Before you begin
- An administrator account in Atlas AVD, for the exports and for cancelling
- Owner, or Contributor plus User Access Administrator, on the Azure subscription Atlas is deployed in
- A Global Administrator or Privileged Role Administrator in Microsoft Entra, to remove directory roles and the app registration
- Exchange Online administrator access, if you used Atlas Ink
- Azure Cloud Shell (Bash) or the Azure CLI, for the optional commands
What stays, what goes
Atlas manages your Azure Virtual Desktop environment in place; it does not host it. Your host pools, session hosts, application groups, workspaces, images, compute galleries, FSLogix profile shares, and networks are native Azure resources, and they keep running after Atlas is gone. What you remove is Atlas itself:
- The Atlas resource group in your subscription (the app, its database, Key Vault, monitoring, and App Attach storage)
- The Azure role assignments and the custom role Atlas was granted
- The AtlasAVD app registration, its enterprise application, and its directory roles
- Anything Atlas Ink configured in Exchange Online, and the Atlas Reach agent on your endpoints
Do Steps 1 to 3 before your subscription ends. When the license lapses the Atlas console locks, and exports, Atlas Ink, and Atlas Reach are no longer available. A cancelled paid subscription ends on its end date with no grace period.
Step 1: Export your data
Everything Atlas stores is in the PostgreSQL database in your own resource group, so the data is already yours. Take a portable copy before you delete anything:
- Open Administration → Platform → Backup & Restore. Under Generate backup, choose a scope (All tenants is available to platform administrators and covers every managed tenant), turn on Encrypt with password if you want the file protected, keep every module ticked, and click Generate backup.
- When it finishes, click Download backup and store the .atlasbackup file somewhere you control. It is a ZIP of your configuration, host pools, deployments, automations, audit logs, activity and alerts, with a SHA-256 checksum per file. Secrets are never included; Vault entries are exported as metadata only.
- Open Audit in the sidebar's Security section and use the Export menu to save the audit trail as CSV, XLSX, or PDF, if your records policy needs it in a readable format.
- Export anything else you keep only in Atlas: Atlas Ink signature templates (the Templates tab exports them all as a JSON backup file), and documents and passwords stored in Atlas Vault. Vault secrets are not in the backup, so copy any you still need into your own password manager or Key Vault.
Backup files are deleted from Atlas 24 hours after they are created, and they are stored on the Atlas App Service, which you delete in Step 6. Download each backup as soon as it is ready.
Step 1 (optional): Raw database copy and API export
- Raw database: the database is the atlasavd database on the PostgreSQL flexible server named atlas-pg-<suffix> in the Atlas resource group. If your policy calls for a raw copy, take one with your own tools (for example pg_dump) before Step 6. Deleting the server deletes the database.
- API export: administrators can also download a JSON snapshot of one tenant's operational data (host pools, session and connection history, cost snapshots, activity, alerts, scripts, and more) from GET /api/organization-tenants/{id}/export. Secrets are redacted and each table is capped at 10,000 rows, so use Backup & Restore for a complete export.
Step 2: Prepare your AVD environment to run without Atlas
Your desktops keep working without Atlas, but anything Atlas was doing for you stops when it goes. Before you cancel:
- Scaling and power: Atlas autoscale, power schedules, and Adaptive Density run in Atlas, not in Azure, so session hosts stay in whatever power state they are in when Atlas stops. Set up an Azure Virtual Desktop scaling plan, or turn on Start VM on Connect, for each host pool that needs one.
- AVD Insights: if you turned on AVD Insights from Atlas, your host pools have a diagnostic setting named atlas-avd-insights (or VD_Atlas on host pools Atlas created), and each host pool's resource group has a data collection rule named atlas-avd-insights-<region> associated with its session hosts. They send data to the Atlas Log Analytics workspace, which is deleted in Step 6. Re-point them at a workspace you keep, or delete them.
- Conditional Access: policies you created or imported through Atlas are ordinary Microsoft Entra policies. They keep enforcing after Atlas is removed. Review them in the Entra admin center and keep, change, or delete each one.
- Credentials: if Atlas holds the only copy of a credential you need, such as a session host local administrator password or an item in Atlas Vault, copy it out now.
Step 3: Clean up Atlas Ink and Atlas Reach
Do this while your subscription is still active. Both need the Atlas console.
- Atlas Ink stamping: if you turned on Stamp signatures server-side (opt-in), turn it off. Atlas removes the Exchange mail-flow rule Atlas Ink managed signature stamping and the mail-enabled group Atlas Ink stamp-mode users. A billing lapse does not remove them, so if they are still there later, delete both in the Exchange admin center.
- Atlas Ink signatures: signatures Atlas pushed stay in your users' mailboxes after you leave, and users can edit them as usual. To put back the signatures users had before Atlas, remove their assignments and run Provision users for them while you are still subscribed: Atlas restores the original it saved, or clears the managed signature if there was none.
- Atlas Reach: revoke or delete each device on the Devices tab, then uninstall the agent from every endpoint and session host. Uninstall the Atlas Reach Agent has the commands for Windows, macOS, and Linux, including what the uninstallers keep on purpose. After a lapse the agents stay installed but can no longer reach Atlas.
Step 4: Cancel your subscription
- Open Administration → Platform → License Overview and click Cancel subscription. It opens the Atlas plan picker.
- Click Cancel subscription, then Cancel at end of billing period. Your plan stays active until the end of the period you have paid for, and you can click Resume subscription any time before then.
- Prepaid plans paid by invoice: there is nothing to cancel. Leave the renewal invoice unpaid and the subscription ends at the end of its term, or tell support@atlasavd.com and we will confirm the end date.
- Licenses bought outside Atlas (BYOL): contact support@atlasavd.com.
- Trials: there is nothing to cancel. When the trial ends without a plan, the console locks in the same way.
Only using an add-on, or want to keep Atlas around without paying? Downgrade to Community (free) in the plan picker keeps the deployment running instead of locking it.
What cancellation does, and what it doesn't
- On the end date the license lapses and the Atlas console locks. Every page shows a lock screen; only licensing and software updates stay reachable.
- Nothing in your Azure subscription or your Microsoft Entra directory is deleted. Host pools, session hosts, and settings are untouched, and Atlas picks them back up if you choose a plan again.
- The Atlas resources in your subscription keep running, and keep appearing on your Azure bill, until you delete them in Steps 5 to 7.
- We email you to confirm the end date.
Step 5: Remove Atlas's Azure role assignments and custom role
Atlas was granted Azure roles at subscription scope in two places: its App Service's managed identity, and the AtlasAVD app registration's service principal. Remove them before you delete the resource group, while the managed identity still exists to look up (Azure does not remove role assignments when an identity is deleted; they stay behind as Identity not found). Atlas also created one custom role, Atlas AVD Resource Group Operator (<your subscription ID>). In Cloud Shell (Bash), from the subscription Atlas is deployed in:
SUB=$(az account show --query id -o tsv)
RG=atlas-avd # your Atlas resource group, if you renamed it
# The Atlas web app's managed identity, and the AtlasAVD service principal
APP=$(az webapp list -g "$RG" --query "[?starts_with(name,'atlasavd-app-')].name | [0]" -o tsv)
MI=$(az webapp identity show -g "$RG" -n "$APP" --query principalId -o tsv)
SP=$(az ad sp list --filter "displayName eq 'AtlasAVD'" --query "[0].id" -o tsv)
# Review what each one holds
az role assignment list --assignee "$MI" --all -o table
az role assignment list --assignee "$SP" --all -o table
# Remove their subscription-scope assignments
az role assignment delete --assignee "$MI" --scope "/subscriptions/$SUB"
az role assignment delete --assignee "$SP" --scope "/subscriptions/$SUB"
# Remove the Atlas custom role (its name carries your subscription ID)
az role definition delete --name "Atlas AVD Resource Group Operator ($SUB)"Assignments on resources inside the Atlas resource group (on the web app, Key Vault, and App Attach storage) go with the resource group in Step 6. Leave the role assignments in your host pool resource groups, such as Desktop Virtualization User on application groups and Virtual Machine User Login: your users need them to keep connecting. In Azure Government, run az cloud set --name AzureUSGovernment first.
Step 6: Delete the Atlas resource group
The Atlas deployment lives in one resource group, atlas-avd unless you named it otherwise when you deployed. The <suffix> is the same eight characters on every resource. It contains:
- App Service plan atlasavd-plan-<suffix> and App Service atlasavd-app-<suffix> (unless you deployed onto an App Service plan you already had; that plan is yours to keep or delete)
- Azure Database for PostgreSQL flexible server atlas-pg-<suffix>
- Key Vault atlas-kv-<suffix>
- Log Analytics workspace atlas-la-<suffix> and Application Insights atlas-ai-<suffix>
- The App Attach storage account (atlasaa followed by letters and numbers), if Atlas created one. Copy out any MSIX packages you still use first.
- If you chose them at deployment: the private endpoints and privatelink DNS zones for the database and Key Vault, and the managed certificate for a custom domain
az group delete --name atlas-avd --yes
# Key Vault keeps a deleted vault for 7 days. To remove it now (for example,
# to redeploy later with the same name), purge it:
az keyvault list-deleted --query "[?starts_with(name,'atlas-kv-')].name" -o tsv
az keyvault purge --name atlas-kv-<suffix>Deleting the resource group deletes the database and every backup still stored on the App Service, and cannot be undone. Make sure Step 1 is done. If you deployed Atlas into a resource group that also holds other resources, delete the Atlas resources one by one instead of the group.
Custom domain DNS records
If you gave Atlas a custom domain, remove its records at your DNS provider: the CNAME (or, for an apex domain, the A record) that pointed at atlasavd-app-<suffix>.azurewebsites.net (azurewebsites.us in Azure Government), and the TXT record at asuid.<your domain>.
Step 7: Remove the AtlasAVD app registration and its directory roles
The control plane never deletes the AtlasAVD app registration, whether it was created during guided setup or by the setup script. Remove it yourself in the Microsoft Entra admin center (entra.microsoft.us in Azure Government):
- Go to Roles & admins, open Exchange Administrator, select AtlasAVD on the Assignments list, and click Remove assignments. Do the same for Compliance Administrator, and for any other directory role you granted it.
- Go to App registrations → All applications, open AtlasAVD, and click Delete. This also removes its enterprise application (service principal) in your directory and invalidates its client secrets. Entra keeps it under Deleted applications for 30 days, where you can Permanently delete it sooner.
- Go to Enterprise applications and check for the setup app: Atlas AVD Provisioning (AtlasAVD-Provisioning-GCC or AtlasAVD-Provisioning-GCCH in government clouds). Guided setup removes it automatically when it can. If it is still listed, open it, go to Properties, and click Delete.
# Or from Cloud Shell, after Step 5 (deleting the app also removes its service principal)
APP_ID=$(az ad app list --filter "displayName eq 'AtlasAVD'" --query "[0].appId" -o tsv)
az ad app delete --id "$APP_ID"Used Atlas Ink? Atlas Ink asked you to turn off Outlook roaming signatures. If you want Outlook to manage roaming signatures again, an Exchange administrator can run Set-OrganizationConfig -PostponeRoamingSignaturesUntilLater $false in Exchange Online PowerShell.
MSPs: each customer tenant cleans up its own directory
Each customer tenant you managed from Atlas Command was connected with its own AtlasAVD app registration, credentials, and role assignments in that customer's directory and subscription. Deleting your own Atlas deployment does not touch them. For every managed customer tenant, repeat these steps in that tenant (you, with the customer's admin access, or the customer):
- Step 3 for any Atlas Ink stamping rule and Atlas Reach agents in that tenant
- Step 5 for the AtlasAVD service principal's role assignments and the Atlas custom role in each of that customer's subscriptions (there is no Atlas managed identity or resource group in a customer tenant)
- Step 7 to remove the directory roles and delete the AtlasAVD app registration, or its enterprise application if the app was registered in another tenant
If you are a customer leaving an MSP, ask your MSP for the export in Step 1, then delete the AtlasAVD enterprise application and its role assignments in your own directory and subscriptions yourself. You do not need the MSP for that.
What the Atlas control plane keeps
The Atlas control plane (controlplane.atlasavd.us) holds your account and billing records, never your AVD workloads, desktops, or user content. Once you leave, it keeps them for these periods (the Privacy Policy has the full retention schedule):
- Account and subscription record (organization, contacts, Microsoft Entra tenant ID, plan history): the life of the subscription plus 7 years
- Billing and payment records: 7 years, as tax and financial law requires. Card and bank details are held by our payment processor, Stripe, not by Atlas.
- Usage reports used for billing: 25 months
- Control plane activity logs: 90 days
- Support conversations: 3 years after the ticket closes
- Your acceptance of the Terms of Service, and a record that your tenant has used its free trial
Requesting deletion
To have us delete the data we hold sooner, email privacy@atlasavd.com from an administrator's address with your organization name and Microsoft Entra tenant ID. We delete or return it as set out in our Data Processing Addendum, except records the law or the agreement requires us to keep (billing and payment records, your Terms of Service acceptance, and the trial record), and copies in routine backups, which age out in the normal backup cycle.
Done when: the Atlas resource group is gone, az role assignment list shows nothing for AtlasAVD, the custom role is deleted, AtlasAVD is gone from App registrations and Enterprise applications, no endpoint runs the Atlas Reach agent, and the Atlas Ink stamping rule is gone from Exchange. Questions? support@atlasavd.com.