Disconnect Atlas AVD from Your Tenant

See exactly what Atlas AVD can reach in your Microsoft Entra directory and Azure subscription, start with read-only access, and more.

Before you begin

  • A Global Administrator, Cloud Application Administrator or Application Administrator in Microsoft Entra, to disable the AtlasAVD enterprise application
  • Contributor (or Website Contributor) on the Atlas resource group, to stop and start the Atlas web app
  • Azure Cloud Shell (Bash) or the Azure CLI, for the optional commands

What Atlas can reach, and through what

Atlas reaches your environment only through identities in your own directory and subscription, where you can see and switch off each one:

  • The AtlasAVD app registration. Atlas makes every call to Microsoft Graph, Azure, Microsoft Defender for Endpoint and Exchange Online as this app, with the permissions and roles you granted at setup. Your administrators also sign in to Atlas through it.
  • The Atlas web app's managed identity. It holds Reader on the subscription and access to Atlas's own resource group and Key Vault, which the app needs to run itself. It does not manage your host pools or session hosts.
  • The Atlas AVD Provisioning setup app, during guided setup only. It has delegated permissions only, so it acts only while an administrator is signed in, and Atlas removes it from your directory once your deployment is running.

For every permission Atlas asks for and why it needs it, see App Permissions Troubleshooting. The setup scripts also print each permission and role they grant, with a one-line reason, as they run.

Start small: read-only access

You don't have to grant write access to see what Atlas does. On the signup form, tick I'll set up the app registration myself, then run the read-only setup script, setup-readonly.sh, in Azure Cloud Shell. You can run it against a test or lab tenant first.

  • It grants read permissions and reader roles only: Microsoft Graph read permissions, read-only Microsoft Defender permissions, the Global Reader directory role instead of Exchange Administrator, and Reader, Desktop Virtualization Reader, Monitoring Reader, Log Analytics Reader and Storage Blob Data Reader in Azure. No Contributor roles and no User Access Administrator.
  • Atlas shows your environment but cannot change it. Actions that would make a change stay unavailable and show a permission hint.
  • You can read every line before it runs. The command downloads one version-pinned copy, checks its SHA-256, and only then runs it.
  • When you're ready for full access, run setup.sh. It upgrades the same registration in place, so you keep your Client ID.

Review the Setup Scripts Before You Run Them has links to both scripts, their checksums and the exact command.

Disconnect in minutes, without uninstalling

Two switches cut Atlas off. Both can be undone, and neither deletes anything: your desktops keep running, and Atlas's data stays in its database in your subscription.

  1. Stop the Atlas web app. In the Azure portal, open the Atlas resource group (atlas-avd unless you named it otherwise), open the App Service named atlasavd-app-<suffix>, and click Stop. Atlas stops straight away: no scheduled jobs, no automations, no calls to Azure or Microsoft 365, and no sign-ins.
  2. Disable the AtlasAVD enterprise application. In the Microsoft Entra admin center (entra.microsoft.us in Azure Government), go to Enterprise applications → All applications, open AtlasAVD, go to Properties, set Enabled for users to sign-in? to No, and click Save. Microsoft Entra then issues no new tokens for AtlasAVD, whether for the app itself or for anyone signing in to it, so nothing can use it to reach your directory or subscription.
RG=atlas-avd   # your Atlas resource group, if you renamed it

# 1. Stop the Atlas web app
APP=$(az webapp list -g "$RG" --query "[?starts_with(name,'atlasavd-app-')].name | [0]" -o tsv)
az webapp stop -g "$RG" -n "$APP"

# 2. Disable the AtlasAVD enterprise application (service principal)
SP=$(az ad sp list --filter "displayName eq 'AtlasAVD'" --query "[0].id" -o tsv)
az ad sp update --id "$SP" --set accountEnabled=false

Tokens Microsoft Entra issued before you disabled the app stay valid until they expire, usually within about an hour. Stopping the web app first is what makes the cut-off immediate. In Azure Government, run az cloud set --name AzureUSGovernment first.

What keeps running, and what stops

  • Keeps running: your Azure Virtual Desktop environment. Host pools, session hosts, application groups, workspaces, images and FSLogix profiles are native Azure resources and don't depend on Atlas.
  • Stops: everything Atlas does for you, including autoscale and power schedules, alerts and notifications, Atlas Advisor, and the Atlas console. Session hosts stay in whatever power state they are in.
  • Atlas Reach agents stay installed on your devices but can't reach Atlas. Atlas Ink signatures already in your users' mailboxes stay as they are, and no mail ever flows through Atlas.
  • Your Azure bill: the App Service plan, database and other Atlas resources are still billed while the web app is stopped. To end those charges, remove Atlas completely.
  • Your Atlas subscription: disconnecting doesn't cancel it. To cancel, see the offboarding guide or email support@atlasavd.com.

Reconnect when you're ready

  1. In the Microsoft Entra admin center, open Enterprise applications → AtlasAVD → Properties, set Enabled for users to sign-in? to Yes, and click Save.
  2. In the Azure portal, open the Atlas App Service and click Start. Atlas picks up where it left off. The first start can take a few minutes.
az ad sp update --id "$SP" --set accountEnabled=true
az webapp start -g "$RG" -n "$APP"

Go further: take back the permissions too

Disabling the app blocks it without changing what it was granted. If your policy calls for removing the grants as well, while keeping the deployment:

  • Azure roles: remove the AtlasAVD service principal's role assignments on each subscription. Step 5 of the offboarding guide has the commands. To grant them again later, run the setup script again; it updates the same registration.
  • Directory roles: in the Microsoft Entra admin center, go to Roles & admins and remove AtlasAVD from Exchange Administrator and Compliance Administrator (or from Global Reader, after a read-only setup).
  • Credentials: in App registrations → AtlasAVD → Certificates & secrets, delete its client secrets. Atlas then cannot sign in as AtlasAVD at all. Reconnecting after that needs a new secret, so contact support@atlasavd.com when you want to come back and we'll walk you through it.

Confirm it's disconnected

  • The Atlas App Service shows Stopped in the Azure portal, and your Atlas address no longer opens Atlas.
  • AtlasAVD shows Enabled for users to sign-in? set to No under Enterprise applications.
  • If your Microsoft Entra license includes sign-in logs, go to Sign-in logs → Service principal sign-ins and filter by AtlasAVD. After you disable it, no new successful sign-ins appear.
  • Your subscription's Activity log shows no new operations by AtlasAVD.

Atlas Advisor is read-only: it can't change anything

Disconnecting isn't the only safeguard. Atlas Advisor, the AI assistant built into Atlas, reads your environment and never changes it. That holds in every setup, full access or read-only.

  • It answers questions and recommends fixes using read-only lookups, and only from data the person asking is already allowed to see.
  • It can draft steps or a script for you to review and copy. It never runs, saves or sends anything itself.
  • There is nothing to approve, for one action or for a whole conversation, because Advisor has no way to carry out a change. Someone on your team makes the change in Atlas AVD with their own permissions, and it is recorded in the activity log like any other change.
  • Advisor sends your question and the results of its lookups only to the AI provider you connect, straight from your deployment. With no provider connected, nothing leaves your deployment. Disconnecting Atlas stops Advisor too.

You choose what Advisor may send to your AI provider. See Privacy: what leaves your tenant in Getting Started with Atlas Advisor.

MSPs: disconnect one customer tenant

Each customer tenant you manage from Atlas Command connects through its own AtlasAVD app registration, or enterprise application, in that customer's directory. To disconnect one customer, disable AtlasAVD in that customer's directory as shown above. Your Atlas deployment and your other customers are not affected. Customers can do this themselves, in their own directory, without the MSP.

Done when: the Atlas web app is stopped, AtlasAVD is disabled in Enterprise applications, and no new AtlasAVD sign-ins appear. Questions? support@atlasavd.com.

Next steps