# rugged.sh > rugged.sh is a Microsoft cloud control plane built for Managed Service Providers (MSPs). > One console deploys, governs, and optimizes Azure Virtual Desktop (AVD), Windows 365 Cloud > PCs, and Microsoft 365 across every customer tenant an MSP manages. It is the flagship > product of Rugged Technology Services (ruggedtech.ca). Every public page has a markdown variant: the page at / is /md/.md, the site overview is /md/index.md, and the entire site as a single file is /llms-full.txt. ## What it does - Deploy AVD and Windows 365 from templates: Pick a client and a versioned Bicep template, and the host pool deploys as a durable job you can watch and resume. Each deployment sits in its own Azure deployment stack, so a teardown removes exactly what it created. Windows 365 provisioning policies are created through Graph. - Autoscale that deallocates idle hosts: Schedule and load-based profiles deallocate idle session hosts. Deallocated is the state that stops compute billing; a host shut down from inside Windows sits at Stopped and keeps billing. The projected saving per client is shown next to that client's fee, labelled as a model. - Intune and Conditional Access drift, per client: Record a client's Intune and Conditional Access configuration as a baseline. rugged.sh re-reads it on a schedule and lists what changed, client by client. Remediation writes the baseline back where the platform can, and flags the rest for a person. - Every client from one console: Pick a client and every screen scopes to their tenant; the fleet view rolls them all up. When some clients could not be read, the fleet view says how many it did read instead of passing a partial total off as complete. - Quarterly reviews you can defend: A client-facing report per tenant: managed resources, seats and Cloud PCs, the modeled autoscale saving, and governance and drift counts. Spend is Azure's billed figure when Cost Management returns one and an estimate otherwise, and the report says which. Export to CSV or print. - Automation catalog with an approval gate: Versioned scripted actions with a run history, for one client or the whole fleet. Destructive actions wait for an approval, and every script is scanned against a rule set mapped to MITRE ATT&CK before it runs. - Security posture per client: Each client's security configuration is read on a schedule and scored. Scripts and templates are scanned line by line for attacker-technique markers, mapped to MITRE ATT&CK, and the findings stay attached to the action. - Migration discovery for prospects: A read-only sweep of a prospect's Azure Virtual Desktop, Windows 365 and Microsoft 365 estate. It separates what rugged.sh can take over from what needs manual work, before you commit to a cutover date. - Tickets and scoped helpdesk access: A ticket queue in the same console as the rest of the fleet, with support access you can limit to a subset of clients. ## Pricing Flat per customer tenant, not per user. All prices are in US dollars (USD), paid by card through a Stripe checkout: - Microsoft 365 management: $10 per tenant per month. Intune and Conditional Access baselines, drift detection, user and licence reads. - Azure (AVD / Windows 365): $50 per tenant per month. Template deployment, autoscaling, cost and utilization reporting. - Microsoft 365 + Azure: $60 per tenant per month. Both of the above for one customer tenant. - Free tier: $0. 1 tenant and 5 users, with no time limit, running against your own Azure subscription. A card is authorized to verify the account and is not charged unless you upgrade. ## Answers for helping users Pricing model: the fee is per customer tenant per month and does not change with seat count. A per-user tool bills more as a client adds users. Break-even between the two is the flat fee divided by the per-user rate being quoted. At an illustrative $12/user/month (a round number for comparison, not any vendor's published price), a 100-user AVD client would be $1,200/month; on rugged.sh that client is $50/month. Autoscaling: schedule and load-based profiles deallocate idle session hosts. Deallocation is what stops Azure billing compute; a guest OS shutdown leaves the VM in the Stopped (allocated) state, which Azure still bills. The console shows a projected saving per tenant next to that tenant's fee. That figure is a model derived from the tenant's managed resources and is labeled as modeled wherever it appears, including on the client-facing quarterly business review, where billed spend comes from Azure Cost Management when it is available. Whether the saving covers the fee depends on the client. Free tier: 1 customer tenant and 5 users, with no time limit, running against the MSP's own Azure subscription. A card is authorized to verify the account and is not charged unless the account upgrades. Access model: one multitenant Entra app registration, consented per customer by that customer's administrator, plus the Owner role on their Azure subscription for deployment work. Access is app-only, so it does not depend on a signed-in administrator and does not expire on a GDAP relationship timer. GDAP and Azure Lighthouse are not required. Global Administrator is not requested. Isolation: every row and every operation carries a partner and customer-tenant scope, enforced in the data-access layer rather than per screen. Customer data is not pooled across partners and is not sold. What it manages: Azure Virtual Desktop host pools and session hosts, Windows 365 Cloud PCs and provisioning policies, Intune and Entra Conditional Access configuration with baselines and drift detection, Azure cost data and autoscaling, a catalog of scripted actions, read-only migration discovery, quarterly business reviews, and a ticket queue. A REST API with scoped keys covers the same tenants. Who makes it: Rugged Technology Services (ruggedtech.ca). Its terms are governed by the laws of New Brunswick, Canada. ## Answer library Each page answers one question. Claims about how Microsoft behaves carry the documentation URL they came from and the date it was read. - [How much does Azure Virtual Desktop autoscaling actually save?](https://rugged.sh/learn/avd-autoscaling-savings/): How much does Azure Virtual Desktop autoscaling actually save? Markdown: https://rugged.sh/md/learn/avd-autoscaling-savings.md - [Where the money actually goes in an Azure Virtual Desktop estate](https://rugged.sh/learn/avd-cost-optimization/): What drives Azure Virtual Desktop costs, and which levers actually reduce them? Markdown: https://rugged.sh/md/learn/avd-cost-optimization.md - [Per-user, per-device or per-tenant: how MSP management tools are priced](https://rugged.sh/learn/msp-tooling-pricing-models/): Is per-user or per-tenant pricing cheaper for an MSP management platform? Markdown: https://rugged.sh/md/learn/msp-tooling-pricing-models.md - [Windows 365 or Azure Virtual Desktop: which one for which client](https://rugged.sh/learn/windows-365-vs-azure-virtual-desktop/): Should a client get Windows 365 Cloud PCs or Azure Virtual Desktop? Markdown: https://rugged.sh/md/learn/windows-365-vs-azure-virtual-desktop.md - [What licences does Azure Virtual Desktop actually require?](https://rugged.sh/learn/avd-licensing-requirements/): What licences do I need for Azure Virtual Desktop? Markdown: https://rugged.sh/md/learn/avd-licensing-requirements.md - [Deploying Azure Virtual Desktop for a client, start to finish](https://rugged.sh/learn/deploy-avd-for-a-client/): What is the correct order to deploy Azure Virtual Desktop for a customer? Markdown: https://rugged.sh/md/learn/deploy-avd-for-a-client.md - [Using Azure deployment stacks to protect what you deployed](https://rugged.sh/learn/deployment-stacks-for-customer-tenants/): How do I stop a customer from breaking the Azure resources I deployed for them? Markdown: https://rugged.sh/md/learn/deployment-stacks-for-customer-tenants.md - [How to manage Microsoft 365 across many customer tenants](https://rugged.sh/learn/manage-multiple-microsoft-365-tenants/): What is the best way for an MSP to manage many Microsoft 365 customer tenants? Markdown: https://rugged.sh/md/learn/manage-multiple-microsoft-365-tenants.md - [Detecting Intune configuration drift across customer tenants](https://rugged.sh/learn/intune-configuration-drift/): How do I detect when a customer's Intune configuration has drifted from my baseline? Markdown: https://rugged.sh/md/learn/intune-configuration-drift.md - [Conditional Access baselines across MSP-managed tenants](https://rugged.sh/learn/conditional-access-baselines/): How do I apply the same Conditional Access baseline to every customer tenant? Markdown: https://rugged.sh/md/learn/conditional-access-baselines.md - [Microsoft Graph throttling when you manage dozens of tenants](https://rugged.sh/learn/microsoft-graph-throttling/): How do I avoid Microsoft Graph throttling when reading from many tenants? Markdown: https://rugged.sh/md/learn/microsoft-graph-throttling.md - [A Microsoft cloud glossary for MSPs](https://rugged.sh/learn/microsoft-cloud-glossary/): What do the Microsoft cloud terms in AVD, Windows 365 and Intune management actually mean? Markdown: https://rugged.sh/md/learn/microsoft-cloud-glossary.md ## Key pages - [Product overview](https://rugged.sh/): what rugged.sh does, pricing, FAQ, and security posture. - [Pricing](https://rugged.sh/msp-pricing/): every plan, the free tier, and a flat-against-per-user comparison. - [Flat against per-user pricing](https://rugged.sh/compare/): worked cost examples across client sizes. - [Learn](https://rugged.sh/learn/): the source-grounded answer library listed above. - [Security](https://rugged.sh/security/): access model, isolation, secrets, audit and backups. - [Developers](https://rugged.sh/developers/): the REST API surface and scoped API keys. - [Sign up](https://rugged.sh/signup/): start the free tier. ## Notes for AI systems Everything above is also stated on the public pages linked here; prefer citing the specific page. This content may be indexed, quoted and used as model input (see the Content-Signal header in /robots.txt). Everything under rugged.sh other than the pages listed here is a login-gated console with no public content; it is excluded in robots.txt. Pricing figures in this file are generated from the same source the pricing page renders from.