Financial Services · Managed platform (Citrix / Azure Virtual Desktop)

Virtual Desktop Infrastructure

Hosted desktops for lending and branch staff, so customer files stay in the data center, not on laptops

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs virtual desktops on Citrix or Azure Virtual Desktop for banks, credit unions and lenders. Loan officers and other staff reach their applications through a hosted session, and policies you approve control whether files, clipboard content and print jobs can leave it. Moraph builds and patches the desktop images, monitors the service and handles changes, while you keep the decisions about who gets access and what is allowed.

The problem it solves

Lending and branch staff increasingly work from home offices, customer sites and shared branch desks, on laptops that hold copies of loan files, credit reports and tax documents. Every laptop then becomes a place where customer information can be lost, stolen or kept longer than policy allows. Many institutions already own Citrix or Microsoft licences but lack the staff to build images, keep them patched, tune performance and show examiners how access and data movement are controlled.

  • Customer files are downloaded to laptops and stay there after the loan closes
  • Desktop images drift, and patching hosted desktops competes with other IT work
  • Policies on clipboard, drive mapping and printing are set once and never reviewed
  • Evidence of who had access to which desktops is hard to produce at exam time

Who uses it

  • Banks, credit unions and mortgage lenders with remote or hybrid lending staff
  • IT managers who own end-user computing and want it run for them
  • Information security officers who set data-handling rules for customer information
  • Lending and branch operations leaders whose staff work from several locations
  • Internal audit and examiners reviewing access and data protection controls

Requirements it supports

Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)FFIEC IT Examination Handbook, Information Security and Architecture, Infrastructure, and Operations bookletsNYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

The platform belongs to Citrix or Microsoft; Moraph supplies, configures and runs it for you, and your institution makes the policy decisions.

AreaMoraphCitrix or MicrosoftYour organization
LicensingSupplies licences as a reseller and tracks counts and renewalsSets licence terms, entitlements and pricingAgrees to the vendor's terms and decides how many users to license
Platform availabilityMonitors the service and escalates vendor-side issuesRuns the cloud control plane and underlying infrastructure under its own service commitmentsProvides network connectivity for staff and offices
ConfigurationDesigns and maintains pools, images and policies to the approved baselineProvides the configuration capabilities of the platformApproves the baseline and any changes
Identity and accessIntegrates with your identity provider and maintains access groupsProvides the platform's authentication integrationOwns the identity provider and decides who gets access
MonitoringWatches health, capacity and user experience around the clockPublishes service status for its cloud componentsReports user problems through your help desk
Incident responseTriages, resolves or escalates incidents and keeps you informedResolves issues in its own service and productDecides on user communications and business impact
ChangesAssesses, tests and applies approved changesReleases platform updates and new features on its own scheduleApproves changes through the service owner and security officer
Patches and updatesPatches images and agents, and applies platform updates after testingSupplies product updates and security fixesApproves maintenance windows
Data-transfer policyImplements and checks the policyProvides the policy controlsDecides the policy and approves exceptions
User supportSecond-line support and vendor escalationVendor support for Moraph's escalationsFirst-line support through your help desk

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Citrix / Azure AVD itself, which belongs to its vendor.

  1. Step 1

    The onboarding tracker

    During onboarding, each user group moves through design, image testing and migration, with sign-off recorded.

    User groupUsersDesktop poolImage testedMigration waveStatus
    Mortgage loan officers48Lending desktopYesWave 1Signed off
    Loan processing22Lending desktopYesWave 1Signed off
    Underwriting15Lending desktopYesWave 2Migrating
    Branch staff130Branch appsIn pilotWave 3Testing
    Collections12Published appsFailed: imaging viewerWave 3Blocked
    During onboarding, each user group moves through design, image testing and migration, with sign-off recorded.

  2. Step 2

    The configuration baseline review

    Each month the live configuration is compared with the baseline your security officer approved.

    Baseline review · Lending desktop pool

    Baseline version
    v7, approved by security officer
    Clipboard to local device
    Blocked
    Local drive mapping
    Blocked
    Printing
    Approved branch printers only
    File download
    1 deviation found
    Image patch level
    Current

    Deviations

    • File download enabled on one session host after a vendor update
    • Change request opened to restore the baseline setting
    • Security officer notified
    Each month the live configuration is compared with the baseline your security officer approved.

  3. Step 3

    A change request

    Adding an application to the desktop is requested, approved, tested on a pilot pool and recorded.

    CR-1182 · Add document imaging viewer to lending desktop

    1. Change requested for underwriting teamBusiness manager
    2. Impact and test plan preparedMoraph service engineer
    3. Change approvedService owner
    4. Installed in pilot image and tested by two usersMoraph service engineer
    5. Released to production pool in agreed windowMoraph service engineer
    6. Request closed with test evidenceMoraph service engineer
    Adding an application to the desktop is requested, approved, tested on a pilot pool and recorded.

  4. Step 4

    Alert triage

    Platform alerts land in Moraph's operations queue, where they are resolved or escalated to the vendor.

    AlertDesktop poolSignalPriorityOwnerStatus
    AL-5521Lending desktopSession host unavailableHighMoraphResolved
    AL-5517Branch appsSign-in time above thresholdMediumMoraphInvestigating
    AL-5512All poolsVendor service degradation noticeHighVendorEscalated
    AL-5508Published appsCapacity near limitMediumMoraphScaled within limit
    AL-5501Lending desktopRepeated failed sign-ins, one userLowYour help deskPassed on
    Platform alerts land in Moraph's operations queue, where they are resolved or escalated to the vendor.

  5. Step 5

    The monthly service review

    Each month the service owner sees availability, incidents, changes and open actions in one pack.

    Monthly service review · Example Community Bank (fictional)

    Desktop pools
    3
    Active users
    227
    User-affecting incidents
    2
    Changes completed
    9
    Images patched
    All pools
    Licences unused
    14

    Actions agreed

    • Reduce licence count at next renewal
    • Investigate slow sign-ins at one branch
    • Schedule access review for underwriting
    Each month the service owner sees availability, incidents, changes and open actions in one pack.

  6. Step 6

    The access review

    Managers confirm who still needs each desktop, and removals are tracked until done.

    UserTeamDesktop poolLast sign-inManager decisionStatus
    User 4410Mortgage lendingLending desktopYesterdayKeepConfirmed
    User 4387Mortgage lendingLending desktop95 days agoRemoveRemoval in progress
    User 4312UnderwritingLending desktopTodayKeepConfirmed
    User 4298CollectionsPublished apps120 days agoPendingReminder sent
    User 4251Branch operationsBranch appsLast weekKeepConfirmed
    Managers confirm who still needs each desktop, and removals are tracked until done.

Workflows

The principal workflows

  1. Onboard

    Moraph assesses your applications and users, designs the desktop pools and images, and builds the environment on Citrix or Azure Virtual Desktop in the hosting arrangement you choose.

    • Applications, user groups and locations are inventoried with your IT team
    • Desktop pools and published applications are designed per user group
    • Data-transfer policies are drafted for your security officer to approve
    • Golden images are built and tested with pilot users
    • User groups move over in waves agreed with you

  2. Operate

    Moraph monitors session hosts, capacity, sign-in failures and connection quality, and patches images on the schedule you approve.

    • Platform health and user experience alerts arrive in Moraph's operations queue
    • Alerts are triaged and either resolved or escalated to the vendor
    • Images are patched and tested before rollout to production pools
    • Capacity is adjusted within the limits you set
    • Incidents affecting users are reported to your service owner

  3. Change

    New applications, image changes and policy changes go through a change request that your service owner approves, with policy exceptions approved by your security officer.

    • Change requested by your IT team, a manager or Moraph
    • Moraph assesses impact and prepares a test plan
    • Service owner approves; security officer approves anything affecting data-transfer policy
    • Change tested on a pilot pool, then released
    • Request closed with the evidence attached

  4. Review

    Each month Moraph reports on service health, changes and incidents, and runs access reviews so managers confirm who still needs each desktop.

    • Monthly service review pack prepared from monitoring and ticket data
    • Configuration compared against the approved baseline
    • Access review lists sent to managers for confirmation
    • Removals and exceptions actioned through change requests
    • Review outcomes kept as evidence for audit

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Desktop user

Loan officer, loan processor, underwriter, branch staff, operations staff

Uses the hosted desktop or published applications to work with customer information without storing it on their own device.

Sees

  • The desktops and applications assigned to their user group
  • Their own files and settings inside the hosted session
  • Service notices about planned maintenance

Does

  • Signs in through your identity provider with multi-factor authentication
  • Works in the hosted applications and stores files in approved locations
  • Logs off or resets their own stuck session
  • Raises support requests through your help desk

Cannot

  • Copy, download or print outside what the data-transfer policy allows
  • Install software in the hosted desktop
  • See other users' sessions or files
Approvals
Their access is approved by their manager and the service owner; nothing they do needs further approval.
Notified about
Planned maintenance affecting their desktop, and changes to the applications they use.

Business manager

Lending manager, branch manager, operations manager

Decides which of their staff need which desktops and applications, and confirms it periodically.

Sees

  • Their team's access to desktop pools and applications
  • Access requests they raised and their status
  • Access review lists for their team

Does

  • Requests access for new staff and removal for leavers
  • Approves access requests for their team
  • Confirms or removes access during access reviews
  • Requests new applications for their team through the service owner

Cannot

  • Approve access outside their own team
  • Approve changes to images or data-transfer policies
  • Grant exceptions to the data-transfer policy
Approvals
Access they approve also needs the service owner's approval where your procedures require it.
Notified about
Access requests waiting for them, access reviews due, and accounts on their team not used for a period your policy sets.

Service owner

IT manager, end-user computing manager, IT director

Owns the virtual desktop service at your institution and is Moraph's main point of contact.

Sees

  • All desktop pools, images, users and open requests
  • Monitoring summaries, incidents and capacity
  • Change history and the monthly service review
  • Licence counts and renewals

Does

  • Approves change requests to images, pools and applications
  • Approves access to desktop pools
  • Sets maintenance windows and capacity limits
  • Attends the monthly service review and agrees actions
  • Approves Moraph administrative access to your environment

Cannot

  • Approve exceptions to the data-transfer policy without the security officer
  • Change audit logs
  • Approve a change they requested themselves where your procedures require a second approver
Approvals
Approves changes and access; changes that affect data-transfer policy also need the security officer.
Notified about
Change requests waiting for approval, incidents affecting users, vendor service notices, and licence renewals coming due.

Information security officer

Information security officer, CISO, IT risk manager

Decides how customer information may move in and out of hosted sessions, and checks that the environment matches the approved baseline.

Sees

  • Data-transfer policies and exceptions by user group
  • Baseline reviews and deviations
  • Session and administrative logs
  • Security incidents involving the service

Does

  • Approves data-transfer policies and each exception
  • Reviews baseline deviations and decides how they are resolved
  • Reviews administrative activity by Moraph and your own staff
  • Requests logs and evidence for audit or investigations

Cannot

  • Apply changes to the environment directly
  • Edit or delete log entries
  • Approve an exception they requested themselves
Approvals
Approves data-transfer policies, exceptions and security-relevant changes.
Notified about
Exception requests, baseline deviations, security incidents and changes to administrative access.

Moraph service engineer

Moraph end-user computing engineer, operations engineer

Runs the platform for you: builds and patches images, monitors the service, responds to incidents and carries out approved changes.

Sees

  • Platform configuration, monitoring and alerts
  • Change requests and incidents for your environment
  • Vendor service notices

Does

  • Builds, tests and patches golden images
  • Triages alerts and resolves or escalates incidents
  • Carries out approved changes and records the evidence
  • Raises cases with Citrix or Microsoft when the vendor's service is involved
  • Prepares the monthly service review

Cannot

  • Make a change that has not been approved, except emergency actions your contract allows, which are reported straight away
  • Grant themselves access to your environment; access is approved by your service owner
  • Open users' files or sessions without a recorded support reason and your agreement
Approvals
All changes are approved by your service owner, and policy changes by your security officer.
Notified about
Platform alerts, user-affecting incidents, approved changes ready to schedule and vendor notices.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews access, change and service records without being able to change anything.

Sees

  • Access review results and access history
  • Change requests and their approvals
  • Baseline reviews and monthly service reports
  • Session and administrative logs within the granted scope

Does

  • Reads and exports records within their scope, with each export logged
  • Requests further evidence through the service owner
  • Leaves review notes where your institution enables them

Cannot

  • Change, approve or delete anything
  • See records outside the scope and dates granted
  • Keep access after it expires
Approvals
Their access is approved by the service owner or security officer, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Help desk

IT help desk analyst, desktop support technician

Gives first-line support to your staff and passes platform issues to Moraph.

Sees

  • Users, their assigned desktops and current session status
  • Open tickets and their status with Moraph
  • Known issues and planned maintenance

Does

  • Resets or logs off stuck sessions
  • Raises access requests on behalf of managers
  • Logs and escalates platform issues to Moraph
  • Tells users about planned maintenance and known issues

Cannot

  • Approve access or changes
  • Change images, pools or data-transfer policies
  • View the contents of a user's session
Approvals
Requests they raise are approved by the manager, service owner or security officer as appropriate.
Notified about
Incidents affecting users and updates on tickets they escalated.

Permissions at a glance

ActionUserManagerService ownerSecurityMoraph eng.AuditorHelp desk
Use an assigned desktop or appFullFullFullFullNo accessNo accessFull
Request access for a personNo accessOwn work onlyFullNo accessNo accessNo accessFull
Approve access to a desktop poolNo accessApprovesApprovesNo accessNo accessNo accessNo access
Reset or log off a sessionOwn work onlyNo accessFullNo accessFullNo accessFull
Raise a change requestNo accessFullFullFullFullNo accessFull
Approve image and pool changesNo accessNo accessApprovesView onlyNo accessView onlyNo access
Approve data-transfer policy exceptionsNo accessNo accessView onlyApprovesNo accessView onlyNo access
Apply approved changesNo accessNo accessNo accessNo accessFullNo accessNo access
View monitoring and incidentsNo accessNo accessView onlyView onlyFullNo accessView only
View session and admin logsNo accessNo accessView onlyView onlyView onlyView onlyNo access
Confirm access in reviewsNo accessOwn work onlyFullView onlyNo accessView onlyNo access
Approve Moraph admin accessNo accessNo accessApprovesView onlyNo accessView onlyNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph engineers act only on approved change requests. Emergency actions allowed by your contract are reported to the service owner straight away and recorded like any other change.
  • Roles follow groups in your identity provider, so joiners, movers and leavers are handled where you already manage them. Desktop pools and published applications can be limited by team, branch or business line.
  • Data-transfer exceptions are approved by your security officer, never by the person asking for them, and each exception has a reason and a review date.
  • Moraph's administrative access to your environment uses named accounts approved by your service owner, and every administrative action is logged. Auditors and examiners get temporary read-only access with a scope and an end date.

Features

What it does

Hosted desktops and apps

Citrix or Azure Virtual Desktop delivers full desktops or individual published applications to staff from the hosted environment.

Data-transfer policies

The platform controls clipboard, local drive mapping, USB redirection, printing and file download per user group, set to the policy your security officer approves.

Managed golden images

Moraph builds and maintains the desktop images, with your applications, security agents and settings, under version control.

Image patching

Operating system and application updates are applied to images, tested on a pilot pool and rolled out on the schedule you approve.

Conditional access

Sign-in goes through your identity provider with multi-factor authentication, and access can be limited by device, location or group.

Profile management

User profiles and settings follow staff between sessions without keeping copies on the device they connect from.

Monitoring and alerting

Session host health, capacity, sign-in failures and connection quality are monitored by Moraph's operations team around the clock.

Capacity management

Session host capacity is scaled within limits you set, balancing user experience against infrastructure cost.

Change control

Every change to images, pools or policies is requested, approved, tested and recorded.

Session and admin logging

Platform logs of sign-ins, sessions and administrative actions are retained and can be forwarded to your security monitoring.

Access reviews

Periodic lists of who can use each desktop pool, sent to managers for confirmation, with removals tracked to completion.

Monthly service review

A monthly report and meeting covering availability, incidents, changes, capacity and open actions.

Integrations

How it connects to your systems

Connects toHowWhat flows
Identity providerStaff and Moraph engineers sign in through your identity provider, such as Microsoft Entra ID or Active Directory, with multi-factor authentication.In: user identity, group membership and sign-in policy.
Line-of-business applicationsYour loan origination, core banking and document imaging applications are installed in images or published as applications.None stored by Moraph; applications run inside the hosted session.
File and profile storageUser profiles and approved file locations are held in storage in the hosting environment, not on the connecting device.In and out: user profiles and files within the hosted environment.
Endpoint protectionYour endpoint detection agent, or Moraph's managed Endpoint Detection & Response service, is included in images.Out: endpoint telemetry to your security tools.
Security monitoringPlatform sign-in, session and administrative logs forwarded to your SIEM or security operations provider.Out: sign-in, session and admin logs.
IT service managementTickets and change requests exchanged with your service desk tool so your staff work in one place.In and out: tickets, change requests and status updates.
PrintingPrinting from hosted sessions routed to approved printers, or disabled for user groups where your policy requires it.Out: print jobs to approved printers only.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on and MFA

Staff and Moraph engineers sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Desktops, applications and administrative rights follow each person's role; approving a change is separate from carrying it out.

Data stays in the hosted session

Data-transfer policies restrict copying, downloading and printing outside the session to what your security officer approves.

Encryption and keys

Data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Sign-ins, sessions, administrative actions and changes are logged with the person and time, and cannot be edited.

Data residency

Desktops are hosted in the region you choose: the United States, the United Kingdom or Australia.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Service

Monthly service review

For service owner and IT leadership

Availability, incidents, changes, capacity, licence use and open actions for the month.

Break down by
Desktop pool, Incident priority, Change type, Month
Delivered as
PDF; reviewed in a monthly meeting
Used for
Overseeing the service and agreeing actions with Moraph.

Incident log

For service owner and help desk

Each incident affecting users, its cause, who handled it, whether the vendor was involved, and how it was resolved.

Break down by
Priority, Desktop pool, Cause, Vendor involvement
Delivered as
Live view; CSV export
Used for
Tracking service problems and spotting recurring causes.

Capacity and user experience

For service owner

Concurrent sessions, session host load, sign-in times and connection quality over time.

Break down by
Desktop pool, Location, Time of day, Period
Delivered as
Live dashboard; monthly PDF
Used for
Deciding when to change capacity or investigate slow sessions.

Licence usage

For service owner and procurement

Licences held against active users, and renewals coming due.

Break down by
Licence type, User group, Renewal date
Delivered as
Monthly PDF; CSV export
Used for
Right-sizing licence counts before renewal.

Change and configuration

Change history

For service owner, security officer, auditors

Every change to images, pools, applications and policies, with who requested, approved and applied it and the test evidence.

Break down by
Change type, Approver, Desktop pool, Date range
Delivered as
Live view; CSV and PDF export
Used for
Evidencing that changes were approved and tested.

Baseline review

For security officer and service owner

The current configuration of images, pools and policies compared with the approved baseline, with deviations and their resolution.

Break down by
Control area, Desktop pool, Deviation status
Delivered as
Monthly PDF
Used for
Confirming the environment still matches what was approved.

Image patch status

For service owner and security officer

The patch level of each image and pool, updates pending and the date of the last rollout.

Break down by
Image, Desktop pool, Update type, Status
Delivered as
Live dashboard; monthly PDF
Used for
Showing that hosted desktops are kept up to date.

Access and security

Access review

For business managers, service owner, auditors

Who can use each desktop pool and application, the manager's confirmation or removal, and removals completed.

Break down by
Desktop pool, Manager, Team, Outcome
Delivered as
Scheduled email to managers; PDF and CSV export
Used for
Periodic certification of access to systems holding customer information.

Data-transfer exceptions

For security officer and auditors

Each exception to the data-transfer policy, the user group, the reason, the approver and the review date.

Break down by
User group, Policy area, Approver, Review date
Delivered as
Live view; PDF export
Used for
Keeping exceptions few, justified and reviewed.

Administrative activity

For security officer and auditors

Administrative sign-ins and actions by Moraph engineers and your own administrators.

Break down by
Administrator, Action, Date range
Delivered as
On request; CSV export
Used for
Reviewing privileged activity in the environment.

Dormant accounts

For service owner and business managers

Users with desktop access who have not signed in for a period your policy sets.

Break down by
Team, Desktop pool, Last sign-in
Delivered as
Scheduled email; CSV export
Used for
Removing access that is no longer needed.

Exports, access and evidence

  • The monthly service review pack is prepared by Moraph from platform monitoring and ticket data, and every report can be exported to CSV or PDF.
  • Platform reporting from Citrix or Microsoft remains available to your administrators; Moraph's reports add change, access and service records around it.
  • Sign-in, session and administrative logs can be forwarded to your SIEM so your security team reports on them alongside other systems.
  • Reports respect each viewer's role: managers see their own team's access, the service owner and security officer see the whole service, and auditors get read-only access.
  • Access review and change reports can be run as of a past date for audit, and running or exporting them is itself logged.

Deployment

Where and how it runs

Azure Virtual Desktop in your Azure tenant

Session hosts run in your Azure subscription in the region you choose, with Moraph operating them under delegated, logged administrative access.

Citrix with hosted workloads

Citrix's cloud service brokers sessions to session hosts in Azure or another hosting environment you choose, operated by Moraph.

Existing Citrix environment

Where you already run Citrix in your own data center, Moraph can take over operation and plan any move to hosted workloads.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery

We inventory your applications, user groups, locations and current desktops, and agree the hosting arrangement and platform. We need an application owner contact and access to your current configuration.

Design and policy

Desktop pools, published applications, identity integration and data-transfer policies are designed and documented for your security officer to approve.

Licensing

Moraph supplies the Citrix or Microsoft licences you choose as a reseller, or works with licences you already own, under the vendor's terms.

Build and image testing

Golden images are built with your applications and agents, and tested by pilot users from each user group.

Migration waves

Users move over in waves agreed with you, with the help desk briefed before each wave and the old arrangement kept until each group signs off.

Handover to operations

Monitoring, change control, the approved baseline and the monthly service review start, and your help desk is trained on first-line support.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Citrix or Microsoft. The platform belongs to its vendor, and the vendor's own service commitments, roadmap and outages apply to it.
  • Licences are subject to the vendor's terms, including any minimum counts, term lengths and changes the vendor makes to its licensing.
  • Data-transfer policies reduce the ways customer information can leave a session, but they cannot stop someone photographing a screen or retyping data. They work alongside your acceptable-use policy and training.
  • Applications that are not supported in a hosted desktop, or that need special hardware, may need to stay on local devices; this is identified during discovery.
  • User experience depends on the network connection staff use to reach the service.
  • The service manages the hosted desktops, not the laptops or thin clients staff connect from. Device management is a separate service, such as Moraph's managed Mobile Device Management.
  • Hosting costs in your own Azure subscription are billed to you by Microsoft and are separate from Moraph's service.
  • Decisions about who gets access and what data may leave a session remain your institution's; Moraph implements and evidences them.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. List the applications your lending staff use and confirm each one works in a hosted desktop
  2. Have a pilot group of loan officers work a full day from home on the hosted desktop
  3. Try to copy, download and print a test file and check the data-transfer policy behaves as approved
  4. Review a sample change request from request to closure, including the test evidence
  5. Ask for a sample monthly service review pack and baseline review
  6. Confirm in the responsibilities table which tasks stay with your IT team

Questions

Frequently asked questions

Can you take over a Citrix environment we already run?

Yes. Moraph assesses it during discovery, brings it to an agreed baseline and operates it, and can plan a move to hosted workloads if you want one.

Citrix or Azure Virtual Desktop: which should we choose?

It depends on your applications, your existing licences and how you want to host. Moraph supports both and gives you a recommendation with the reasons after discovery; the choice is yours.

Who owns the data in the hosted desktops?

Your institution does. Where it is stored and how it is returned and deleted at the end of the agreement are set out in the contract.

How is it priced?

Vendor licences and any hosting costs are priced under the vendor's terms, and Moraph's managed service is a subscription based on the number of users and desktop pools, with implementation charged separately. See Working with Moraph for what drives a quotation.

Do Moraph engineers have standing access to our environment?

Moraph engineers use named administrative accounts that your service owner approves, through your identity provider, and every administrative action is logged and reviewable by your security officer.

Is there an accessibility conformance report?

Ask through the procurement request form at /how-to-buy/request, naming the platform and version you are evaluating, and we will obtain the vendor's current report for you.

Next steps

Evaluate Virtual Desktop Infrastructure

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Virtual Desktop Infrastructure guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Virtual Desktop Infrastructure support guide.

Related products