Running Microsoft cloud for other people
Questions that come up managing Azure Virtual Desktop, Windows 365 and Microsoft 365 across many customer tenants. Claims about how Microsoft behaves list the documentation they came from and the date it was read.
12 articles · last updated 2026-09-10 · markdown index · llms.txt
Cost
What a Microsoft cloud estate actually costs, and which levers move it.
How much does Azure Virtual Desktop autoscaling actually save?
Autoscaling saves the compute hours you do not run. Azure bills a session host VM for every hour it is allocated to a host, so the saving comes entirely from reaching the Deallocated power state: a host that runs 260 hours a month instead of 730 stops incurring about 64 percent of its compute charge. Two things do not stop: managed disks and networking keep billing while the VM is deallocated, and per-user Windows licensing is unaffected. A VM shut down from inside Windows lands in Stopped (allocated), which Azure still bills in full.
6 min read · updated 2026-09-10Where the money actually goes in an Azure Virtual Desktop estate
Session host compute is almost always the largest line in an AVD bill, followed by managed disks, profile storage and, in some designs, networking. The levers that move real money are running fewer host hours through autoscaling, right-sizing the VM SKU to measured session density, matching disk tier to actual IOPS, and committing to reservations or savings plans for the capacity you will genuinely run around the clock.
4 min read · updated 2026-09-10Per-user, per-device or per-tenant: how MSP management tools are priced
Per-user pricing scales your cost with your client's headcount, which means your platform bill grows every time a client hires, whether or not your work grows with it. Per-tenant pricing is a fixed cost per customer regardless of seat count, so the cost of managing a client is flat and predictable. Per-tenant is cheaper for every client above a break-even headcount, which you can calculate directly: divide the flat per-tenant fee by the per-user rate.
4 min read · updated 2026-09-10
Deployment
Standing up AVD and Windows 365 for a client without relearning it every time.
Windows 365 or Azure Virtual Desktop: which one for which client
Windows 365 is billed per user per month at a fixed price for a dedicated Cloud PC, so it is predictable and needs almost no capacity planning, but it costs the same whether the user works two hours a day or ten. Azure Virtual Desktop is Azure infrastructure billed by the hour, so pooled multi-session hosts shared across users plus autoscaling make it cheaper at scale, at the cost of design and operational work. Small clients, task workers and anyone who needs a predictable per-seat number tend to fit Windows 365; larger pooled workloads with predictable working hours tend to fit AVD.
4 min read · updated 2026-09-10What licences does Azure Virtual Desktop actually require?
For Windows 10 or 11 Enterprise and Enterprise multi-session session hosts, each user needs one of Microsoft 365 E3, E5, A3, A5, F3, Business Premium or Student Use Benefit, Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows VDA per user. Windows Server session hosts are licensed differently: they need RDS Client Access Licences with Software Assurance, or RDS User Subscription Licences. If your licence entitles you to AVD you do not install a separate one, and Azure consumption for the session host VMs and storage is billed on top either way.
4 min read · updated 2026-09-10Deploying Azure Virtual Desktop for a client, start to finish
Register the resource provider, prepare identity and networking, then create the workspace, the host pool, and the application group that references the host pool, in that order. Session hosts come next: each needs a registration token that exists before the AVD agent installs, a network interface, an osProfile with admin credentials, and an image reference. Assign users to the application group, then add a scaling plan, which requires the AVD service principal to already have access to the host pool.
6 min read · updated 2026-09-10Using Azure deployment stacks to protect what you deployed
Deploy them through an Azure deployment stack with deny settings. A stack manages a set of resources as one unit and creates a deny assignment over them, with a mode of none, denyDelete or denyWriteAndDelete, which applies to everyone except the principals you explicitly exclude. It covers control plane operations only, not data plane ones, and only resources the template creates explicitly, so it stops a subscription owner deleting a host pool but not someone writing into a storage container.
5 min read · updated 2026-09-10
Governance
Baselines, drift and multi-tenant access across a fleet.
How to manage Microsoft 365 across many customer tenants
There are four practical access models: a multitenant app registration consented per customer, which gives app-only API access whose grant does not expire, though its credential still needs rotating; GDAP, which grants time-bound delegated roles to your staff and expires after at most two years; Azure Lighthouse, which delegates Azure resources only and does nothing for Microsoft 365; and Microsoft 365 Lighthouse, a Microsoft console for monitoring customer tenants. Most automation at scale runs on app-only access through a multitenant app, because it does not expire, does not depend on a signed-in admin, and works identically for every tenant.
5 min read · updated 2026-09-10Detecting Intune configuration drift across customer tenants
Read the policy state on a schedule, hash or diff it against a stored golden baseline, and alert on the difference. There is no change feed for Intune Settings Catalog policies, so detection is a polling problem, not an event problem. The practical approach is to treat each policy's settings JSON as an opaque document, compare it structurally rather than field by field, and remediate by writing the baseline back through the policy PATCH.
4 min read · updated 2026-09-10Conditional Access baselines across MSP-managed tenants
Author the policy once, create it in each tenant in report-only state, review the impact in sign-in logs, then enable it. Conditional Access policies are created and read through Microsoft Graph v1.0, and updates are a partial PATCH that returns 204 and preserves fields you did not send, which means a drifted policy can be corrected by patching the changed fields back rather than deleting and recreating it. Deleting a Conditional Access policy to recreate it removes an enforced control in the gap, so it is the wrong remediation path.
4 min read · updated 2026-09-10
Platform
The Microsoft surfaces underneath, and the vocabulary that goes with them.
Microsoft Graph throttling when you manage dozens of tenants
Graph returns HTTP 429 with a Retry-After header giving the number of seconds to wait, and Microsoft's guidance is to wait that long and retry rather than backing off on your own schedule. Combine requests with JSON batching, which allows up to 20 requests in one call, use $select to ask for fewer fields, and avoid polling patterns in favour of change tracking where it exists. The important detail about batching is that each request inside a batch is evaluated individually against throttling limits, so a batch can return 200 while individual members failed with 429.
4 min read · updated 2026-09-10A Microsoft cloud glossary for MSPs
The terms that trip people up most are the ones that sound like synonyms and are not: a host pool is a group of session hosts, an application group publishes what users see, and a workspace is what they connect to. Stopped and deallocated are different billing states. Azure Lighthouse covers Azure resources while Microsoft 365 Lighthouse is a separate console. Definitions for each of these, and the rest of the vocabulary, are below.
5 min read · updated 2026-09-10
Try it on one client
The free tier covers one customer tenant and five users, with no time limit, against your own Azure subscription.