized access control:<\/strong> Admin operations governed by RAM; audit with ActionTrail.<\/li>\n<li><strong>Reduced data exfiltration risk:<\/strong> With correct controls and network isolation, users can be prevented from copying data to local devices (capability varies; verify).<\/li>\n<li><strong>Network segmentation:<\/strong> Put desktops in dedicated VPCs\/subnets, route to approved services only.<\/li>\n<li><strong>Logging and auditability:<\/strong> Stronger audit trail than unmanaged endpoints when configured properly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Right-sized desktop specs:<\/strong> Pick CPU\/memory profiles per persona (task worker vs power user).<\/li>\n<li><strong>Regional placement:<\/strong> Put desktops close to end users to reduce latency (subject to region availability).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You need <strong>managed desktops<\/strong> with centralized provisioning and security controls.<\/li>\n<li>You have <strong>distributed teams<\/strong> or <strong>contractors<\/strong> and want cloud-first access patterns.<\/li>\n<li>You operate in <strong>regulated environments<\/strong> where endpoint data storage is risky.<\/li>\n<li>You want to <strong>standardize developer\/test desktops<\/strong> without shipping high-end laptops.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When they should not choose it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your users need <strong>offline-first<\/strong> desktop functionality (cloud desktops require reliable connectivity).<\/li>\n<li>Your workloads rely heavily on <strong>specialized peripherals<\/strong> or low-latency local hardware (some peripherals may not be supported; verify).<\/li>\n<li>You already have mature VDI tooling (Citrix\/VMware) and the migration cost outweighs benefits.<\/li>\n<li>You need <strong>very specific OS\/app licensing<\/strong> that isn\u2019t compatible with cloud-hosted desktop licensing (verify licensing terms carefully).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Alibaba Cloud Workspace used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services and insurance (regulated data, controlled access)<\/li>\n<li>Healthcare (data privacy, controlled workstation access)<\/li>\n<li>Education (lab desktops, seasonal capacity)<\/li>\n<li>Retail and customer support (standard agent desktops)<\/li>\n<li>Media\/design (when GPU profiles are supported\u2014verify GPU availability and performance constraints)<\/li>\n<li>Manufacturing and logistics (contractor access, shift-based work)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IT operations \/ workplace engineering<\/li>\n<li>Security and compliance teams<\/li>\n<li>Call center and customer support teams<\/li>\n<li>Development and QA teams (standardized dev\/test machines)<\/li>\n<li>External vendors\/contractors<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Office productivity desktops<\/li>\n<li>CRM\/ERP access desktops<\/li>\n<li>Secure browser \/ bastion-style desktop access to internal apps<\/li>\n<li>Developer toolchains (IDE, SDKs) where allowed<\/li>\n<li>Training labs and ephemeral classroom environments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures and deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Private VPC desktops<\/strong> accessing internal apps over VPN\/Express Connect<\/li>\n<li><strong>Internet-isolated desktops<\/strong> with only whitelisted outbound access via NAT\/proxy<\/li>\n<li><strong>Multi-OU \/ multi-department<\/strong> separation via different directories or policy groups (exact constructs vary; verify)<\/li>\n<li><strong>Dev\/test<\/strong>: short-lived desktops for QA and training<\/li>\n<li><strong>Production<\/strong>: persistent desktops for employees and customer support<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios you can implement with Alibaba Cloud Workspace. For each, the \u201cwhy it fits\u201d assumes standard DaaS capabilities; validate exact policy\/features in official docs for your edition\/region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Secure remote work desktops for employees<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Employees need full desktop access from home, but corporate data must not be stored on personal devices.<\/li>\n<li><strong>Why this service fits:<\/strong> Data and compute stay in Alibaba Cloud; access is controlled centrally with auditable administration.<\/li>\n<li><strong>Example:<\/strong> A finance team uses Workspace desktops to access internal accounting apps via VPN from any device.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Contractor desktops with time-bound access<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Contractors need access to internal tools temporarily; you must revoke access quickly and prove it in audits.<\/li>\n<li><strong>Why this service fits:<\/strong> Provision desktops quickly, assign to contractor accounts, and revoke by disabling accounts and\/or releasing desktops.<\/li>\n<li><strong>Example:<\/strong> A vendor gets a desktop for 6 weeks, then the desktop is deprovisioned and access removed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Call center \/ customer support standard desktop<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Support agents need a consistent toolset; endpoint drift causes tickets and downtime.<\/li>\n<li><strong>Why this service fits:<\/strong> Golden images and policy-based configuration keep desktops consistent.<\/li>\n<li><strong>Example:<\/strong> A support team uses a standardized desktop image with a CRM client and softphone.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) BYOD enablement without endpoint management sprawl<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Users bring personal devices; installing management agents on every device is hard and risky.<\/li>\n<li><strong>Why this service fits:<\/strong> Workspace can reduce endpoint footprint to just a connection client.<\/li>\n<li><strong>Example:<\/strong> A small business allows personal laptops but requires all work to occur inside Workspace desktops.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Secure access \u201cjump desktop\u201d for admins (bastion pattern)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Admins require privileged access to internal systems; direct access from laptops is too risky.<\/li>\n<li><strong>Why this service fits:<\/strong> Put admin desktops in a locked-down VPC with strict inbound\/outbound rules.<\/li>\n<li><strong>Example:<\/strong> SREs connect to a Workspace desktop and from there to internal ECS instances and databases.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Training lab for classes and workshops<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Training needs identical environments that can be reset after each class.<\/li>\n<li><strong>Why this service fits:<\/strong> Use an image and provision many desktops for a limited time window.<\/li>\n<li><strong>Example:<\/strong> A university provisions 100 desktops for a 2-day cloud course, then removes them.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Developer desktops close to cloud-native resources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Developers face slow performance when building against cloud resources over the internet.<\/li>\n<li><strong>Why this service fits:<\/strong> Developers work inside the same region as their cloud resources, reducing latency.<\/li>\n<li><strong>Example:<\/strong> A team builds microservices on Alibaba Cloud; developers use Workspace desktops in the same region to access internal repositories and test clusters.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) M&amp;A integration: fast, isolated desktop access for new users<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> After acquisition, you need to provide access without merging endpoint management immediately.<\/li>\n<li><strong>Why this service fits:<\/strong> Workspace provides an isolated environment with controlled connectivity into specific apps.<\/li>\n<li><strong>Example:<\/strong> New subsidiary employees receive Workspace desktops that can access only selected internal apps during integration.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Data-protection-first desktops for regulated documents<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams handle sensitive documents that must remain within controlled environments.<\/li>\n<li><strong>Why this service fits:<\/strong> Centralize files in cloud storage\/internal systems; restrict copy\/paste and file transfer if supported.<\/li>\n<li><strong>Example:<\/strong> Legal team works on contracts inside Workspace desktops; outbound access is limited to approved destinations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Seasonal workforce scaling (retail\/logistics peaks)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Headcount spikes seasonally; buying laptops for short-term staff is wasteful.<\/li>\n<li><strong>Why this service fits:<\/strong> Provision additional desktops temporarily and pay only for the period\/plan used (pricing model varies).<\/li>\n<li><strong>Example:<\/strong> A logistics company adds 300 desktops for a peak season and deprovisions after.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Unified desktop platform for multiple branch offices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Branch offices have inconsistent PC hardware and limited IT support.<\/li>\n<li><strong>Why this service fits:<\/strong> Central IT manages one desktop platform; branches just need a stable network connection.<\/li>\n<li><strong>Example:<\/strong> Retail branches use low-cost thin clients to connect to desktops in the nearest Alibaba Cloud region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Application compatibility containment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A legacy Windows app must remain available but is unsafe to run on unmanaged endpoints.<\/li>\n<li><strong>Why this service fits:<\/strong> Run the app inside a controlled desktop environment and limit connectivity.<\/li>\n<li><strong>Example:<\/strong> A manufacturing firm runs a legacy ERP client inside Workspace with restricted network egress.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>The exact feature list can differ by region, edition, and client type. The items below reflect common, practical capabilities expected from Alibaba Cloud Workspace-style DaaS offerings. <strong>Verify availability and limits in the official docs for your region.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Managed cloud desktop provisioning<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Creates desktop instances with defined CPU\/memory\/storage specifications.<\/li>\n<li><strong>Why it matters:<\/strong> Standardizes and accelerates desktop rollout.<\/li>\n<li><strong>Practical benefit:<\/strong> New user desktops can be ready in minutes rather than days.<\/li>\n<li><strong>Caveats:<\/strong> Quotas and regional capacity can limit how many desktops you can create at once.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Workspace directory \/ user identity boundary<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides a place to manage end-user identities for desktop assignment and login, and organizes desktops under a directory\/workspace construct.<\/li>\n<li><strong>Why it matters:<\/strong> Separates end-user identity management from administrator IAM (RAM).<\/li>\n<li><strong>Practical benefit:<\/strong> You can manage users in a way aligned to desktop delivery rather than cloud console access.<\/li>\n<li><strong>Caveats:<\/strong> Integration with enterprise identity systems (e.g., AD) may require additional components and networking; verify supported directory types.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Desktop images (golden image workflow)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you define desktop templates (OS + applications + configuration).<\/li>\n<li><strong>Why it matters:<\/strong> Repeatability, compliance, and faster patch rollouts.<\/li>\n<li><strong>Practical benefit:<\/strong> Update an image and roll it out to a department.<\/li>\n<li><strong>Caveats:<\/strong> Image lifecycle processes (capture, distribute, version, rollback) vary by platform; plan for testing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Policy-based management (session + device controls)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Applies administrative controls to desktops\/users (for example, peripheral redirection, clipboard behavior, file transfer, watermarking, idle timeout\u2014<strong>verify<\/strong> which controls are supported).<\/li>\n<li><strong>Why it matters:<\/strong> Reduces data leakage and enforces consistent behavior.<\/li>\n<li><strong>Practical benefit:<\/strong> Restrict USB redirection for high-risk groups; allow it for engineering.<\/li>\n<li><strong>Caveats:<\/strong> Overly strict policies can break legitimate workflows; use tiered personas.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) VPC networking integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Places desktops into VPC subnets (vSwitches) and controls connectivity using route tables and security groups.<\/li>\n<li><strong>Why it matters:<\/strong> Networking is the foundation for secure enterprise access (private apps, on-prem integration).<\/li>\n<li><strong>Practical benefit:<\/strong> Desktops can reach internal APIs without exposing them to the internet.<\/li>\n<li><strong>Caveats:<\/strong> Misconfigured routes\/DNS are a top cause of \u201ccan\u2019t reach app\u201d tickets.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Internet access control (egress governance)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Controls whether desktops have direct internet access or must go through NAT\/proxy.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents unmanaged outbound access and supports compliance requirements.<\/li>\n<li><strong>Practical benefit:<\/strong> Force all outbound web traffic through a corporate secure web gateway.<\/li>\n<li><strong>Caveats:<\/strong> If you block internet, you must provide access to OS\/app update sources through controlled paths.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Administrative access via RAM (IAM)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses Alibaba Cloud RAM users\/roles\/policies for administrators managing Workspace resources.<\/li>\n<li><strong>Why it matters:<\/strong> Least privilege, separation of duties, and auditable admin control.<\/li>\n<li><strong>Practical benefit:<\/strong> Helpdesk can reset desktops without being able to change network architecture.<\/li>\n<li><strong>Caveats:<\/strong> Poorly scoped policies lead to over-privileged admins; invest time in custom RAM policies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Audit logging (governance)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Captures and records administrative API events (commonly via Alibaba Cloud ActionTrail).<\/li>\n<li><strong>Why it matters:<\/strong> Compliance and incident response depend on knowing \u201cwho changed what.\u201d<\/li>\n<li><strong>Practical benefit:<\/strong> Investigate desktop deletions or policy changes with traceable events.<\/li>\n<li><strong>Caveats:<\/strong> Ensure trails are enabled in all relevant regions and delivered to immutable storage\/log archives.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Monitoring and operational visibility<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides status\/health for desktops and (depending on integration) metrics and alarms.<\/li>\n<li><strong>Why it matters:<\/strong> Workspace is user-facing; outages are immediately visible to the business.<\/li>\n<li><strong>Practical benefit:<\/strong> Alert when many desktops disconnect (could indicate network issues).<\/li>\n<li><strong>Caveats:<\/strong> Metrics granularity and integration points vary; <strong>verify<\/strong> CloudMonitor support and available metrics.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Lifecycle operations (start\/stop\/rebuild\/restore)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Operational actions to manage desktop state and recover from issues.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces MTTR by allowing quick remediation workflows.<\/li>\n<li><strong>Practical benefit:<\/strong> Rebuild a corrupted desktop from a known-good image.<\/li>\n<li><strong>Caveats:<\/strong> Rebuild\/reset operations can cause data loss if user data is stored on the system disk; separate user data where possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Multi-persona desktop sizing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Offers multiple desktop specifications for different user profiles.<\/li>\n<li><strong>Why it matters:<\/strong> Avoid overpaying for all users; avoid underpowered desktops for power users.<\/li>\n<li><strong>Practical benefit:<\/strong> Finance users get standard desktops; developers get larger memory.<\/li>\n<li><strong>Caveats:<\/strong> Some apps require GPU or special drivers; confirm supported specs and licensing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Client connectivity experience<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides end-user client(s) and connection methods to access desktops.<\/li>\n<li><strong>Why it matters:<\/strong> User experience drives adoption; the client must be stable and secure.<\/li>\n<li><strong>Practical benefit:<\/strong> Users can connect from multiple devices where supported.<\/li>\n<li><strong>Caveats:<\/strong> OS support matrix and feature parity (USB, multi-monitor, audio) differs by client; verify client documentation.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>Alibaba Cloud Workspace typically separates concerns into:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong> Web console + APIs used by administrators to create directories, desktops, images, and policies.<\/li>\n<li><strong>Data plane:<\/strong> The streaming\/session path between end-user client and the cloud desktop, plus the desktop\u2019s network access to apps, file shares, and the internet.<\/li>\n<li><strong>Identity plane:<\/strong> Admin identity via RAM; end-user identity via Workspace directory and\/or enterprise identity integration (verify options).<\/li>\n<li><strong>Networking plane:<\/strong> VPC, vSwitches, routes, security groups, NAT\/VPN\/Express Connect.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (typical)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Admin signs in to Alibaba Cloud console and configures Workspace resources (directory, VPC attachment, images, policies).<\/li>\n<li>Workspace provisions desktops into the configured VPC\/subnets.<\/li>\n<li>Admin assigns desktops to directory users.<\/li>\n<li>End user signs in from a Workspace client using directory credentials (or federated credentials if configured).<\/li>\n<li>A session is established to the assigned desktop; pixels\/inputs stream over the network.<\/li>\n<li>Desktop accesses internal services over VPC routes (VPN\/Express Connect) and optional internet access via NAT\/proxy.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related Alibaba Cloud services (common patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VPC<\/strong>: required for private networking<\/li>\n<li><strong>NAT Gateway<\/strong>: for controlled outbound internet from private subnets<\/li>\n<li><strong>VPN Gateway \/ Express Connect<\/strong>: for private connectivity to on-premises<\/li>\n<li><strong>RAM<\/strong>: admin access control<\/li>\n<li><strong>ActionTrail<\/strong>: audit events for governance<\/li>\n<li><strong>Log Service (SLS)<\/strong>: centralized log retention and analysis (commonly used with ActionTrail deliveries)<\/li>\n<li><strong>CloudMonitor<\/strong>: alarms and dashboards (verify Workspace integration specifics)<\/li>\n<li><strong>KMS<\/strong>: encryption key management in broader architecture (usage depends on Workspace\u2019s encryption model\u2014verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services (design-time dependencies)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A VPC with correctly designed IP ranges and subnets<\/li>\n<li>DNS strategy for internal domains (especially for AD integration)<\/li>\n<li>Egress strategy (NAT\/proxy) if desktops need updates\/internet access<\/li>\n<li>Identity design (directory type, password policies, MFA where applicable)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model (conceptual)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Administrators:<\/strong> authenticated via Alibaba Cloud account\/RAM, authorized by RAM policies.<\/li>\n<li><strong>End users:<\/strong> authenticated via Workspace directory or enterprise identity integration.<\/li>\n<li><strong>Network access:<\/strong> controlled by VPC constructs (security groups, routes, ACLs) and any proxy\/NAT.<\/li>\n<li><strong>Auditing:<\/strong> admin operations recorded via ActionTrail; user session logging varies\u2014verify.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model (what to plan)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IP planning:<\/strong> Allocate enough IPs for desktops and growth; avoid overlapping CIDRs with on-prem if using VPN\/Express Connect.<\/li>\n<li><strong>Subnets\/vSwitch:<\/strong> Use separate subnets for different desktop groups (e.g., production vs contractors).<\/li>\n<li><strong>Egress:<\/strong> Prefer private-only desktops with egress via NAT\/proxy and strict allowlists.<\/li>\n<li><strong>Ingress:<\/strong> Ideally no direct inbound from internet to desktops; users connect via the Workspace access mechanism.<\/li>\n<li><strong>Name resolution:<\/strong> If desktops must resolve internal domains, set up DNS forwarding\/resolvers accessible via VPC.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Turn on <strong>ActionTrail<\/strong> in each region where you run Workspace.<\/li>\n<li>Export ActionTrail logs to a centralized log account\/project (where supported) for retention.<\/li>\n<li>Define operational alarms around:<\/li>\n<li>Desktop provisioning failures<\/li>\n<li>Authentication failures (if exposed)<\/li>\n<li>Connectivity issues between desktop subnet and required services<\/li>\n<li>Tag Workspace-related resources for cost tracking (where tagging is supported).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[End User Device\\nWorkspace Client] --&gt;|Login + Session| WS[Alibaba Cloud Workspace]\n  WS --&gt;|Provision\/Assign| D[Cloud Desktop]\n  D --&gt; VPC[VPC \/ vSwitch Subnet]\n  VPC --&gt; APP[Internal Apps\\n(ECS\/RDS\/etc.)]\n  VPC --&gt;|Optional egress| NAT[NAT\/Proxy]\n  WS --&gt; RAM[RAM (Admin IAM)]\n  WS --&gt; AT[ActionTrail (Audit)]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Users\n    U1[Employees]\n    U2[Contractors]\n  end\n\n  subgraph Access\n    C[Workspace Client]\n  end\n\n  subgraph AlibabaCloudRegion[Alibaba Cloud Region]\n    subgraph ControlPlane[Control Plane]\n      WS[Alibaba Cloud Workspace\\nConsole\/API]\n      RAM[RAM\\n(Admin roles\/policies)]\n      AT[ActionTrail]\n      SLS[Log Service (SLS)\\nCentral retention]\n    end\n\n    subgraph Network[VPC]\n      subgraph Subnets\n        S1[Prod Desktop Subnet]\n        S2[Contractor Desktop Subnet]\n      end\n      SG[Security Groups]\n      RT[Route Tables]\n      NAT[NAT Gateway \/ Secure Proxy]\n      VPN[VPN Gateway \/ Express Connect]\n      DNS[DNS \/ Resolver\\n(for internal domains)]\n    end\n\n    subgraph Desktops\n      D1[Prod Cloud Desktops]\n      D2[Contractor Cloud Desktops]\n    end\n\n    subgraph Workloads\n      APP[Internal Web Apps \/ APIs]\n      DB[Databases]\n      FS[File Services]\n    end\n  end\n\n  U1 --&gt; C --&gt; WS\n  U2 --&gt; C --&gt; WS\n\n  WS --&gt; RAM\n  WS --&gt; AT --&gt; SLS\n\n  WS --&gt; D1\n  WS --&gt; D2\n\n  D1 --&gt; S1 --&gt; SG --&gt; RT\n  D2 --&gt; S2 --&gt; SG --&gt; RT\n\n  RT --&gt; VPN --&gt; APP\n  RT --&gt; VPN --&gt; DB\n  RT --&gt; VPN --&gt; FS\n  RT --&gt; NAT\n  S1 --&gt; DNS\n  S2 --&gt; DNS\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Account and billing<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Alibaba Cloud account<\/strong> with billing enabled.<\/li>\n<li>A payment method or credit arrangement that can purchase Workspace resources (subscription and\/or pay-as-you-go depending on region\/edition\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM (RAM)<\/h3>\n\n\n\n<p>You need permissions to:\n&#8211; Create\/manage Workspace resources (directories, desktops, images, policies)\n&#8211; Create\/manage VPC resources (VPC, vSwitch, security groups, NAT\/VPN if used)\n&#8211; View billing and usage<\/p>\n\n\n\n<p>If your organization uses least privilege, prepare:\n&#8211; A RAM admin role for Workspace administration\n&#8211; A separate network admin role for VPC\/NAT\/VPN\n&#8211; A read-only auditor role for monitoring and ActionTrail review<\/p>\n\n\n\n<blockquote>\n<p>Exact RAM actions for Alibaba Cloud Workspace are service-specific; generate policies using the Alibaba Cloud console policy editor or reference the Workspace authorization docs (verify in official docs).<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Web browser for Alibaba Cloud console<\/li>\n<li>Workspace client for your end-user OS (download link and OS support matrix: <strong>verify in official docs<\/strong>)<\/li>\n<li>Optional: Alibaba Cloud CLI (<code>aliyun<\/code>) for general account\/network tasks (Workspace CLI coverage varies; verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Select a region where <strong>Alibaba Cloud Workspace<\/strong> is available.<\/li>\n<li>Ensure your users are reasonably close (latency-sensitive).<\/li>\n<li><strong>Verify<\/strong> supported regions and editions in the official product page\/docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Desktop count quota<\/li>\n<li>Directory\/user quota<\/li>\n<li>VPC limits (vSwitch IP capacity)<\/li>\n<li>Any image\/template limits<\/li>\n<\/ul>\n\n\n\n<p>Check Alibaba Cloud <strong>Quotas<\/strong> and the Workspace console quota pages (if available). If you\u2019re running a pilot, request quota increases early.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>VPC<\/strong> (almost always required)<\/li>\n<li>Optional for enterprise connectivity:<\/li>\n<li>NAT Gateway (controlled egress)<\/li>\n<li>VPN Gateway \/ Express Connect (private on-prem connectivity)<\/li>\n<li>DNS\/resolver strategy for internal domains<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Alibaba Cloud Workspace pricing is <strong>region- and edition-dependent<\/strong> and often varies by:\n&#8211; Desktop specification (CPU, memory)\n&#8211; Storage (system disk, data disk type and size)\n&#8211; Billing model (subscription vs pay-as-you-go, where available)\n&#8211; Optional bundles (network, security, management features)\n&#8211; Optional GPU profiles (if offered)\n&#8211; Bandwidth\/egress and internet access components\n&#8211; Additional supporting services (NAT, VPN, logs, storage, backups)<\/p>\n\n\n\n<p>Because exact SKUs and rates change by region and contract terms, <strong>do not rely on fixed numbers<\/strong>. Use official pricing sources:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Product page: https:\/\/www.alibabacloud.com\/product\/workspace  <\/li>\n<li>Pricing page (verify current URL and SKUs): https:\/\/www.alibabacloud.com\/product\/workspace\/pricing  <\/li>\n<li>Alibaba Cloud pricing calculator (if used in your org): https:\/\/www.alibabacloud.com\/pricing<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (what you typically pay for)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Cost Dimension<\/th>\n<th>What It Means<\/th>\n<th>Practical Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Desktop compute<\/td>\n<td>The desktop\u2019s CPU\/RAM profile<\/td>\n<td>Usually the main cost driver<\/td>\n<\/tr>\n<tr>\n<td>Storage<\/td>\n<td>System disk + optional data disk<\/td>\n<td>Higher performance disks cost more<\/td>\n<\/tr>\n<tr>\n<td>Internet bandwidth\/egress<\/td>\n<td>Public internet usage from desktops<\/td>\n<td>Often overlooked; can spike with downloads\/updates<\/td>\n<\/tr>\n<tr>\n<td>Network services<\/td>\n<td>NAT Gateway, VPN Gateway, Express Connect<\/td>\n<td>These can exceed desktop costs in some architectures<\/td>\n<\/tr>\n<tr>\n<td>Logging<\/td>\n<td>SLS ingestion\/storage if you centralize audit logs<\/td>\n<td>Useful for compliance; plan retention<\/td>\n<\/tr>\n<tr>\n<td>Support<\/td>\n<td>Alibaba Cloud support plan<\/td>\n<td>Some orgs require enterprise support<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<p>A permanent free tier is <strong>not guaranteed<\/strong> for DaaS offerings. Alibaba Cloud sometimes provides trials\/promotions. <strong>Verify<\/strong> current trial availability on the product page or the console.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Major cost drivers (what usually makes bills high)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Over-provisioned desktops<\/strong> (too much CPU\/RAM for standard users)<\/li>\n<li><strong>Always-on desktops<\/strong> (no shutdown schedule; paying for idle capacity depending on billing model)<\/li>\n<li><strong>Large or high-performance disks<\/strong> for every user<\/li>\n<li><strong>Uncontrolled internet egress<\/strong> (updates, downloads, streaming)<\/li>\n<li><strong>Enterprise connectivity<\/strong> (VPN\/Express Connect, NAT)<\/li>\n<li><strong>Image sprawl<\/strong> (multiple images increases operational overhead; may also affect storage cost depending on how images are stored)<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden\/indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identity integration:<\/strong> AD integration may require domain controllers, DNS, or connectors in VPC.<\/li>\n<li><strong>Operations time:<\/strong> Image maintenance and patching is real work\u2014plan staffing.<\/li>\n<li><strong>Security tooling:<\/strong> Web gateways, EDR, vulnerability scanning, compliance logging (may require additional products).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network and data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If desktops are in private subnets:<\/li>\n<li>Outbound internet often requires <strong>NAT Gateway<\/strong> or a proxy.<\/li>\n<li>If users download large files or run frequent updates, egress costs can be material.<\/li>\n<li>If desktops access on-prem apps:<\/li>\n<li>VPN\/Express Connect bandwidth and availability become part of your desktop UX.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost (practical tactics)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Persona-based sizing:<\/strong> Define 3\u20135 desktop profiles and map users.<\/li>\n<li><strong>Right-size storage:<\/strong> Keep system disks lean; put user data on separate disks if supported and needed.<\/li>\n<li><strong>Shutdown schedules:<\/strong> Use policies\/automation to stop desktops after hours (depends on billing and feature availability\u2014verify).<\/li>\n<li><strong>Control egress:<\/strong> Route outbound traffic through a proxy with allowlists.<\/li>\n<li><strong>Use a single golden image per persona:<\/strong> Reduce drift and rebuild time.<\/li>\n<li><strong>Pilot with a small group:<\/strong> Validate user experience before scaling.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A realistic pilot estimate should include:\n&#8211; 2\u20135 standard desktops in one region\n&#8211; Minimal disk sizes required for OS + office tools\n&#8211; No GPU\n&#8211; Limited internet egress\n&#8211; Logging via ActionTrail (basic)<\/p>\n\n\n\n<p>To estimate:\n1. Open the Workspace pricing page for your region.\n2. Select a standard desktop SKU\/spec.\n3. Add storage and expected usage term.\n4. Add NAT\/VPN only if required.\n5. Add expected log retention costs if centralizing logs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>For a production rollout (e.g., 300\u20132000 users), budget not only for desktops, but also:\n&#8211; At least two network paths (VPN\/Express Connect redundancy)\n&#8211; Centralized log retention (ActionTrail \u2192 SLS)\n&#8211; Image build pipeline (test desktops, staging OU\/group)\n&#8211; Helpdesk operations and incident management\n&#8211; Support plan appropriate for a user-facing platform<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab is designed to be <strong>small, realistic, and low-risk<\/strong>. It focuses on the most common first milestone: <strong>provision one cloud desktop and connect to it<\/strong>.<\/p>\n\n\n\n<p>Because Alibaba Cloud Workspace options vary by region\/edition (directory type names, client types, policies), the steps use <strong>console-driven choices<\/strong> and tell you what to select when multiple options exist. Always follow the on-screen instructions and cross-check with the official \u201cGetting Started\u201d guide for your region.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Provision a basic Alibaba Cloud Workspace environment:\n&#8211; Create\/select a VPC and subnet for desktops\n&#8211; Create a Workspace directory (simple directory if available)\n&#8211; Create one cloud desktop from a standard image\/spec\n&#8211; Assign it to a user\n&#8211; Connect using the Workspace client\n&#8211; Validate network access\n&#8211; Clean up resources to avoid ongoing cost<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will create:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>VPC + vSwitch<\/strong> for desktop placement  <\/li>\n<li><strong>Directory\/Workspace<\/strong> to manage users  <\/li>\n<li><strong>Desktop<\/strong> assigned to a test user  <\/li>\n<li>Optional: <strong>NAT Gateway<\/strong> only if your desktop requires outbound internet (keep it off for minimal cost unless you need updates\/downloads)<\/li>\n<\/ol>\n\n\n\n<p>Expected time: 45\u201390 minutes (depending on region availability and provisioning time)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Choose a region and confirm service availability<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the Alibaba Cloud console.<\/li>\n<li>Use the region selector to pick a region close to you.<\/li>\n<li>Navigate to <strong>Alibaba Cloud Workspace<\/strong> in the console.<\/li>\n<li>Confirm you can access the product and create resources in this region.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can open the Workspace console and see options to create a directory\/workspace and desktops.<\/p>\n\n\n\n<p><strong>If you cannot find Workspace:<\/strong><br\/>\n&#8211; Check the official product page and supported regions.<br\/>\n&#8211; Verify you\u2019re using the correct Alibaba Cloud international\/China portal for your account.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a dedicated VPC for the lab<\/h3>\n\n\n\n<p>If you already have a suitable VPC, you can reuse it. For a clean lab, create a new one.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>VPC<\/strong> console.<\/li>\n<li>Create a VPC, for example:\n   &#8211; VPC CIDR: <code>10.10.0.0\/16<\/code> (choose any non-overlapping range)<\/li>\n<li>Create a <strong>vSwitch<\/strong> (subnet) in one zone in the same region, for example:\n   &#8211; vSwitch CIDR: <code>10.10.1.0\/24<\/code><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a VPC and vSwitch ready for desktop placement.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In the VPC console, confirm the vSwitch status is <em>Available<\/em> and is in the intended zone.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create or select a security group strategy<\/h3>\n\n\n\n<p>Alibaba Cloud Workspace may manage security groups automatically or let you choose one, depending on edition.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In <strong>ECS \/ Security Groups<\/strong> (or within Workspace networking settings), create a security group such as <code>sg-workspace-lab<\/code>.<\/li>\n<li>Keep inbound rules minimal. In many DaaS models, user connections do not require you to open inbound ports directly to the desktop.<\/li>\n<li>Allow outbound traffic as required (default outbound allow is common). If your security baseline requires restriction, plan an outbound proxy.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A security group exists for desktop NICs (if the console asks you to select one).<\/p>\n\n\n\n<p><strong>Caution:<\/strong> Do not expose RDP\/SSH to the public internet unless you have a controlled, temporary reason and strong controls. Most Workspace deployments should avoid direct inbound exposure.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Workspace directory (identity container)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the <strong>Alibaba Cloud Workspace<\/strong> console, find <strong>Directories \/ Workspaces<\/strong> (exact label varies).<\/li>\n<li>Click <strong>Create Directory<\/strong> (or equivalent).<\/li>\n<li>Choose a directory type:\n   &#8211; If you see <strong>Simple Directory<\/strong> (or similar), choose it for this lab (lowest operational overhead).\n   &#8211; If you only see AD integration options, stop here and follow the official AD integration guide (requires DNS, connectivity, and potentially domain controllers).<\/li>\n<li>Select the <strong>VPC<\/strong> and <strong>vSwitch<\/strong> created earlier.<\/li>\n<li>Configure directory details:\n   &#8211; Name: <code>workspace-lab-dir<\/code>\n   &#8211; DNS settings: use defaults unless the guide requires otherwise<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A directory\/workspace is created and in a <em>Running\/Available<\/em> state.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Directory status shows healthy\/available.\n&#8211; The directory is associated with your VPC\/vSwitch.<\/p>\n\n\n\n<p><strong>Common error and fix:<\/strong>\n&#8211; <strong>Error:<\/strong> \u201cInsufficient IP addresses in vSwitch.\u201d<br\/>\n<strong>Fix:<\/strong> Use a larger vSwitch CIDR (e.g., \/23) or create a new vSwitch.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create a test end user<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the Workspace console, locate <strong>Users<\/strong> under the directory.<\/li>\n<li>Create a user, for example:\n   &#8211; Username: <code>labuser1<\/code>\n   &#8211; Display name: <code>Lab User 1<\/code>\n   &#8211; Email\/phone: as required by the console\n   &#8211; Password: set a strong initial password<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> <code>labuser1<\/code> exists in the directory.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; User appears in the user list and is enabled.<\/p>\n\n\n\n<p><strong>Tip:<\/strong> If your organization requires MFA or password complexity, follow those policies. MFA availability depends on edition\/region\u2014verify.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Create a cloud desktop<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Workspace console, go to <strong>Desktops<\/strong> \u2192 <strong>Create Desktop<\/strong> (wording varies).<\/li>\n<li>Select:\n   &#8211; Directory: <code>workspace-lab-dir<\/code>\n   &#8211; Network: VPC\/vSwitch from earlier<\/li>\n<li>Choose an image:\n   &#8211; Pick a standard, vendor-provided OS image (Windows or Linux) that is clearly marked as supported.<\/li>\n<li>Choose a desktop specification:\n   &#8211; Start with a small\/standard profile suitable for office tasks.<\/li>\n<li>Choose storage:\n   &#8211; Minimum system disk supported by the image\n   &#8211; Optional data disk only if needed for the lab<\/li>\n<li>Assign the desktop to user:\n   &#8211; <code>labuser1<\/code><\/li>\n<li>Confirm and create.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Desktop provisioning begins; status shows <em>Creating\/Provisioning<\/em> and later <em>Running\/Available<\/em>.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Desktop appears with an ID and assigned user.\n&#8211; Status becomes available\/ready.<\/p>\n\n\n\n<p><strong>Common error and fix:<\/strong>\n&#8211; <strong>Error:<\/strong> \u201cInsufficient quota.\u201d<br\/>\n<strong>Fix:<\/strong> Request quota increase in the Quotas console or reduce requested desktop count\/spec.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Obtain the client and connection information<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Workspace console, find <strong>Client Download<\/strong> or <strong>User Access<\/strong> instructions.<\/li>\n<li>Download the Workspace client for your OS.<\/li>\n<li>Collect required info:\n   &#8211; Login endpoint\/tenant code (if required)\n   &#8211; Username and directory name (if required)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a client installed and know how to log in.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Client launches successfully.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Connect as the end user<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Workspace client.<\/li>\n<li>Enter the directory\/tenant info if prompted.<\/li>\n<li>Sign in as:\n   &#8211; Username: <code>labuser1<\/code>\n   &#8211; Password: the one you set<\/li>\n<li>Select the assigned desktop and connect.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You see the cloud desktop session and can interact with the OS.<\/p>\n\n\n\n<p><strong>Verification inside the desktop:<\/strong>\n&#8211; Check OS version and confirm basic responsiveness.\n&#8211; Open a browser or terminal (depending on OS) to confirm the environment is functional.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Validate network access (basic)<\/h3>\n\n\n\n<p>Inside the desktop session:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Confirm private IP address is from your VPC CIDR (e.g., <code>10.10.1.x<\/code>).<\/li>\n<li>If you need internet for the lab:\n   &#8211; Try visiting a simple site.\n   &#8211; If it fails and you expected it to work, you likely need NAT\/proxy configuration.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong><br\/>\n&#8211; Private IP matches VPC subnet.<br\/>\n&#8211; Internet access works only if you designed egress for it.<\/p>\n\n\n\n<p><strong>Notes on egress design:<\/strong>\n&#8211; In many secure setups, desktops do <strong>not<\/strong> have direct internet access.\n&#8211; If you require controlled internet access, implement NAT Gateway or a corporate proxy and route accordingly.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 10 (Optional): Add controlled internet egress using NAT Gateway<\/h3>\n\n\n\n<p>Only do this if you need outbound internet (updates, downloads, web browsing for the lab). NAT Gateway adds cost.<\/p>\n\n\n\n<p>High-level steps (exact steps vary; verify in NAT Gateway docs):\n1. Create a <strong>NAT Gateway<\/strong> in the same VPC.\n2. Purchase\/attach an <strong>EIP<\/strong> (Elastic IP Address) to the NAT Gateway.\n3. Configure <strong>SNAT<\/strong> for the desktop subnet (<code>10.10.1.0\/24<\/code>).\n4. Ensure route tables for the subnet allow traffic to NAT.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Desktop can reach the internet via NAT.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; From desktop, browse to a website.\n&#8211; If you have a proxy, verify DNS and proxy rules.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist to validate the lab end-to-end:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] Directory is <em>Available<\/em><\/li>\n<li>[ ] <code>labuser1<\/code> exists and is enabled<\/li>\n<li>[ ] Desktop is <em>Available\/Running<\/em> and assigned to <code>labuser1<\/code><\/li>\n<li>[ ] End-user client can log in successfully<\/li>\n<li>[ ] Desktop session opens<\/li>\n<li>[ ] Private IP matches VPC subnet<\/li>\n<li>[ ] Optional: internet access works only via NAT\/proxy design<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Client login fails<\/h4>\n\n\n\n<p><strong>Symptoms:<\/strong> Incorrect credentials, tenant code mismatch, or authentication error.<br\/>\n<strong>Fixes:<\/strong>\n&#8211; Reset <code>labuser1<\/code> password in Workspace console.\n&#8211; Verify you are using the correct directory\/tenant identifier.\n&#8211; Confirm the directory is healthy\/available.\n&#8211; Check whether account lockout policies apply.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Desktop stuck in \u201cCreating\u201d<\/h4>\n\n\n\n<p><strong>Symptoms:<\/strong> Provisioning never completes.<br\/>\n<strong>Fixes:<\/strong>\n&#8211; Check quotas and regional capacity.\n&#8211; Try a different zone\/vSwitch if the product supports multi-zone.\n&#8211; Reduce spec or use a more standard image.\n&#8211; Review event\/error details in the Workspace console.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Desktop connects but cannot reach internal apps<\/h4>\n\n\n\n<p><strong>Symptoms:<\/strong> App timeouts, DNS failures.<br\/>\n<strong>Fixes:<\/strong>\n&#8211; Check VPC routes to on-prem (VPN\/Express Connect).\n&#8211; Verify DNS resolution for internal domains.\n&#8211; Confirm security group egress rules and any NACL rules.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: No internet access<\/h4>\n\n\n\n<p><strong>Symptoms:<\/strong> Web browsing fails.<br\/>\n<strong>Fixes:<\/strong>\n&#8211; Confirm whether desktops are intended to have internet.\n&#8211; If yes, configure NAT Gateway SNAT (or proxy) for the subnet.\n&#8211; Verify route tables and DNS.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Poor performance \/ lag<\/h4>\n\n\n\n<p><strong>Symptoms:<\/strong> High latency in session.<br\/>\n<strong>Fixes:<\/strong>\n&#8211; Choose a closer region.\n&#8211; Validate user\u2019s local network stability.\n&#8211; Increase desktop spec if CPU\/memory is pegged.\n&#8211; Check if multi-monitor\/high-res settings exceed network capacity.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges, delete what you created:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Workspace console:\n   &#8211; Disconnect sessions.\n   &#8211; Delete\/release the desktop (ensure you understand data loss implications).\n   &#8211; Delete the test user and directory (if no longer needed).<\/li>\n<li>In VPC console:\n   &#8211; Delete NAT Gateway and release EIP (if created).\n   &#8211; Delete vSwitch.\n   &#8211; Delete VPC.<\/li>\n<li>In logging\/governance:\n   &#8211; Keep ActionTrail enabled if required by org policy; otherwise, stop any extra log deliveries you enabled for the lab.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> No active desktops, no NAT\/EIP, and no lab VPC resources remain.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Design for personas:<\/strong> Define desktop profiles by job function (task\/knowledge\/power\/GPU\u2014if offered).<\/li>\n<li><strong>Separate concerns by subnet:<\/strong> Production employees, contractors, and admin\/jump desktops should live in separate subnets and often separate directories\/policies.<\/li>\n<li><strong>Keep desktops private:<\/strong> Avoid direct inbound exposure; rely on Workspace connection mechanisms.<\/li>\n<li><strong>Plan IP capacity:<\/strong> Each desktop consumes an IP; plan for peak + growth + maintenance buffers.<\/li>\n<li><strong>Standardize images:<\/strong> Use a small set of golden images; version them and test before rollout.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Least privilege RAM roles:<\/strong> Separate Workspace admin from network admin and billing admin.<\/li>\n<li><strong>Use MFA for administrators:<\/strong> Enforce MFA for Alibaba Cloud console\/RAM users.<\/li>\n<li><strong>Audit everything:<\/strong> Enable ActionTrail and centralize logs to a secure log archive account\/project.<\/li>\n<li><strong>Segregate duties:<\/strong> Helpdesk role can do resets but cannot change networking or policies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Right-size early:<\/strong> Measure CPU\/RAM usage before scaling.<\/li>\n<li><strong>Avoid idle spend:<\/strong> If billing model charges for running time, implement shutdown schedules (where supported).<\/li>\n<li><strong>Control egress:<\/strong> NAT\/proxy + allowlists reduce surprise data transfer costs.<\/li>\n<li><strong>Avoid per-user overbuild:<\/strong> Don\u2019t give every user a large data disk \u201cjust in case.\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Pick the right region:<\/strong> User experience is highly latency-sensitive.<\/li>\n<li><strong>Test with real workflows:<\/strong> Multi-monitor, video calls, and large IDE builds change requirements.<\/li>\n<li><strong>Use appropriate storage performance:<\/strong> If your workload is disk-heavy (compilers, indexing), storage performance matters.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Document restore\/rebuild flows:<\/strong> Know how to recover a broken desktop quickly.<\/li>\n<li><strong>Keep images updated:<\/strong> Patch regularly; avoid long-lived unpatched images.<\/li>\n<li><strong>Plan network redundancy:<\/strong> For on-prem connectivity, design redundant VPN\/Express Connect if Workspace is mission-critical.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Define a desktop lifecycle:<\/strong> request \u2192 approve \u2192 provision \u2192 operate \u2192 offboard.<\/li>\n<li><strong>Automate onboarding:<\/strong> If APIs exist and are stable, integrate with ITSM (verify API support).<\/li>\n<li><strong>Centralize logs:<\/strong> ActionTrail + SLS for audit; keep retention aligned with compliance.<\/li>\n<li><strong>Run periodic access reviews:<\/strong> Ensure only active users have desktops.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Tag resources:<\/strong> Department, cost center, environment, owner.<\/li>\n<li><strong>Naming standards:<\/strong> Include region, environment, and persona in names (e.g., <code>cn-hz-prod-hr-standard-001<\/code>).<\/li>\n<li><strong>Document policy intent:<\/strong> A policy named \u201cNo USB\u201d should have a short description and a change record.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Admin access:<\/strong> Use Alibaba Cloud RAM with least privilege. Create separate roles for:<\/li>\n<li>Workspace provisioning<\/li>\n<li>Helpdesk operations<\/li>\n<li>Security\/audit read-only<\/li>\n<li><strong>End-user access:<\/strong> Use the Workspace directory mechanism. If integrating enterprise identity (e.g., AD), ensure:<\/li>\n<li>Secure network path between desktops and identity infrastructure<\/li>\n<li>Strong password policies and lockout policies<\/li>\n<li>MFA where supported (verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>In transit:<\/strong> Desktop session traffic should be encrypted by the Workspace protocol (verify in official docs).<\/li>\n<li><strong>At rest:<\/strong> Desktop disks are typically encrypted at the storage layer in modern clouds, but encryption controls (default vs optional, customer-managed keys) vary by product and region. <strong>Verify Workspace disk encryption options<\/strong> and whether KMS CMKs are supported.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep desktops in <strong>private subnets<\/strong>.<\/li>\n<li>Avoid assigning public IPs to desktop NICs.<\/li>\n<li>Use NAT\/proxy for outbound internet; restrict with allowlists.<\/li>\n<li>For internal apps, use private connectivity (VPN\/Express Connect) and restrict routes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not hardcode credentials in images.<\/li>\n<li>Use enterprise secrets management for app credentials where possible (outside the desktop image).<\/li>\n<li>Rotate passwords for service accounts used in images.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable <strong>ActionTrail<\/strong> for administrative auditing.<\/li>\n<li>Centralize logs in <strong>Log Service (SLS)<\/strong> with restricted access.<\/li>\n<li>For compliance, ensure log retention meets regulatory requirements.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Validate where data is stored:<\/li>\n<li>Desktop disks in-region<\/li>\n<li>Logs in-region or centralized<\/li>\n<li>Confirm whether the service supports compliance needs (ISO, SOC, etc.) via Alibaba Cloud compliance documentation (verify current compliance status).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Over-permissive RAM policies (\u201cAdministratorAccess\u201d for everyone)<\/li>\n<li>Allowing desktops direct inbound access from the internet<\/li>\n<li>Unrestricted outbound internet without inspection<\/li>\n<li>Using one shared end-user account for multiple people<\/li>\n<li>Storing sensitive data on the system disk and then rebuilding desktops (data loss + uncontrolled copies)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a <strong>zero-trust-ish<\/strong> pattern:<\/li>\n<li>Private desktops<\/li>\n<li>Private app endpoints<\/li>\n<li>Strong identity + MFA<\/li>\n<li>Auditing and centralized logging<\/li>\n<li>Use separate directories\/subnets for contractors.<\/li>\n<li>Implement periodic access review and automated offboarding.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because exact limits depend on region\/edition, treat these as common \u201cgotchas\u201d and confirm specifics in official documentation.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Region availability:<\/strong> Workspace may not be available in every Alibaba Cloud region.<\/li>\n<li><strong>Quota constraints:<\/strong> Desktop count and directory limits can block pilots; request quota increases early.<\/li>\n<li><strong>Latency sensitivity:<\/strong> User experience degrades quickly with higher latency or jitter.<\/li>\n<li><strong>Peripheral compatibility:<\/strong> USB redirection, printers, scanners, smart cards, and audio\/video can have limitations depending on client and policies\u2014verify support matrix.<\/li>\n<li><strong>Image management overhead:<\/strong> Golden images require patching, testing, and controlled rollout.<\/li>\n<li><strong>Egress surprises:<\/strong> If desktops have internet access, bandwidth\/egress can become a cost and security risk.<\/li>\n<li><strong>Identity integration complexity:<\/strong> AD integration requires DNS correctness and reliable connectivity; misconfiguration causes login failures.<\/li>\n<li><strong>Licensing nuance:<\/strong> OS and application licensing in virtual desktop environments can be complex\u2014validate licensing terms.<\/li>\n<li><strong>Data persistence model:<\/strong> If you rebuild\/reset desktops, you may lose data unless it\u2019s stored on persistent disks or external storage\u2014design user profile\/data strategy intentionally.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Alibaba Cloud Workspace is one option in the End User Computing space. The right choice depends on your cloud strategy, identity\/networking requirements, and operational maturity.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatives within Alibaba Cloud (or self-managed on Alibaba Cloud)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Self-managed VDI on ECS:<\/strong> Maximum control, but you manage brokering, images, scaling, and security tooling yourself.<\/li>\n<li><strong>Bastion\/jump servers on ECS:<\/strong> Cheaper for admin access use cases, but not a full desktop delivery platform.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatives in other clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS WorkSpaces \/ WorkSpaces Web:<\/strong> Mature DaaS options integrated with AWS ecosystem.<\/li>\n<li><strong>Azure Virtual Desktop (AVD):<\/strong> Strong Microsoft ecosystem integration, but requires careful management of host pools and licensing.<\/li>\n<li><strong>Google \/ partners:<\/strong> Google\u2019s native offerings differ (often developer-focused workstations); third-party VDI partners fill gaps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open-source \/ self-managed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Apache Guacamole + RDP\/SSH<\/strong> to ECS desktops: low-cost remote access, but you manage everything.<\/li>\n<li><strong>Citrix \/ VMware Horizon<\/strong> on cloud infrastructure: enterprise-grade but complex and often expensive.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Comparison table<\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Alibaba Cloud Workspace<\/strong><\/td>\n<td>Alibaba Cloud-first DaaS for managed desktops<\/td>\n<td>Integrated with Alibaba Cloud VPC\/RAM; centralized desktop management<\/td>\n<td>Feature set varies by region\/edition; latency-sensitive<\/td>\n<td>You want managed desktops in Alibaba Cloud with centralized control<\/td>\n<\/tr>\n<tr>\n<td>Self-managed VDI on ECS (Alibaba Cloud)<\/td>\n<td>Full customization<\/td>\n<td>Maximum control; flexible images and tooling<\/td>\n<td>High ops burden; you build\/operate brokering and scaling<\/td>\n<td>You need custom protocols\/features not offered by Workspace<\/td>\n<\/tr>\n<tr>\n<td>Jump desktop on ECS (no DaaS)<\/td>\n<td>Admin\/bastion access<\/td>\n<td>Simple and cheap<\/td>\n<td>Not scalable as EUC platform; weak user lifecycle tooling<\/td>\n<td>Small admin-only use case, not full workforce<\/td>\n<\/tr>\n<tr>\n<td>AWS WorkSpaces<\/td>\n<td>Multi-region DaaS in AWS<\/td>\n<td>Mature ecosystem; many integrations<\/td>\n<td>Tied to AWS; cost model differs<\/td>\n<td>Your infra is primarily on AWS<\/td>\n<\/tr>\n<tr>\n<td>Azure Virtual Desktop<\/td>\n<td>Microsoft-centric enterprises<\/td>\n<td>Strong Windows integration; M365 alignment<\/td>\n<td>Can be complex; licensing nuance<\/td>\n<td>You are all-in on Microsoft identity and Windows workloads<\/td>\n<\/tr>\n<tr>\n<td>Citrix\/VMware Horizon (partner)<\/td>\n<td>Large enterprises needing advanced EUC<\/td>\n<td>Rich features, mature tooling<\/td>\n<td>Expensive; complex<\/td>\n<td>You need advanced EUC controls and already have licensing\/skills<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Regulated financial services remote work<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A bank needs remote access for 2,000 users with strict audit requirements and minimal data leakage risk.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Alibaba Cloud Workspace desktops in two dedicated subnets (employees vs contractors)<\/li>\n<li>Private connectivity to on-prem core systems via redundant Express Connect\/VPN<\/li>\n<li>Outbound internet blocked by default; exceptions via secure proxy with allowlists<\/li>\n<li>Centralized audit: ActionTrail delivered to SLS with long retention and restricted access<\/li>\n<li>RAM roles: separate provisioning, helpdesk, network admin, auditor<\/li>\n<li><strong>Why this service was chosen:<\/strong> Managed DaaS reduces endpoint data risk and accelerates onboarding while keeping desktops close to cloud-hosted apps.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Faster user provisioning<\/li>\n<li>Improved audit readiness (who changed what, when)<\/li>\n<li>Reduced data leakage from unmanaged endpoints<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: BYOD with secure access to production systems<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A 25-person startup has contractors and BYOD laptops. They need secure access to production dashboards and internal admin tools.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>One Alibaba Cloud Workspace directory<\/li>\n<li>Two desktop personas: standard + power user<\/li>\n<li>Private VPC access to internal tools; no public inbound exposure<\/li>\n<li>NAT Gateway for limited outbound access (package repositories and updates only)<\/li>\n<li><strong>Why this service was chosen:<\/strong> Centralizes security without building a full endpoint management program.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Contractors can work securely without receiving corporate laptops<\/li>\n<li>Lower operational overhead than self-managed VDI<\/li>\n<li>Better security posture for production access<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Alibaba Cloud Workspace the same as a VPN?<\/strong><br\/>\nNo. A VPN provides network connectivity. Alibaba Cloud Workspace provides managed cloud desktops. You may still use VPN\/Express Connect for desktops to reach on-prem apps.<\/p>\n\n\n\n<p>2) <strong>Do users need Alibaba Cloud accounts to use Workspace desktops?<\/strong><br\/>\nTypically no. End users usually authenticate via the Workspace directory mechanism rather than Alibaba Cloud RAM. Verify user identity model in official docs.<\/p>\n\n\n\n<p>3) <strong>Can I integrate Workspace with Active Directory?<\/strong><br\/>\nOften yes in DaaS platforms, but integration method and support vary by region\/edition. Verify the supported directory types and prerequisites (DNS, connectivity, domain controllers).<\/p>\n\n\n\n<p>4) <strong>Can desktops be placed in a private subnet without internet access?<\/strong><br\/>\nCommonly yes, and it\u2019s a recommended security posture. If you need updates, use controlled egress via NAT\/proxy or private update sources.<\/p>\n\n\n\n<p>5) <strong>How do I prevent copy\/paste or USB file transfer?<\/strong><br\/>\nMany EUC platforms provide policy controls for clipboard and peripheral redirection. Confirm Workspace policy catalog and client support in official docs.<\/p>\n\n\n\n<p>6) <strong>What happens if a desktop is corrupted?<\/strong><br\/>\nYou generally use lifecycle operations like rebuild\/restore (names vary) or replace the desktop with a new one from an image. Ensure user data is stored in a persistent way.<\/p>\n\n\n\n<p>7) <strong>Where should user data live\u2014on the system disk or elsewhere?<\/strong><br\/>\nAvoid storing important user data only on the system disk if you plan to rebuild. Prefer a persistent data disk or external storage approach aligned with your org (verify best-supported method for Workspace).<\/p>\n\n\n\n<p>8) <strong>Can I use custom images with preinstalled software?<\/strong><br\/>\nTypically yes via image creation\/capture workflows. Validate image creation steps and supported OS versions.<\/p>\n\n\n\n<p>9) <strong>How do I size desktops correctly?<\/strong><br\/>\nStart with a pilot, monitor CPU\/RAM\/disk usage, and define personas. Overprovisioning is the most common cost mistake.<\/p>\n\n\n\n<p>10) <strong>Is performance good enough for video calls?<\/strong><br\/>\nIt depends on region latency, network quality, desktop spec, and client capabilities. Test with real conditions; consider local media optimizations if supported (verify).<\/p>\n\n\n\n<p>11) <strong>Can I restrict desktops to only access internal apps?<\/strong><br\/>\nYes through VPC routing and security groups, plus proxy allowlists for any required outbound traffic.<\/p>\n\n\n\n<p>12) <strong>How do I audit administrative actions?<\/strong><br\/>\nUse Alibaba Cloud ActionTrail to record Workspace-related API operations and deliver logs to SLS for retention.<\/p>\n\n\n\n<p>13) <strong>Does Workspace support multi-region failover?<\/strong><br\/>\nCloud desktops are typically region-bound. Cross-region DR is usually a design pattern (images + automation + identity strategy) rather than an automatic failover. Verify official guidance.<\/p>\n\n\n\n<p>14) <strong>Can I automate provisioning with APIs?<\/strong><br\/>\nMany Alibaba Cloud services offer APIs. Confirm Workspace API availability, SDK support, and best practices in official docs before building automation.<\/p>\n\n\n\n<p>15) <strong>What are the first three things to do before a production rollout?<\/strong><br\/>\n(1) Validate region latency and user experience, (2) design VPC connectivity + DNS + egress controls, (3) define images\/personas\/policies and an operating model (helpdesk + patch cadence).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Alibaba Cloud Workspace<\/h2>\n\n\n\n<p>Official URLs and exact page names can change. If a link redirects, navigate from the product page to the latest docs.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official product page<\/td>\n<td>Alibaba Cloud Workspace<\/td>\n<td>High-level overview, region availability entry point: https:\/\/www.alibabacloud.com\/product\/workspace<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>Alibaba Cloud Workspace Documentation<\/td>\n<td>Canonical setup\/config guides (verify latest): https:\/\/www.alibabacloud.com\/help\/<\/td>\n<\/tr>\n<tr>\n<td>Official pricing page<\/td>\n<td>Workspace Pricing<\/td>\n<td>Region\/SKU-based pricing details (verify URL): https:\/\/www.alibabacloud.com\/product\/workspace\/pricing<\/td>\n<\/tr>\n<tr>\n<td>Pricing calculator<\/td>\n<td>Alibaba Cloud Pricing Calculator<\/td>\n<td>Estimate total costs across services: https:\/\/www.alibabacloud.com\/pricing<\/td>\n<\/tr>\n<tr>\n<td>Governance\/audit<\/td>\n<td>ActionTrail Documentation<\/td>\n<td>How to audit Workspace admin actions: https:\/\/www.alibabacloud.com\/help\/en\/actiontrail<\/td>\n<\/tr>\n<tr>\n<td>Networking<\/td>\n<td>VPC Documentation<\/td>\n<td>VPC\/subnet\/routing design used by desktops: https:\/\/www.alibabacloud.com\/help\/en\/vpc<\/td>\n<\/tr>\n<tr>\n<td>Logging<\/td>\n<td>Log Service (SLS) Documentation<\/td>\n<td>Central log retention and analysis: https:\/\/www.alibabacloud.com\/help\/en\/sls<\/td>\n<\/tr>\n<tr>\n<td>Architecture center<\/td>\n<td>Alibaba Cloud Architecture Center<\/td>\n<td>Reference architectures and patterns: https:\/\/www.alibabacloud.com\/architecture<\/td>\n<\/tr>\n<tr>\n<td>Video learning<\/td>\n<td>Alibaba Cloud YouTube Channel<\/td>\n<td>Product overviews and webinars (search \u201cWorkspace\u201d): https:\/\/www.youtube.com\/@AlibabaCloud<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The providers below are listed as external training options. Always verify current course outlines, instructor credentials, and schedules on their websites.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; Suitable audience: Cloud engineers, DevOps\/SRE, platform teams, beginners to intermediate<br\/>\n   &#8211; Likely learning focus: Cloud fundamentals, DevOps practices, hands-on labs (verify Workspace coverage)<br\/>\n   &#8211; Mode: Check website<br\/>\n   &#8211; Website: https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong><br\/>\n   &#8211; Suitable audience: Beginners to intermediate in DevOps\/SCM and tooling<br\/>\n   &#8211; Likely learning focus: SCM\/DevOps foundations and operational practices (verify cloud EUC topics)<br\/>\n   &#8211; Mode: Check website<br\/>\n   &#8211; Website: https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong><br\/>\n   &#8211; Suitable audience: Cloud operations teams, cloud administrators<br\/>\n   &#8211; Likely learning focus: Cloud ops, monitoring, cost basics (verify Alibaba Cloud coverage)<br\/>\n   &#8211; Mode: Check website<br\/>\n   &#8211; Website: https:\/\/www.cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong><br\/>\n   &#8211; Suitable audience: SREs, reliability\/operations engineers<br\/>\n   &#8211; Likely learning focus: Reliability engineering, monitoring\/incident response (verify EUC relevance)<br\/>\n   &#8211; Mode: Check website<br\/>\n   &#8211; Website: https:\/\/www.sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong><br\/>\n   &#8211; Suitable audience: Operations teams exploring AIOps<br\/>\n   &#8211; Likely learning focus: AIOps concepts, automation, observability (verify Workspace applicability)<br\/>\n   &#8211; Mode: Check website<br\/>\n   &#8211; Website: https:\/\/www.aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>These are trainer-related sites\/platforms to explore. Verify course relevance to Alibaba Cloud Workspace before enrolling.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong><br\/>\n   &#8211; Likely specialization: DevOps\/cloud training (verify specifics)<br\/>\n   &#8211; Suitable audience: Engineers seeking guided training<br\/>\n   &#8211; Website: https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong><br\/>\n   &#8211; Likely specialization: DevOps tooling and cloud operations (verify specifics)<br\/>\n   &#8211; Suitable audience: Beginners to intermediate DevOps learners<br\/>\n   &#8211; Website: https:\/\/www.devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong><br\/>\n   &#8211; Likely specialization: Freelance DevOps\/cloud consulting and training resources (verify specifics)<br\/>\n   &#8211; Suitable audience: Teams\/individuals needing short-term expertise<br\/>\n   &#8211; Website: https:\/\/www.devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong><br\/>\n   &#8211; Likely specialization: DevOps support and training (verify specifics)<br\/>\n   &#8211; Suitable audience: Teams needing operational guidance<br\/>\n   &#8211; Website: https:\/\/www.devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>These organizations may help with assessment, design, migration, security review, and operational readiness. Confirm service scope and references directly with the vendor.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong><br\/>\n   &#8211; Likely service area: Cloud\/DevOps consulting (verify service catalog)<br\/>\n   &#8211; Where they may help: Architecture reviews, implementation support, operational practices<br\/>\n   &#8211; Consulting use case examples: EUC readiness assessment, VPC connectivity design, governance baseline<br\/>\n   &#8211; Website: https:\/\/www.cotocus.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; Likely service area: DevOps and cloud consulting\/training (verify service catalog)<br\/>\n   &#8211; Where they may help: Platform rollout planning, IaC\/automation, team enablement<br\/>\n   &#8211; Consulting use case examples: Pilot-to-production plan for Workspace, cost optimization workshop, operations runbooks<br\/>\n   &#8211; Website: https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong><br\/>\n   &#8211; Likely service area: DevOps consulting services (verify service catalog)<br\/>\n   &#8211; Where they may help: Cloud operations, automation, security posture improvements<br\/>\n   &#8211; Consulting use case examples: Logging\/audit pipeline design, least-privilege IAM, network segmentation strategy<br\/>\n   &#8211; Website: https:\/\/www.devopsconsulting.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Alibaba Cloud Workspace<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Alibaba Cloud basics:<\/strong> regions, zones, billing, RAM<\/li>\n<li><strong>Networking fundamentals:<\/strong> VPC, subnets (vSwitch), route tables, security groups<\/li>\n<li><strong>Identity fundamentals:<\/strong> least privilege, MFA, audit concepts<\/li>\n<li><strong>Windows\/Linux administration basics:<\/strong> images, patching, domain join concepts (if using AD)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Enterprise connectivity:<\/strong> VPN Gateway, Express Connect, DNS integration patterns<\/li>\n<li><strong>Centralized logging:<\/strong> ActionTrail \u2192 SLS, retention and alerting<\/li>\n<li><strong>Endpoint\/security controls:<\/strong> proxy patterns, egress allowlisting, DLP concepts (if your org requires)<\/li>\n<li><strong>Automation:<\/strong> Infrastructure as Code for VPC and supporting services; Workspace APIs if available and supported<\/li>\n<li><strong>Cost management:<\/strong> tagging strategy, budget alerts, usage reviews<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud solutions architect<\/li>\n<li>Cloud platform engineer<\/li>\n<li>DevOps\/SRE (for secure admin environments and operational tooling)<\/li>\n<li>Workplace\/End-user computing engineer<\/li>\n<li>Security engineer (access control, audit, network segmentation)<\/li>\n<li>IT operations\/helpdesk (desktop lifecycle operations)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Alibaba Cloud certifications evolve and may not be product-specific to Workspace. Use Alibaba Cloud certification learning paths for:\n&#8211; Cloud computing fundamentals\n&#8211; Security specialty\n&#8211; Networking specialty<\/p>\n\n\n\n<p><strong>Verify<\/strong> current certification offerings on Alibaba Cloud\u2019s official certification portal.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a persona-based desktop catalog (3 sizes) and document assignment rules.<\/li>\n<li>Implement a private-only desktop environment with NAT\/proxy allowlists.<\/li>\n<li>Create an image update pipeline (monthly patch cadence) with test\/stage\/prod rollout.<\/li>\n<li>Build an audit dashboard from ActionTrail logs in SLS (who created\/deleted desktops).<\/li>\n<li>Run a cost review: right-size 20 pilot users based on observed resource usage.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>End User Computing (EUC):<\/strong> Technologies that deliver desktops\/apps to end users with centralized management.<\/li>\n<li><strong>DaaS (Desktop-as-a-Service):<\/strong> Cloud-hosted, managed virtual desktops delivered over the network.<\/li>\n<li><strong>VPC (Virtual Private Cloud):<\/strong> A logically isolated network in Alibaba Cloud for private IP addressing and routing.<\/li>\n<li><strong>vSwitch:<\/strong> A subnet within a VPC in Alibaba Cloud.<\/li>\n<li><strong>Security Group:<\/strong> Virtual firewall controlling inbound\/outbound traffic for attached resources.<\/li>\n<li><strong>RAM (Resource Access Management):<\/strong> Alibaba Cloud IAM service for users, roles, and policies.<\/li>\n<li><strong>ActionTrail:<\/strong> Alibaba Cloud service for auditing API calls and console actions.<\/li>\n<li><strong>SLS (Log Service):<\/strong> Alibaba Cloud logging platform for log ingestion, storage, search, and analysis.<\/li>\n<li><strong>NAT Gateway:<\/strong> Provides outbound internet access for private subnets and can implement SNAT.<\/li>\n<li><strong>SNAT:<\/strong> Source Network Address Translation\u2014private IPs share a public IP for outbound connections.<\/li>\n<li><strong>Express Connect:<\/strong> Dedicated private connectivity between on-premises and Alibaba Cloud (verify product naming and options).<\/li>\n<li><strong>Golden Image:<\/strong> A standardized OS image with patches and applications used to provision multiple desktops.<\/li>\n<li><strong>Persona:<\/strong> A user category (task worker, knowledge worker, developer) used to standardize desktop sizing and policies.<\/li>\n<li><strong>Least Privilege:<\/strong> Granting only the minimum permissions necessary to perform tasks.<\/li>\n<li><strong>Egress:<\/strong> Outbound network traffic leaving your VPC to the internet or other networks.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Alibaba Cloud Workspace is Alibaba Cloud\u2019s End User Computing service for delivering managed cloud desktops with centralized provisioning, policy control, and VPC-based network isolation. It matters because it helps organizations reduce endpoint risk, accelerate onboarding, and standardize desktop environments while keeping data closer to cloud workloads.<\/p>\n\n\n\n<p>Cost and security success depends on fundamentals: right-size desktop personas, control egress (NAT\/proxy), enforce least-privilege RAM roles, and enable auditing with ActionTrail (and optionally centralize logs in SLS). Choose Alibaba Cloud Workspace when you want a managed DaaS platform in Alibaba Cloud; avoid it for offline-first needs or highly specialized peripheral workflows without verifying compatibility.<\/p>\n\n\n\n<p>Next step: follow the official Alibaba Cloud Workspace getting started documentation for your region, then expand your pilot with identity integration, image lifecycle management, and production-grade networking (VPN\/Express Connect) once the user experience is validated.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>End User Computing<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,15],"tags":[],"class_list":["post-98","post","type-post","status-publish","format-standard","hentry","category-alibaba-cloud","category-end-user-computing"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/98","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=98"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/98\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=98"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=98"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=98"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}