Virtual Desktop Infrastructure

Moraph resells, implements and runs virtual desktops on Citrix or Azure Virtual Desktop for banks, credit unions and lenders. Loan officers and other staff reach their applications through a hosted session, and policies you approve control whether files, clipboard content and print jobs can leave it. Moraph builds and patches the desktop images, monitors the service and handles changes, while you keep the decisions about who gets access and what is allowed.

The problem it solves

Lending and branch staff increasingly work from home offices, customer sites and shared branch desks, on laptops that hold copies of loan files, credit reports and tax documents. Every laptop then becomes a place where customer information can be lost, stolen or kept longer than policy allows. Many institutions already own Citrix or Microsoft licences but lack the staff to build images, keep them patched, tune performance and show examiners how access and data movement are controlled.

Who it’s for

• Banks, credit unions and mortgage lenders with remote or hybrid lending staff
• IT managers who own end-user computing and want it run for them
• Information security officers who set data-handling rules for customer information
• Lending and branch operations leaders whose staff work from several locations
• Internal audit and examiners reviewing access and data protection controls

1. OnboardMoraph assesses your applications and users, designs the desktop pools and images, and builds the environment on Citrix or Azure Virtual Desktop in the hosting arrangement you choose.
2. OperateMoraph monitors session hosts, capacity, sign-in failures and connection quality, and patches images on the schedule you approve.
3. ChangeNew applications, image changes and policy changes go through a change request that your service owner approves, with policy exceptions approved by your security officer.
4. ReviewEach month Moraph reports on service health, changes and incidents, and runs access reviews so managers confirm who still needs each desktop.

Hosted desktops and apps

Citrix or Azure Virtual Desktop delivers full desktops or individual published applications to staff from the hosted environment.

Data-transfer policies

The platform controls clipboard, local drive mapping, USB redirection, printing and file download per user group, set to the policy your security officer approves.

Managed golden images

Moraph builds and maintains the desktop images, with your applications, security agents and settings, under version control.

Image patching

Operating system and application updates are applied to images, tested on a pilot pool and rolled out on the schedule you approve.

Conditional access

Sign-in goes through your identity provider with multi-factor authentication, and access can be limited by device, location or group.

Profile management

User profiles and settings follow staff between sessions without keeping copies on the device they connect from.

Monitoring and alerting

Session host health, capacity, sign-in failures and connection quality are monitored by Moraph's operations team around the clock.

Capacity management

Session host capacity is scaled within limits you set, balancing user experience against infrastructure cost.

Change control

Every change to images, pools or policies is requested, approved, tested and recorded.

Session and admin logging

Platform logs of sign-ins, sessions and administrative actions are retained and can be forwarded to your security monitoring.

Access reviews

Periodic lists of who can use each desktop pool, sent to managers for confirmation, with removals tracked to completion.

Monthly service review

A monthly report and meeting covering availability, incidents, changes, capacity and open actions.

Desktop user

Signs in to the hosted desktop or applications to do their work

Business manager

Requests and approves access for their team and confirms it in access reviews

Service owner

Owns the service at your institution and approves changes

Information security officer

Sets and approves data-transfer policies and exceptions

Moraph service engineer

Builds, patches, monitors and changes the environment under approved requests

Auditor or examiner (read-only)

Views access records, change history and service reports

Identity provider

Staff and Moraph engineers sign in through your identity provider, such as Microsoft Entra ID or Active Directory, with multi-factor authentication.

Line-of-business applications

Your loan origination, core banking and document imaging applications are installed in images or published as applications.

File and profile storage

User profiles and approved file locations are held in storage in the hosting environment, not on the connecting device.

Endpoint protection

Your endpoint detection agent, or Moraph's managed Endpoint Detection & Response service, is included in images.

Security monitoring

Platform sign-in, session and administrative logs forwarded to your SIEM or security operations provider.

IT service management

Tickets and change requests exchanged with your service desk tool so your staff work in one place.

Printing

Printing from hosted sessions routed to approved printers, or disabled for user groups where your policy requires it.

Single sign-on and MFA

Staff and Moraph engineers sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Desktops, applications and administrative rights follow each person's role; approving a change is separate from carrying it out.

Data stays in the hosted session

Data-transfer policies restrict copying, downloading and printing outside the session to what your security officer approves.

Encryption and keys

Data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Sign-ins, sessions, administrative actions and changes are logged with the person and time, and cannot be edited.

Data residency

Desktops are hosted in the region you choose: the United States, the United Kingdom or Australia.

Azure Virtual Desktop in your Azure tenant

Session hosts run in your Azure subscription in the region you choose, with Moraph operating them under delegated, logged administrative access.

Citrix with hosted workloads

Citrix's cloud service brokers sessions to session hosts in Azure or another hosting environment you choose, operated by Moraph.

Existing Citrix environment

Where you already run Citrix in your own data center, Moraph can take over operation and plan any move to hosted workloads.

Discovery

We inventory your applications, user groups, locations and current desktops, and agree the hosting arrangement and platform. We need an application owner contact and access to your current configuration.

Design and policy

Desktop pools, published applications, identity integration and data-transfer policies are designed and documented for your security officer to approve.

Licensing

Moraph supplies the Citrix or Microsoft licences you choose as a reseller, or works with licences you already own, under the vendor's terms.

Build and image testing

Golden images are built with your applications and agents, and tested by pilot users from each user group.

Migration waves

Users move over in waves agreed with you, with the help desk briefed before each wave and the old arrangement kept until each group signs off.

Handover to operations

Monitoring, change control, the approved baseline and the monthly service review start, and your help desk is trained on first-line support.

• Moraph is not Citrix or Microsoft. The platform belongs to its vendor, and the vendor's own service commitments, roadmap and outages apply to it.
• Licences are subject to the vendor's terms, including any minimum counts, term lengths and changes the vendor makes to its licensing.
• Data-transfer policies reduce the ways customer information can leave a session, but they cannot stop someone photographing a screen or retyping data. They work alongside your acceptable-use policy and training.
• Applications that are not supported in a hosted desktop, or that need special hardware, may need to stay on local devices; this is identified during discovery.
• User experience depends on the network connection staff use to reach the service.
• The service manages the hosted desktops, not the laptops or thin clients staff connect from. Device management is a separate service, such as Moraph's managed Mobile Device Management.
• Hosting costs in your own Azure subscription are billed to you by Microsoft and are separate from Moraph's service.
• Decisions about who gets access and what data may leave a session remain your institution's; Moraph implements and evidences them.

• List the applications your lending staff use and confirm each one works in a hosted desktop
• Have a pilot group of loan officers work a full day from home on the hosted desktop
• Try to copy, download and print a test file and check the data-transfer policy behaves as approved
• Review a sample change request from request to closure, including the test evidence
• Ask for a sample monthly service review pack and baseline review
• Confirm in the responsibilities table which tasks stay with your IT team