The architecture at a glance
The Atlas web app (an Azure App Service in your subscription) starts every licensing call. It calls out over HTTPS to controlplane.atlasavd.us and authenticates with your deployment's registration token, a credential issued when your deployment was set up and stored in your subscription. The control plane answers with your license, signed by Atlas.
The control plane holds no standing access to your subscription or your Microsoft Entra directory. It reaches your deployment for only two things: a short refresh nudge after your plan changes, and a health check when the Atlas team runs one.
What your deployment sends
Each call carries only what licensing needs:
- Registration, at startup: your deployment's ID, its web address and the Atlas version it runs. This is how the control plane links your deployment to your subscription.
- Heartbeat, every 5 minutes: the deployment ID, the version, whether the app is healthy, and, with MSP Capabilities, how many tenants the deployment manages (MSP Capabilities are priced per managed tenant). If you have opted in to sharing your cost savings for the counter on atlasavd.com, the heartbeat also carries that one total. Withdraw consent and only the opt-out is sent.
- License check, every 15 minutes, at startup, and whenever an administrator clicks the Sync plan (refresh) button on the Licensing page: a request for your current license. It sends nothing about your environment.
- Usage counts, for usage-based add-ons such as the User Portal, Atlas Ink, Atlas Reach and Atlas Spool: the number used in a period, per account. Accounts are identified by an internal number, never by name, and no user names or email addresses are sent. Each report is numbered and signed, so a missing report shows up as a gap.
- Trial start and terms acceptance: the date your trial began and when the license terms were accepted, so the trial clock cannot be reset.
- Plan links and quote requests, only when an administrator clicks Choose a plan, Add units or Request a quote. The control plane returns a one-time link to its plan picker, where every purchase is paid through Stripe Checkout.
None of these calls carries your desktops, session data, user content, Azure credentials or Microsoft 365 data. Those stay in your subscription.
How the license is protected
- Every license answer is signed by the control plane with an Ed25519 private key that never leaves Atlas. The Atlas web app checks the signature with the matching public key, which is built into the app, before it reads a single field.
- A public key can check a signature but cannot make one. Pointing the app at another server, or changing an app setting, cannot produce a license the app will accept.
- Atlas also stores the last signed answer exactly as it arrived and checks the signature again every time the license is read. Editing the license in the database cannot raise your plan or extend it.
When your plan changes
- An administrator buys a plan, changes plan or billing term, or adds units on the control plane's plan picker, and pays through Stripe Checkout.
- The control plane sends your Atlas web address a refresh nudge. The nudge tells Atlas to check its license now. It carries no license data itself.
- Atlas makes a license check straight away and applies the new signed license, usually within seconds.
- If the nudge cannot reach your deployment, for example because the web app only accepts traffic from your own network, the next heartbeat tells Atlas its license has changed, so the new plan arrives within about 5 minutes. You can also click Sync plan on the Licensing page.
If the control plane cannot be reached
A short outage changes nothing. Atlas keeps using the last signed license it received, and the next successful check brings it up to date.
Each signed license is valid offline for a limited time: 72 hours by default, set by the control plane and never more than 7 days. The clock runs from when Atlas signed the answer, so it cannot be wound back. If Atlas has had no newer answer by then, administrators see a screen saying the license cannot be verified, and Atlas unlocks again as soon as a license check succeeds. Software updates can still be applied from that screen.
Your desktops and users keep working throughout. Azure Virtual Desktop connections go through Microsoft's service and never pass through Atlas or the control plane.
What your network needs to allow
- Outbound HTTPS (port 443) from the Atlas App Service to controlplane.atlasavd.us. One control plane serves both Azure Commercial and Azure Government (GCC High) customers.
- No new inbound ports. The refresh nudge and health check arrive at your existing Atlas web address. If you restrict who can reach it, licensing still works: plan changes arrive with the next heartbeat instead of straight away.
Licensing calls in detail
For security reviews and firewall logs, these are the licensing requests and the direction each one travels. The deployment's calls send the registration token in the Authorization header; the setup calls run before that token exists and are rate-limited.
- Setup (deployment → control plane): POST /api/marketplace/bootstrap, /api/marketplace/register and /api/marketplace/ready, and POST /api/instances/register.
- Heartbeat (deployment → control plane): POST /api/instances/heartbeat, every 5 minutes.
- License (deployment → control plane): GET /api/license/state, every 15 minutes, with the signature in the X-License-Signature-Ed25519 response header. POST /api/trial/anchor and /api/license/terms-acceptance record the trial start and terms acceptance.
- Usage and billing (deployment → control plane): POST /api/marketplace/metering for usage counts, and POST /api/marketplace/plan-selection-link and /api/marketplace/plan-inquiry for plan links and quotes. The word marketplace in these paths is historical: Atlas does not use the Azure Marketplace, and Stripe is its only billing service.
- Refresh nudge (control plane → deployment): POST https://<your Atlas web address>/api/license/refresh-now, authenticated with the same registration token.
- Health check (control plane → deployment): GET https://<your Atlas web address>/health, with no credentials.