Sorry to give vague answers.
The defender solution will be entirely cloud based. we will have local servers (when they become end of life we replace them with a cloud based service). In the meantime we need a solution where our data is not uploaded to Microsoft. We have identifiable medical data and are subject to legislative requirements