Secureframe Virtual Desktops lets your organization provision CMMC-compliant virtual desktops so your team can securely view and process Controlled Unclassified Information (CUI). It is part of Secureframe's Defense product line. Instead of bringing every employee laptop into CMMC scope, your team does CUI work inside the virtual desktops, keeping your compliance boundary small and manageable.

Start with Prerequisites to setting up your Virtual Desktops, then Provisioning Virtual Desktops, then Accessing Your Virtual Desktop.

Virtual desktops are always deployed into an Azure Government environment that your organization owns. Secureframe handles the provisioning and configuration; the underlying infrastructure lives in your tenant.

Windows 11 is the operating system for Secureframe Virtual Desktops.

Before you can provision desktops, you need:

See Prerequisites to setting up your Virtual Desktops for the full checklist, including the 15-character tenant name requirement.

Every virtual desktop in your environment is built from a golden image: a Windows template that Secureframe builds, secures, and keeps up to date. It includes Windows 11 and Microsoft 365, with the security settings CMMC requires already in place.

This matters for CMMC in two ways:

Secureframe releases new versions of the golden image with Windows updates and security changes. Before a version is released, Secureframe starts a test desktop from it and checks that it starts up, has the right software, and has its security settings in place. New desktops are built from the newest version. A desktop you already have stays on its version until it's rebuilt.

See Golden Image for Virtual Desktops for what the image includes and how updates work.

When a user signs in, they get a ready-to-use desktop right away. Instead of paying for a dedicated virtual machine for every user (machines that sit idle whenever those users aren't working), your organization runs a smaller set of desktops that the whole team shares. Your team gets the same experience at a lower Azure cost.

Autoscaling starts and stops your desktops around your team's working hours, so you pay for Azure compute when it's needed instead of around the clock. You choose those hours, called core hours, for each day when you create a pool, and you can update them anytime.

Desktops start about 30 minutes before core hours so they're ready when your team signs in, and they shut down after core hours once everyone has left. If someone is still working when core hours end, their desktop stays on until they're done. If someone needs to work outside core hours, signing in starts a desktop automatically.

Because desktops are shared and start and stop on a schedule, a user's settings and preferences belong to their profile, not to any one machine. Whichever desktop they sign in to, those follow them, so every desktop feels like their own.

The machines themselves are disposable. A desktop can be rebuilt, replaced, or upgraded without wiping profile settings. Files stored only on that desktop do not follow the profile. That includes items on the Desktop, in Downloads, and on local disks.

Every virtual desktop includes a shared drive (Z:) for files your team works on together. Save a file once and everyone with access to your Virtual Desktops can open it, with no copying or emailing files between people.

The shared drive uses its own storage account in your Azure Government environment, which appears as a separate line on your Azure bill.

Secureframe keeps track of two things in your Virtual Desktops: what people do in your environment, and any changes made to the setup Secureframe manages for you. Both are set up automatically, so there is nothing to turn on.

Secureframe keeps a record of what happens in your Virtual Desktops, such as who signed in, who connected to a desktop, which files on the shared drive were opened or changed, and what changed in your setup. Records are stored in a log workspace in your own Azure Government environment. Secureframe keeps them for a year, protects them from deletion, and emails you if logging stops. Ready-made searches answer the questions assessors ask most often. The log workspace appears as a separate line on your Azure bill.

See Activity Logging for Virtual Desktops for what is recorded and how to find your records.

Secureframe watches the infrastructure it manages for your Virtual Desktops and flags any change made directly in Azure, like a setting that was changed, a resource that was added, or one that was deleted. For each change, you see what changed, who made it and how much it matters, then choose to keep it or have Secureframe revert it. Every decision is recorded in the Drift log, giving you a reviewed record of changes to your CUI environment.

See Drift Detection for Virtual Desktops for how to review and manage changes.

The Secureframe platform includes automated tests that make sure your virtual desktops stay CMMC compliant. As you deploy and use virtual desktops, the platform automatically checks the relevant controls and surfaces the results in your compliance dashboard.

Does deploying a virtual desktop make me CMMC compliant?

Who pays for the Azure infrastructure?

Why do we need to verify an adsf subdomain during license setup?

If I remove a user from a Virtual Desktop in Secureframe, do they lose access right away?

Does Virtual Desktop / VDI Enclave setup include a CUI-compliant SharePoint?

Will I lose data if my virtual desktop is rebuilt or migrated?

Can I install my own software on a Virtual Desktop?

Questions? Contact [email protected] or reach out to your CSM.