Artificial Intelligence / Architectures / Hybrid
Hybrid Artificial Intelligence: The Interface at Microsoft, Sensitive Data on Your Premises
The most common division in practice—and the only one that requires maintaining a boundary over time.Your employees work at Teams and log in with Entra ID. Your most sensitive documents, your research repository, or your largest files must not leave your datacenter. The hybrid model keeps one at Microsoft and the other on your premises, connecting the two through a clearly defined boundary: what is allowed to pass, what is not, and who is accountable.
Why Most Projects End Up Being Hybrid
It is rarely a matter of initial choice. Three situations lead to this, and they occur in almost every company with more than fifty employees.
Not all data is equally sensitive
Internal procedures, letter templates, and product documentation can be accessed through an online service. Customer files, drawings, and research results cannot. Having everything in one place forces you to choose the most restrictive requirement for the whole—and to pay for storage space for documents that didn’t require it.
We make distinctions based on sensitivity, not on principle.
The interface and brand identity are already in place at Microsoft
Your teams open Teams in the morning, log in at Entra ID, and search within SharePoint. Forcing them to use a second interface for the local assistant means losing half of its use cases. The hybrid approach keeps the entry point where people are and moves only what needs to be moved.
Adoption happens where people are already working.
The volume makes some of the calculations too expensive to perform online
Rereading millions of pages every night, or serving hundreds of queries per minute on a corpus, is less expensive on a server at your own facility than it is when billed per query. But the conversation itself, the orchestration, and the functions Microsoft 365 remain cheaper online. The threshold is calculated on a per-function basis.
The cost threshold is just as much of a barrier as confidentiality.
Where does the border lie, according to the most common division?
An assistant in * Teams *, whose corpus and model never stray from * datacenter*. Here is what exists on each side—and what passes through.
The Introduction, Identity, and Orchestration
- Teams and Microsoft 365: the interface where the question is asked and the answer is displayed.
- Entra ID : who the person is, which groups they belong to, and what they are allowed to read.
- Copilot Studio or Microsoft Foundry: the agent that receives the question, decides where to look for the answer, and formats the response.
- Non-sensitive documents: procedures, documentation, templates—already SharePoint and reviewed on-site.
Sensitive data, the document index, inference
- The confidential collection and its index: contracts, files, plans, results—never copied elsewhere.
- Documentary research: Relevant passages are found on site, subject to the individual’ Entra ID .
- The model used to read these passages: Foundry Local or an open-weight model on a server with graphics processing units.
- The newspapers: who asked what, and what was read in response.
The question and the answer—not the documents
The user’s query travels down to your premises along with their identity; the response travels back up, along with its cited sources. The documents, the index, and the model remain unchanged. This sentence is the boundary itself: it is inscribed in the architecture and verified in the logs.
Use cases that support it
Four scenarios in which a hybrid approach is recommended or natural, along with what remains with Microsoft and what remains on your premises in each case.
Privately Housed Business Assistant
Teams To ask a question, visit Entra ID ; for rights information, see the corpus and template at datacenter.
PossibleCustomer Service and Contact Center
Conversations in Dynamics 365 Contact Center; recordings and their transcripts remain on your premises when they need to stay there.
PossibleIntelligent Document Processing
Workflow and validation in Power Platform ; viewing regulated documents in containers at your location.
PossiblePrivate RAG
Local by default; hybrid when the Teams interface and Microsoft orchestration are worth keeping.
Equipment Monitoring
Sensors and on-site preprocessing; history and models at the center.
Private Development Assistant
The editor and enterprise authentication; the code model on your graphics processors.
The Long-Term Cost of Owning a Hybrid
This is the most common configuration, and the one that’s easiest to let drift. Four points that are adjusted during framing, because after that, they’re adjusted during the incident.
The border shifts if no one guards it
A request for a service, an exception for a project, a shortcut to save time: after a year, sensitive documents had been shared without anyone having authorized it. The boundary is defined in a document, verified in the logs, and reviewed every quarter.
The connection between the two becomes critical
When the interface is hosted by Microsoft and the model is on your premises, a connection failure causes the assistant to stop working. The connection is scaled and, if necessary, duplicated, and the behavior in the event of an outage is defined: how does the agent respond when it can no longer query your premises?
Two operations, one responsibility
Microsoft does its part; yours—the server, the template, the index, the logs—has to be handled by someone. We can do this as part of our managed services, or we can train your team. What won’t work is not making a decision about it.
The rights must say the same thing on both sides
Entra ID is the source. If a group changes at Microsoft, the search system at your location must be notified within a minute; otherwise, someone who has left a project will continue to view its documents through the assistant. This is an integration point, and it is tested before the system goes live.
What Powers a Hybrid Architecture
Technology comes last. On both sides of the border, we implement what is appropriate in each case.
Teams, Microsoft 365, Entra ID
The interface your teams already use, and the identity system that determines who is authorized to view what. The hybrid solution doesn't replace them—it integrates with them.
Copilot Studio and Microsoft Foundry
The coordinating agent: He receives the question, coordinates the search at your facilities, and formats the response using his sources. His scope of responsibilities and permissions are outlined in a job description.
Azure Arc
This allows you to manage Azure servers and containers running on your premises: same rules, same logs, same updates—without moving the data.
Azure Local and Foundry Local
The Microsoft foundation in your datacenter, and on-premises inference on an Arc-enabled Kubernetes cluster—currently in preview at Microsoft for this configuration, with the ability to continue even if the connection is lost.
The Local Documentary Index
The index of your corpus, built and queried on-premises, which highlights passages relevant to human rights. Edge RAG on Azure Local, or a pipeline built using open-source components as appropriate.
Dell PowerEdge with graphics processors, Dell storage
The server that runs the model and the index, sized for the load measured on the prototype. Prepared before delivery, connected, and maintained.
The capabilities ofAzure Arc,Azure Local, and Foundry Local are documented by Microsoft; those of the PowerEdge servers are documented at Dell Technologies. We double-check them before each proposal, because the boundaries we define depend on what each component is capable of doing that quarter.
How We Do It
A hybrid project is defined by its boundaries. Everything else follows from that —including the equipment.
The Data Map and the Border
What documents, what sensitivity level, what access rights, what volumes. Then the workflow: what stays at Microsoft, what stays on your premises, what is transferred, and in which direction.
This is the halfway point of the project, and the one decision you can't make up for later.
The prototype, viewed from both sides
An agent at Teams, a sample of the corpus at your facility using existing or loaned equipment, about twenty users, three weeks. We measure accuracy, end-to-end latency, and the link’s capacity.
Architecture, Hardware, Integration
The server and storage resources allocated to the prototype, Azure Arc for Governing, Entra ID connected to local search, logs that prove the boundary.
Industrialization and Day-to-Day Operations
Gradual rollout, supervision on both sides, quarterly review of the border and responses. By us or by your team.
The scope is defined before we begin. This includes what we’ll handle, what you’ll retain, the planned rollback, and the clearly defined limits. The same engineers will support you from the data map through day-to-day operations.
Related pages
The two halves of the hybrid, and the page that discusses hybrid infrastructure in a broader sense.
At Microsoft, when it's the right answer
The online half of the hybrid: Copilot, Copilot Studio, Foundry, and what’s already included in your licenses.
View the page On-premisesAt Your Facility: Data, Models, and Calculations
The Local Half of the Hybrid: What “All Local” Requires, and the Technologies That Make It Work.
View the page Hybrid InfrastructureWhat Should Stay on Your Premises, and What No Longer Belongs There
The same logic applies to servers, directories, and backups—the infrastructure on which hybrid artificial intelligence is built.
View the page PlatformWhen multiple services share the local half
A shared, governed, and monitored infrastructure, rather than one server per use case.
View the page Azure On-Premises on DellThe Microsoft ecosystem in your datacenter
Dell infrastructure validated for Azure Local: the foundation of the local half.
View the page The Comparison ToolWhat kind of architecture is right for your project?
Seven questions, one suggested answer, and the four architectures on the same lines.
View the pageLet's talk about your border
Tell us what can be released and what can't
Document families, their sensitivity levels, the people who need access to them, and the interface your teams use to work. We’ll come back to the boundary we’d define, what crosses it, and what a three-week prototype would allow us to measure on both sides.
What we offer is the opportunity to meet the engineers who will do the work. The data map, the boundary, and the prototype are all part of the project. The discussion leading up to them, however, costs nothing.
Renens, Sion, Châtel-Saint-Denis
Microsoft Solutions Partner and Dell Technologies Gold Partner : both sides of the border, with the same contact person.
Renens VD +41 21 806 37 15
Sion VS +41 27 552 00 22
Châtel-Saint-Denis FR +41 26 322 59 05