What users see
Users sign in with their Microsoft work account and land on My Desktops. Atlas Smart Connect puts the best desktop for them right now at the top, with a Connect Now button, the reasons it was picked and an Atlas Confidence score; the rest are listed under Other Available Desktops with latency, available sessions and load. Connect opens the user's default client, and the arrow beside it offers the Windows App or the browser instead. The sidebar also has Recent Sessions, Recovery (quick fixes when a connection fails), My Vault (the user's personal Atlas Vault), Security (their sign-in methods) and Preferences, where each user sets their language, timezone, default connection method and whether desktop health details are shown.
Turning the portal on or off
Two independent switches must both be on for a tenant's portal to be reachable, and both are on by default. If Atlas cannot read a switch, the portal is treated as off:
- The tenant-level End User Portal switch, set during the first-run wizard's Premium step ("Enable the End User Portal") and changed later from the End User Portal row in Settings → Configuration Matrix. Turning it off closes the portal for that tenant; only administrators can use Atlas AVD.
- For each managed tenant, the Enable User Portal switch on the tenant's page (Administration → Tenants → Tenant List, then open the tenant), so an MSP can offer the portal to some customers and not others.
The Premium toggles are opt-outs, never force-enables: leaving a service on inherits your subscription's defaults and entitlements, and switching it off records a tenant-level opt-out you can reverse later.
The least-privilege security model
The portal is deliberately the least-privileged surface in Atlas:
- Portal users are added automatically on first sign-in with the Portal User role, which holds no administrative permissions. A Portal User who tries to sign in to the admin console is refused with "This account is not authorized".
- Portal sessions are pinned to their tenant. A portal user cannot switch their session to another tenant, and an unknown tenant ID shows "portal unavailable" rather than revealing whether the tenant exists.
- Users only ever see desktops assigned to them through your existing AVD application-group assignments; the portal grants no new access to resources.
Sign-in URLs
Users can start at <your-app-url>/portal and enter their work email; Atlas takes them to their own organization's sign-in. Each managed tenant also has its own direct link, shown as Portal login on the tenant's page (and as User Portal URL under Manage on the Tenant List), ready to copy and share. Sign-in through a tenant's link authenticates against that tenant's own app registration, which needs the <your-app-url>/auth/callback reply URL. Atlas registers it automatically at first start and when the setup wizard finishes.
If portal sign-in for a tenant fails with AADSTS500113 (no reply address registered), the reply URL is missing: the tenant's page shows the exact address to add under the tenant app registration's Authentication > Web > Redirect URIs, or re-run the setup script so Atlas can register it itself.
How portal usage is billed
The portal is included on every plan and metered by use: one unit is one distinct user with at least one portal sign-in in a calendar month (UTC), counted once no matter how many times they connect. Units come first from your plan's pooled monthly allowance, the same pool Atlas Ink draws on. The Community plan caps portal usage at 10 active users per month; paid plans have no active-user limit, only your unit balance. A user turned away at the cap is never billed. If your unit balance runs out, new portal users see "Usage Allowance Used Up" until units are added (see Buying More Units).