Why a responsibility matrix matters

Moving desktops to the cloud never makes the work disappear. It moves the line between what Microsoft operates and what your team still owns. Teams that miss this line end up with an unpatched image, a forgotten capacity plan, or a “managed” service nobody is actually managing.

The matrix below compares four models across eleven layers, from the physical datacenter at the bottom to user identity at the top.

The big picture at a glance

Layer by layer

Reading each model

Windows 365: the most managed option

Windows 365 is delivered as a SaaS-style Cloud PC. Microsoft handles the datacenter, broker, VM lifecycle, device onboarding, device identity, networking, capacity (including business continuity and disaster recovery) and even the OS image lifecycle. Your team focuses on patching policy, applications and users. The result is the lowest operational overhead and the most predictable cost per user.

Windows 365 with configurable options

Many enterprises need more control, such as a custom network, a custom image or specific identity settings. When you enable those options, the device identity, networking and capacity layers become shared, and image lifecycle moves back to you. You trade some convenience for fit, so choose each option deliberately rather than turning everything on.

Azure Virtual Desktop: maximum flexibility

With AVD, Microsoft runs the datacenter and the control plane (broker and service delivery). You own the session hosts, VM lifecycle, images, networking, scaling, disaster recovery, patching and apps. In return you get multi-session Windows, fine-grained cost optimisation with autoscale, and full architectural freedom.

On-premises VDI: everything is yours

Traditional VDI means you operate the whole stack, including hardware, hypervisor, broker, storage, network and security. It can be the right answer for data residency, latency-sensitive or air-gapped workloads, but it carries the highest operational burden.

How to choose

• Pick Windows 365 when you want predictable per-user pricing, fast onboarding and minimal operations, for example contractors, developers or call centre staff with persistent desktops.
• Pick Windows 365 with options when you like the simplicity but need your own network, image or identity controls.
• Pick Azure Virtual Desktop when you need multi-session hosts, deep customisation, scale-to-zero cost savings or complex application stacks, and you have the skills to run it.
• Stay on-premises only when regulation, latency or connectivity truly forces it.

Key takeaways

Every step from on-premises VDI to AVD to Windows 365 hands more layers to Microsoft, and each handover reduces your operational control as well as your workload. Match the model to your team’s skills and your workload’s needs, then write down who owns each of the eleven layers before go-live. If you can’t name an owner for a layer, that’s your first risk item.

Based on Microsoft’s responsibility matrix for Windows 365, Azure Virtual Desktop and on-premises VDI. Always confirm current details in Microsoft documentation, as service boundaries evolve.