Documentation

Last updated: 6 July 2026

Sandman shuts down Azure virtual machines when nobody needs them. Users get a Microsoft Teams message before their machine stops and can postpone with one click. You save money; nobody gets interrupted.

This page walks you through getting Sandman running.

How it works

  1. Schedule — an admin sets shift start and end times for each VM in the dashboard.
  2. Notify — when a shift ends, the VM’s owner gets a Teams message: “Can we stop your machine?”
  3. Postpone — need more time? One click keeps the VM running for 1–3 more hours.
  4. Save — the VM shuts down and the savings show up on the dashboard.

Sandman runs on a single small VM inside your own Azure subscription. Your data never leaves your environment.

Before you start

You’ll need three things. Your Azure admin can prepare them in about 15 minutes:

  • An Azure subscription where your VMs live, and permission to create a new VM in it.
  • A Microsoft Entra ID app registration — this is how Sandman signs users in and reads your VM list. You’ll copy a few IDs from the Azure Portal into the setup wizard.
  • An SSH key — Azure asks for one when creating the VM (passwords are disabled for security).
For IT admins: exact permissions
  • Azure RBAC: Virtual Machine Contributor at subscription scope, so Sandman can list, start, and stop VMs.
  • Microsoft Graph (application): User.ReadBasic.All with admin consent, for syncing directory users.
  • Sign-in (delegated): openid, profile, email, User.Read; redirect URI https://<your-host>/auth/callback.
  • Groups claim in the ID token, so Sandman can map Entra groups to the admin role.
  • Teams notifications: a Logic App (or Power Automate flow) with an HTTP trigger; you paste its URL into the wizard.

Step 1 — Install from the Azure Marketplace

  1. Find Sandman in the Azure Marketplace and click Create.
  2. Pick your plan: Startup (up to 10 scheduled VMs), Scaleup (up to 50), or Corporate (unlimited).
  3. Fill in the usual VM details — resource group, region, and your SSH key.
  4. Enter the IP addresses (yours and your team’s) that should be allowed to reach the web dashboard. Keeping this list short keeps the appliance safe.
  5. Click Create and wait a few minutes for Azure to finish.
For IT admins: what the template deploys
  • One VM on Azure Linux 3 (ARM64) with a locked-down network security group: HTTPS 443 from your allowed ranges, SSH 22 from admin ranges only, everything else denied.
  • A separate data disk for the database and application state — this disk survives VM replacement and plan upgrades.
  • A system-assigned managed identity with Virtual Machine Contributor, so Sandman can manage VMs without storing extra credentials.
  • Setup wizard port 8091 stays closed unless you explicitly allow it during setup or maintenance.

Step 2 — Run the setup wizard

Open the VM’s address in your browser. On a fresh install, Sandman automatically takes you to Sleepwalker, its guided setup wizard. It asks for:

  • Your Azure IDs (tenant, subscription, and the app registration details from “Before you start”)
  • The web address (hostname) where your team will reach Sandman, and how to get its HTTPS certificate — automatic via Let’s Encrypt, or upload your own
  • Which Entra groups count as Sandman admins
  • Your Teams webhook URL, if you want shutdown notifications (recommended)

When you finish, the wizard switches itself off and hands over to the main dashboard. That’s it — you’re running.

For IT admins: what happens under the hood
  • First boot prepares the data disk, PostgreSQL, and the session store before the wizard opens.
  • The wizard writes /etc/sandman/config.yaml, configures the Caddy reverse proxy and TLS, sets initialized: true, and enables the main service.
  • Sleepwalker is disabled in normal operation. For maintenance, SSH to the host, run sudo sandman config enable, allow port 8091 to your IP, then run sudo sandman config disable when finished.
  • Logs live in /var/log/sandman/.

Step 3 — Everyday use

  • Sign in with your normal Microsoft account — no separate password.
  • Sync your VMs from the dashboard; Sandman finds every VM in the subscription.
  • Assign owners and shifts — pick who uses each VM and when their workday ends.
  • Toggle scheduling per VM. Machines without a schedule are never touched.
  • Watch the savings add up on the dashboard.

Restricted or offline networks

Sandman is self-hosted, so it works well in locked-down environments. Keep in mind:

  • If the appliance can’t reach Let’s Encrypt, upload your own HTTPS certificate in the wizard instead.
  • Sandman still needs to reach Azure’s management API to start and stop VMs (public endpoints or your private ones).
  • Teams notifications need outbound HTTPS to your Logic App URL — skip them if that’s not possible.
  • Updates can be installed from local media or an internal package mirror; direct internet access is not required.

Updates & changing plans

  • Regular updates are standard package updates — install, then check the dashboard is healthy.
  • Changing plan tier (say Startup → Scaleup): deploy a fresh Sandman VM on the new plan and re-attach your existing data disk. Your settings, schedules, and history carry over. Contact support if you’d like a hand.

Need help?

Email support@yourcloudtools.com — include your Sandman version and plan, and describe what you expected vs. what happened. Details on response times are on the Support page.

© 2026 Sandman