rugged.sh
Start free

A Microsoft cloud glossary for MSPs

5 min readMarkdown version

Short answer

The terms that trip people up most are the ones that sound like synonyms and are not: a host pool is a group of session hosts, an application group publishes what users see, and a workspace is what they connect to. Stopped and deallocated are different billing states. Azure Lighthouse covers Azure resources while Microsoft 365 Lighthouse is a separate console. Definitions for each of these, and the rest of the vocabulary, are below.

Azure Virtual Desktop

  • Host pool: A collection of session hosts that share configuration and load balancing. Either pooled, where users share hosts, or personal, where each user has a dedicated one.
  • Session host: The Windows VM users actually run on. An ordinary Azure VM with the AVD agent registered to a host pool.
  • Application group: What is published to users from a host pool: either the full desktop or a set of RemoteApps. It references the host pool at creation and is registered to a workspace.
  • Workspace: The logical container users connect to, which surfaces the application groups they are assigned.
  • Multi-session: Windows 10 or 11 Enterprise multi-session, editions that allow several concurrent interactive users on one VM. The basis of pooled AVD economics.
  • Scaling plan: The AVD resource that defines ramp-up, peak, ramp-down and off-peak behaviour for a host pool, with capacity thresholds per schedule.
  • Drain mode: Marking a session host so no new sessions land on it, which is how a host is emptied before it can be deallocated.
  • FSLogix: The profile container technology that makes a user's profile follow them across pooled hosts, stored on Azure Files or Azure NetApp Files.
  • RDP Shortpath: A direct UDP transport for the remote session, as opposed to the default TCP 443 reverse connection.

Windows 365

  • Cloud PC: A dedicated, Microsoft-hosted Windows VM assigned one-to-one to a user, billed per user per month.
  • Provisioning policy: The Intune object that defines how Cloud PCs are built: image, join type and network. Cloud PCs provision automatically when a licence is assigned, rather than being created by an admin.
  • Azure network connection: The optional link between Cloud PCs and on-premises resources.
  • Windows 365 Flex: The variant where one licence covers more than one user, in contrast to the one-to-one model in Enterprise, Business and Government. It has two modes. In Dedicated mode a licence provisions up to three Cloud PCs, each assigned to a single user, with one concurrent session between them. In Shared mode a licence provisions one Cloud PC shared non-concurrently by a group, wiped at sign-out. Formerly named Windows 365 Frontline.

Identity and access

  • Microsoft Entra ID: The cloud identity service, formerly Azure Active Directory. Always the authentication authority for AVD.
  • App-only access: API access using the client credentials flow, where an application authenticates as itself with no signed-in user. Does not expire with a session and is not tied to a person.
  • Admin consent: The act by which a customer's administrator grants an application the permissions it requests in their tenant. Visible and revocable in the customer's enterprise applications.
  • GDAP: Granular Delegated Admin Privileges. Time-bound, role-scoped delegated access for partner staff, with a maximum relationship duration of two years.
  • Azure Lighthouse: Azure delegated resource management, letting a customer delegate Azure subscriptions or resource groups to a managing tenant. Azure resources only.
  • Microsoft 365 Lighthouse: A separate Microsoft console for onboarding, monitoring and managing Microsoft 365 customer tenants at scale.
  • Hybrid identity: A user account synchronized between on-premises Active Directory and Entra ID, matched on UPN or SID.

Governance and deployment

  • Settings Catalog: The Intune surface listing individual configurable settings, exposed through Graph as configuration policies. Documented on the beta endpoint.
  • Conditional Access: Entra policies that evaluate sign-in conditions and apply grant or session controls. Can run enabled, disabled, or report-only.
  • Report-only: The Conditional Access state that evaluates a policy against real sign-ins and records the result without enforcing it.
  • Configuration drift: The difference between a tenant's current configuration and the baseline it is supposed to match, accumulated through ordinary day-to-day changes.
  • Bicep: The domain-specific language that compiles to ARM JSON templates. Readable infrastructure as code for Azure.
  • Deployment stack: An Azure resource that manages a group of resources as one unit and can apply deny settings that block changes from outside the stack.
  • Deny assignment: The mechanism behind deployment stack deny settings, blocking specified control plane operations on managed resources for everyone except excluded principals.
  • Idempotent job: An operation that can be safely retried and produces the same result, which is what long-running cloud deployments have to be to survive throttling and restarts.

Billing and scale

  • Deallocated: A VM power state where the lease on the underlying hardware is released and compute is no longer billed. Disks and networking continue to incur charges.
  • Stopped (allocated): A VM that is powered off but still allocated to a host, typically from a guest OS shutdown. Still billed for compute.
  • Throttling: Service-imposed request limiting. Microsoft Graph signals it with HTTP 429 and a Retry-After header.
  • Tenant: A single customer's Microsoft cloud directory. The natural unit of isolation, and the unit rugged.sh prices on.
  • Partner isolation: The property that one MSP using a shared platform cannot see another MSP's customers or data. Where it is enforced matters: a check in the data-access layer holds for every query, while a check in each screen holds only for the screens that remember it.

Questions people ask

What is the difference between a host pool and a workspace in AVD?
A host pool is the collection of session host VMs that run user sessions. A workspace is what users connect to, and it surfaces the application groups published from one or more host pools. An application group sits between them, referencing the host pool and being registered to the workspace.
What is the difference between Azure Lighthouse and Microsoft 365 Lighthouse?
Azure Lighthouse is Azure delegated resource management, letting customers delegate Azure subscriptions and resource groups to a managing tenant. Microsoft 365 Lighthouse is a separate offering that helps service providers onboard, monitor and manage Microsoft 365 customer tenants.
What does deallocated mean in Azure?
The VM has released its lease on the underlying hardware and is no longer billed for compute. It is distinct from Stopped, where the VM is powered off but still allocated and still billed. Disks and networking keep incurring charges in both states.

Sources

Microsoft's behaviour described above was read from these pages on the dates shown. Claims that come from our own testing against a live Azure subscription carry that date inline.

Related

Try it on one client

The free tier covers one customer tenant and five users, with no time limit, against your own Azure subscription. Paid plans are priced per tenant, not per user.

Start free See pricing