Microsoft does exactly that, they're called Secure Access Workstations, and they're used for all sensitive work. You can find some details here: https://docs.microsoft.com/en-us/windows-server/identity/sec...

They're described as PAWs in the document, but they are called SAWs internally (as one of the notes explains down the page).