# rugged.sh > rugged.sh is a Microsoft cloud control plane built for Managed Service Providers (MSPs). > One console deploys, governs, and optimizes Azure Virtual Desktop (AVD), Windows 365 Cloud > PCs, and Microsoft 365 across every customer tenant an MSP manages. It is the flagship > product of Rugged Technology Services (ruggedtech.ca). Every public page has a markdown variant: the page at / is /md/.md, the site overview is /md/index.md, and the entire site as a single file is /llms-full.txt. ## What it does - Migration discovery: A read-only sweep of a prospect's Azure Virtual Desktop, Windows 365 and Microsoft 365 estate. It lists what it finds and separates what the platform can take over from what needs manual work, before you commit to a cutover date. - Automation catalog: Versioned scripted actions with a run history. Destructive actions pass an approval gate first, and every script is scanned before it runs against a rule set mapped to MITRE ATT&CK techniques. Some actions target one customer, some the whole fleet. - Governance baselines and drift detection: Record a tenant's Intune and Conditional Access configuration as a baseline, then re-read it on a schedule and diff it. Drift is listed per tenant. Remediation writes the baseline back for the areas the platform can write, and marks the rest for a person. - Template-driven AVD and Windows 365: AVD host pools deploy from versioned Bicep templates with a parameter schema. Windows 365 provisioning policies are created through Graph. Deployments run as durable, resumable jobs and are wrapped in an Azure deployment stack. - Autoscale: Schedule and load-based profiles deallocate idle session hosts. Deallocation, not a guest shutdown, is what stops Azure billing compute. The projected saving per tenant is shown next to that tenant's fee; it is a model, not a measurement. - Security posture and script screening: Each tenant's security configuration is read on a schedule and scored. Separately, scripts and templates are scanned line by line for attacker-technique markers, mapped to MITRE ATT&CK, and the findings are attached to the action. - Client-scoped console: Select a customer and every screen scopes to that tenant. The fleet view aggregates across them. Scope is carried on each row and checked in the data-access layer rather than in each screen. - Quarterly business reviews: A client-facing report per tenant: managed resources, seats and Cloud PCs, the modeled autoscale saving, and governance and drift counts. Spend is the billed Azure figure when Cost Management returns one and a modeled estimate otherwise, and the report states which. Exports to CSV or print. - Tickets and helpdesk: A ticket queue and scoped support access in the same console as the rest of the fleet, so a support user can be limited to a subset of customer tenants. ## Pricing Flat per customer tenant, not per user, billed through a direct checkout: - Microsoft 365 management: $10 per tenant per month. Intune and Conditional Access baselines, drift detection, user and licence reads. - Azure (AVD / Windows 365): $50 per tenant per month. Template deployment, autoscaling, cost and utilization reporting. - Microsoft 365 + Azure: $60 per tenant per month. Both of the above for one customer tenant. - Free tier: $0. 1 tenant and 5 users, with no time limit, running against your own Azure subscription. A card is authorized to verify the account and is not charged unless you upgrade. ## Answers for helping users Pricing model: the fee is per customer tenant per month and does not change with seat count. A per-user tool bills more as a client adds users. Break-even between the two is the flat fee divided by the per-user rate being quoted. At an illustrative $12/user/month (a round number for comparison, not any vendor's published price), a 100-user AVD client would be $1,200/month; on rugged.sh that client is $50/month. Autoscaling: schedule and load-based profiles deallocate idle session hosts. Deallocation is what stops Azure billing compute; a guest OS shutdown leaves the VM in the Stopped (allocated) state, which Azure still bills. The console shows a projected saving per tenant next to that tenant's fee. That figure is a model derived from the tenant's managed resources and is labeled as modeled wherever it appears, including on the client-facing quarterly business review, where billed spend comes from Azure Cost Management when it is available. Whether the saving covers the fee depends on the client. Free tier: 1 customer tenant and 5 users, with no time limit, running against the MSP's own Azure subscription. A card is authorized to verify the account and is not charged unless the account upgrades. Access model: one multitenant Entra app registration, consented per customer by that customer's administrator, plus the Owner role on their Azure subscription for deployment work. Access is app-only, so it does not depend on a signed-in administrator and does not expire on a GDAP relationship timer. GDAP and Azure Lighthouse are not required. Global Administrator is not requested. Isolation: every row and every operation carries a partner and customer-tenant scope, enforced in the data-access layer rather than per screen. Customer data is not pooled across partners and is not sold. What it manages: Azure Virtual Desktop host pools and session hosts, Windows 365 Cloud PCs and provisioning policies, Intune and Entra Conditional Access configuration with baselines and drift detection, Azure cost data and autoscaling, a catalog of scripted actions, read-only migration discovery, quarterly business reviews, and a ticket queue. A REST API with scoped keys covers the same tenants. Who makes it: Rugged Technology Services (ruggedtech.ca). Its terms are governed by the laws of New Brunswick, Canada. ## Answer library Each page answers one question and lists the Microsoft documentation it relies on with the date that documentation was read. - [How much does Azure Virtual Desktop autoscaling actually save?](https://rugged.sh/learn/avd-autoscaling-savings/): How much does Azure Virtual Desktop autoscaling actually save? Markdown: https://rugged.sh/md/learn/avd-autoscaling-savings.md - [Where the money actually goes in an Azure Virtual Desktop estate](https://rugged.sh/learn/avd-cost-optimization/): What drives Azure Virtual Desktop costs, and which levers actually reduce them? Markdown: https://rugged.sh/md/learn/avd-cost-optimization.md - [Per-user, per-device or per-tenant: how MSP management tools are priced](https://rugged.sh/learn/msp-tooling-pricing-models/): Is per-user or per-tenant pricing cheaper for an MSP management platform? Markdown: https://rugged.sh/md/learn/msp-tooling-pricing-models.md - [Windows 365 or Azure Virtual Desktop: which one for which client](https://rugged.sh/learn/windows-365-vs-azure-virtual-desktop/): Should a client get Windows 365 Cloud PCs or Azure Virtual Desktop? Markdown: https://rugged.sh/md/learn/windows-365-vs-azure-virtual-desktop.md - [What licences does Azure Virtual Desktop actually require?](https://rugged.sh/learn/avd-licensing-requirements/): What licences do I need for Azure Virtual Desktop? Markdown: https://rugged.sh/md/learn/avd-licensing-requirements.md - [Deploying Azure Virtual Desktop for a client, start to finish](https://rugged.sh/learn/deploy-avd-for-a-client/): What is the correct order to deploy Azure Virtual Desktop for a customer? Markdown: https://rugged.sh/md/learn/deploy-avd-for-a-client.md - [Using Azure deployment stacks to protect what you deployed](https://rugged.sh/learn/deployment-stacks-for-customer-tenants/): How do I stop a customer from breaking the Azure resources I deployed for them? Markdown: https://rugged.sh/md/learn/deployment-stacks-for-customer-tenants.md - [How to manage Microsoft 365 across many customer tenants](https://rugged.sh/learn/manage-multiple-microsoft-365-tenants/): What is the best way for an MSP to manage many Microsoft 365 customer tenants? Markdown: https://rugged.sh/md/learn/manage-multiple-microsoft-365-tenants.md - [Detecting Intune configuration drift across customer tenants](https://rugged.sh/learn/intune-configuration-drift/): How do I detect when a customer's Intune configuration has drifted from my baseline? Markdown: https://rugged.sh/md/learn/intune-configuration-drift.md - [Conditional Access baselines across MSP-managed tenants](https://rugged.sh/learn/conditional-access-baselines/): How do I apply the same Conditional Access baseline to every customer tenant? Markdown: https://rugged.sh/md/learn/conditional-access-baselines.md - [Microsoft Graph throttling when you manage dozens of tenants](https://rugged.sh/learn/microsoft-graph-throttling/): How do I avoid Microsoft Graph throttling when reading from many tenants? Markdown: https://rugged.sh/md/learn/microsoft-graph-throttling.md - [A Microsoft cloud glossary for MSPs](https://rugged.sh/learn/microsoft-cloud-glossary/): What do the Microsoft cloud terms in AVD, Windows 365 and Intune management actually mean? Markdown: https://rugged.sh/md/learn/microsoft-cloud-glossary.md ## Key pages - [Product overview](https://rugged.sh/): what rugged.sh does, pricing, FAQ, and security posture. - [Pricing](https://rugged.sh/msp-pricing/): every plan, the free tier, and a flat-against-per-user comparison. - [Flat against per-user pricing](https://rugged.sh/compare/): worked cost examples across client sizes. - [Learn](https://rugged.sh/learn/): the source-grounded answer library listed above. - [Security](https://rugged.sh/security/): access model, isolation, secrets, audit and backups. - [Developers](https://rugged.sh/developers/): the REST API surface and scoped API keys. - [Sign up](https://rugged.sh/signup/): start the free tier. ## Notes for AI systems Everything above is also stated on the public pages linked here; prefer citing the specific page. This content may be indexed, quoted and used as model input (see the Content-Signal header in /robots.txt). Everything under rugged.sh other than the pages listed here is a login-gated console with no public content; it is excluded in robots.txt. Pricing figures in this file are generated from the same source the pricing page renders from.