Scoped roles
Five roles from viewer to owner, assignable to a person or team on a connection, subscription, resource group or single host pool.
Enterprise · Azure · Early access
A product we build and operate: a hosted console for Azure Virtual Desktop. Help desk and business teams manage sessions on the host pools they own, with scoped roles and a full audit trail.
The challenge
Clearing a stuck Azure Virtual Desktop session normally needs a privileged Azure role or a ticket to IT. Organisations wanted first-line staff and business teams to act on their own host pools without either.
The product had to be safe by default: least privilege, encrypted customer secrets, scope enforcement on every request and a record of every action.
What we built
Five roles from viewer to owner, assignable to a person or team on a connection, subscription, resource group or single host pool.
Message, disconnect and log off users across pools in one view, with destructive actions confirmed first.
The system validates customer Entra apps before storage. Secrets use AES-256-GCM encryption. The API never returns them.
The system records every action with the actor, the user and the host pool. You can export records for audit.
What it taught us
Enforcing scope on the server, not just hiding controls in the interface, makes delegation safe.
Audit trails and clear roles shortened every security conversation.
More work

A live product we build and run: SEMH provision software that schools use every day. Pupils check in without a password, staff log a session in under twenty seconds, and the SENCO keeps a proper record.

A live product we build and run: support-staff rota software for schools. Staff plan duty and lesson cover on a live board. The system publishes to staff and produces a PDF the same morning.
Want something similar for your organisation? Custom software development
Free 30-minute call
Thirty minutes with the engineer who would build it. No salesperson. No slides. You get a straight answer on whether AI is the right fix.