Now onboarding design partners
Run more Citrix® and Azure Virtual Desktop seats per engineer
Sessionwright is an AI admin agent for MSPs that run Citrix, NetScaler® and Azure Virtual Desktop for their customers. One console across tenants, Azure Lighthouse onboarding and white-label reports, at wholesale prices. Your engineers approve every change.
Your team
One console for every tenant. Approvers and change windows set per tenant.
Azure Virtual DesktopTenant A
Lighthouse delegationConsented appOwn runner
Citrix DaaS and NetScalerTenant B
Runner in customer networkOutbound only
Citrix Virtual Apps and DesktopsTenant C
Own runnerRead-only to start
Findings, reports and audit logs stay in your environment and your customers'. None of it reaches Sessionwright.
Your margin depends on engineer hours
Managed Citrix and AVD works well until every tenant needs the same checks, done by hand, by the few people who know how.
Margin per seat
The pressure
Each new tenant adds daily health checks, patch weeks and monthly reports. When that work grows with engineer hours, margin per seat shrinks as you grow.
What Sessionwright changes
The agent runs the checks for every tenant and drafts the plans. Your engineer reviews and approves, instead of collecting data by hand.
Scarce Citrix and NetScaler skills
The pressure
Senior Citrix and NetScaler engineers are hard to hire and expensive to keep. When a gateway CVE lands, every customer needs them on the same day.
- Talent.com lists an average US Citrix engineer salary of $127,750 a year. Source: Talent.com
- UK permanent roles that cite NetScaler advertise a median salary of £77,500 (six months to 15 October 2026). Source: ITJobsWatch
What Sessionwright changes
The rule engine carries the checklists your best engineer would run. Nightpatch drafts an HA-aware upgrade plan per tenant, and your team approves each one in that customer's change window.
Inconsistent quality between engineers
The pressure
Two engineers review the same estate and find different things. Reports vary with whoever wrote them.
What Sessionwright changes
Every tenant gets the same rules, the same evidence and the same report format. Each finding names the rule that raised it and the data behind it.
Every tenant in one view, each one kept apart
Your engineers work every customer from one console. Each customer environment gets its own runner, its own credentials and its own approvers.
In this version, customer data stays in your environment and your customers'. None of it reaches Sessionwright.
One console across tenants
Findings, open plans and pending approvals for every customer, side by side. Move from one tenant to the next without switching tools or directories.
A runner per customer environment
Each customer gets its own runner, a Windows service or a container. It makes outbound connections only, and its credentials stay in that environment.
Per-tenant isolation
Snapshots, findings, reports and audit logs are kept per tenant. One customer's data never appears in another customer's report or chat.
Approvals per tenant
Each tenant has its own approvers and change windows. An approval is signed for one plan in one tenant and cannot be reused anywhere else.
Azure Lighthouse onboarding for AVD
Azure Lighthouse lets a customer delegate subscriptions or resource groups to your tenant. Your engineers and the Sessionwright runner then work from your own tenant, without switching directories.
Microsoft does not charge extra for Lighthouse. Customers choose exactly what they delegate, can see your actions in their activity log, and can remove access at any time.
Source: Azure Lighthouse overview (Microsoft Learn)
Onboarding an AVD tenant
- 1The customer's subscription Owner deploys one Lighthouse template. It starts read-only.
- 2The customer's admin consents to a multi-tenant Microsoft Entra app for the reads Lighthouse cannot do.
- 3An optional one-time customer template grants the few roles Lighthouse cannot assign.
- 4The runner starts a read-only assessment of the tenant.
Where Lighthouse stops, and how we cover it
| Lighthouse limit | How Sessionwright covers it |
|---|---|
| Built-in Azure roles only. No custom roles and no Owner. | We use least-privilege built-in role sets. The agent's own action catalog is the inner limit on what it will do. |
| Azure Resource Manager only. No Microsoft Graph, Entra ID or Intune. | A multi-tenant app that each customer's admin consents to handles Graph reads. The customer can revoke it at any time. |
| No role assignments, so no assigning users to application groups. | Entra groups are assigned to application groups once at onboarding. Membership is then managed through Graph. |
| Cannot grant the AVD service principal the role that autoscale and Start VM on Connect need. | The one-time customer template includes that role, deployed by the customer's Owner. |
| No roles with data actions, so no direct access to FSLogix profile shares. | FSLogix checks run in-guest from a fixed, read-only script catalog. Each run needs an approval. |
| Cross-tenant Cost Management works only for CSP partners. | The consented app can be given Cost Management Reader, or the agent estimates cost from Azure retail prices and inventory. |
Source: Tenants, users and roles in Azure Lighthouse (Microsoft Learn)
Citrix and NetScaler tenants
Lighthouse covers Azure only. For Citrix Virtual Apps and Desktops, Citrix DaaS and NetScaler ADC and Gateway, the same customer-hosted runner sits inside each customer network. It calls the documented vendor APIs, starts read-only and connects outbound only. Approvals, audit logs and reports work the same way on every platform.
Reports with your name on them
Your customers buy from you. The reports they read should say so.
White-label reports
Assessment reports, digests and upgrade evidence packs carry your company name and logo. Your engineer presents the readout. White-label reports are included in the platform fee.
- Findings with the evidence behind each one
- The same format for every tenant and every engineer
- Plans and approvals recorded with the names of your approvers
Wholesale assessments
Buy Drop-in Assessments at a wholesale price, deliver them under your brand and charge your customer what you choose. The scope and report match our direct assessment.
- Your price from us
- $750 (AVD) / $1,500 (Citrix + NetScaler)
- Our direct list price for the same scope
- $2,500 (AVD) / $4,500 (Citrix + NetScaler)
The MSP price sheet
A platform fee, then seats for the users you manage. Prices are in US dollars.
| Item | Price | Notes |
|---|---|---|
| Platform fee | $500/mo | Multi-tenant console, Azure Lighthouse onboarding, white-label reports included |
| Advisor seats | $1.00 per managed user per month | $0.75 above 5,000 users |
| Operator seats | $2.50 per managed user per month | $2.00 above 5,000 users |
| Nightpatch | $60 per NetScaler instance per month | |
| Wholesale assessments | $750 (AVD) / $1,500 (Citrix + NetScaler) | You resell at your own price |
Partner pilot: two tenants free for 60 days, then the MSP price sheet. Prices last checked 2026-10-15.
See direct pricingPartner pilot: two tenants free for 60 days
Sessionwright is early. We are onboarding our first MSP design partners now, and we are shaping the multi-tenant console and white-label options with them.
Pilots are read-only. No write actions run in a customer environment until our insurance is bound.
- 1
A 30-minute call
We agree which two tenants to start with and what a good result looks like for you.
- 2
Onboarding
AVD tenants through the Lighthouse template and app consent. Citrix and NetScaler tenants through a runner in the customer network.
- 3
Read-only assessments
Both tenants get a full read-only assessment and a white-label report you can share with the customer.
- 4
Day 60
Move to the price sheet, or stop. Stopping means removing the delegation and the app consent, and uninstalling the runners.
Questions
Does customer data reach Sessionwright?
No. In this version the runner works inside each customer environment, and findings, reports and audit logs stay there or with you. Chat calls a model endpoint that you choose, under your own agreement with the model provider.
Do we have to use Azure Lighthouse?
No, but it is the simplest path for AVD and Microsoft does not charge extra for it. A customer who prefers not to delegate can consent to the app and assign roles with a template instead. Citrix and NetScaler tenants do not use Lighthouse at all: they use a runner in the customer network.
Do our engineers still make the changes?
Your engineers stay in charge. Sessionwright takes the repetitive checks, the data collection and the first draft of each plan. Your engineers decide, approve each plan in the customer's change window, and handle the work that needs judgment.
What happens after the 60-day pilot?
You move the two tenants, and any others you add, to the MSP price sheet, or you stop. To stop, customers remove the Lighthouse delegation and the app consent, and you uninstall the runners.
Is Sessionwright SOC 2 certified?
Not yet. SOC 2 is on the roadmap. Until then, the architecture keeps customer data out of our hands: the runner lives in the customer environment, connects outbound only, and credentials never leave that environment.
Talk to us about the partner program
Tell us how many tenants you run and on which platforms. A person replies, normally within one business day, to set up a 30-minute call.
Prefer email? hello@sessionwright.com