Externally managed cloud provisioning can be a win from a SOC2 / ISO compliance perspective. You've just changed from having to manage controls on local environ

Externally managed cloud provisioning can be a win from a SOC2 / ISO compliance perspective. You've just changed from having to manage controls on local environments yourself (e.g. antivirus, MDM, logging etc ) to offloading the risk to a third-party vendor. Now, you may think that is more INSECURE because now someone else has control over your environments, and that may be true for any arbitrary cloud desktop provider. But when it is Microsoft themselves, it will be hard for an auditor to take issue; they already manage the risk of the OS security itself.