How Grok Bot Simplifies Security Checks and Investigations

A professional reviewing a laptop in a dim office, with teal and amber lighting

A Full Access grant on a mailbox is the kind of audit event that makes you sit up. Someone, or something, has just been given the right to open a mailbox and read what is in it. In an MSP or SMB tenant that is not a change you ignore. It is also, as I was reminded this week, the kind of change Microsoft’s own Exchange service can generate as routine maintenance. The hard part is telling those two things apart quickly, without handing extra privilege to the tool that is helping you look.

My read-only Microsoft 365 monitoring bot flagged a burst of mailbox changes at 6:02–6:03pm the previous evening, including a Full Access grant. It did not assume the worst, and it did not start changing anything in the tenant. It asked me a straight question: was that burst me, or a Copilot or agent test?

I had not made any mailbox changes. I told it to investigate further. What follows is how that investigation ran, what the issue turned out to be, and how you can set up a similar read-only check of your own.

Why audit noise is hard to work with

The Microsoft Purview unified audit log is one of the most useful tools in a Microsoft 365 tenant. It is also one of the noisiest. A genuine mailbox permission change sits in the same log as scheduled Microsoft maintenance, directory sync, and admin work you already know about. The record is often technically correct and still hard to read at a glance.

That problem is sharper for MSPs and smaller IT teams. An MSP is watching this pattern across many tenants, usually without a 24-hour security operations centre. An SMB often has one or two people who also run the rest of the environment. In both cases the failure modes are the same. You either spend the evening chasing a change that Microsoft already documented as normal, or you scroll past something that deserved a closer look.

Alerts do not solve this by themselves. An alert can tell you that a Full Access grant happened. It cannot tell you whether the actor was a person, an app you own, or Exchange doing maintenance. It also cannot tell you, in plain English, what was touched and what was not.

I already use Grok Bot for a morning brief of MSP news and security updates. That is a different job. Industry news will not investigate a change inside your tenant. For that, you need a bot with read-only access, a habit of asking you first, and a willingness to stop when it cannot see enough.

How Grok Bot helps

The value is not that the bot is cleverer than the audit log. The log already has the events. The value is the way the work is done:

  • It monitors in read-only mode, so a routine check cannot become a change in the tenant.
  • It asks the human first when something looks unusual, instead of guessing or firing a ticket.
  • It investigates on request, then reports findings in plain English.
  • It states gaps honestly. If it cannot confirm a permission is still in place, it says so, rather than quietly requesting more access for itself.
  • When more access is genuinely needed, the human grants it, after the bot has explained what it needs and what the trade-offs are.
  • It can pause for a safety check, including whether you are looking at the right tenant.

That last point matters more than it sounds. A useful investigation bot is sceptical, not eager.

A real investigation

The bot’s first message was the right one. It had seen a burst of mailbox changes at 6:02–6:03pm, including a Full Access grant, and it wanted to know whether that was me or a test.

Screenshot of a Grok Bot chat. The bot asks whether the 6:02–6:03pm mailbox change burst, including the FullAccess grant, was the author or a Copilot or agent test. The author replies that they made no mailbox changes and asks the bot to investigate further. The bot reports, read-only, that the changes were Exchange Online scheduled maintenance by the built-in NT SERVICE\MSExchangeAdminApiNetCore account on system mailboxes only, with a FullAccess grant to Discovery Management on the Discovery Search mailbox, and notes it could not yet confirm the grant is still in place.
My monitoring bot asked whether the mailbox change burst was me, then investigated read-only when I said it wasn’t.

I replied that I had made no mailbox changes the previous day, and asked it to investigate further.

It stayed read-only. The actor was not a user, and it was not one of my apps. It was Exchange’s built-in service account, NT SERVICE\MSExchangeAdminApiNetCore, running from inside Microsoft’s own servers. It had only touched Exchange’s built-in system mailboxes. No user mailbox was changed, and no forwarding was set.

The Full Access grant was also narrower than it first appeared. It gave the built-in Discovery Management role group access to the Discovery Search mailbox. That is Exchange’s eDiscovery role group, and Microsoft documents this permission as the default. The same pattern had already run about 20 times between 12 October and the day of the alert. It only looked suspicious because the audit record showed the account’s identifier rather than its name.

That reading matches Microsoft’s own documentation. In the audit log activities guidance, Microsoft says you may see NT SERVICE\MSExchangeAdminApiNetCore on mailbox permission events, that this is a system account in the Exchange service in the Microsoft cloud, and that a common audited activity is updating permissions on the Discovery Search mailbox to verify that Full Access — “which is the default” — is assigned to Discovery Management. If you want to check that kind of claim while you investigate, the Microsoft Learn connector in Grok Bot is the straightforward way to pull the official wording rather than relying on memory.

So the story in the audit log was already pointing to routine maintenance. There was still a gap.

Closing the last gap

The bot was honest about what it could not do. It could see the audit events, but the read-only app could not read current Exchange mailbox permissions, so it could not confirm the Full Access grant was still in place. It did not request extra permission for itself, and it did not grant itself any.

Instead, it explained the access it needed, and I granted it. That was the Exchange.ManageAsApp application permission, with admin consent, plus the Global Reader role.

This is where least privilege deserves a proper look. Exchange.ManageAsApp lets an app connect to Exchange Online PowerShell without a user sign-in, but it is not a blank cheque. Microsoft still requires an Entra role or an Exchange role group to decide what the app is allowed to do. Global Reader is a supported choice for that, and Microsoft describes it as the read-only counterpart to Global Administrator: it can read settings and administrative information across Microsoft 365 services, but it cannot take management actions.

It is still broader than this particular check required. In Exchange Online, Global Reader maps to the View-Only Organization Management role group, whose members can view the properties of any object in the organisation. If all you need is Exchange visibility, adding the app to View-Only Organization Management is the narrower path. Global Reader also grants read access across other Microsoft 365 admin centres. The bot pointed that alternative out. I chose Global Reader anyway, because I wanted the broader read-only view for this monitoring bot and I was the person granting it. The trade-off was explicit. That is the standard I want: the human decides, with the narrower option on the table.

There was one more useful pause. I sent a screenshot from the admin portal so the bot could see the consent and role grant. The header showed a name that made it stop and warn me I might be in the wrong tenant. It was actually this tenant’s display name. I would rather a bot hesitate over a familiar name than charge ahead in the wrong directory.

With the access in place, the bot connected app-only to Exchange Online PowerShell, ran only Get-* read cmdlets, and disconnected. It confirmed that Discovery Management still has Full Access on the Discovery Search mailbox. The permission is not inherited, and it is not a deny entry. That matches Microsoft’s documented default, and it was still in place after the maintenance. Nothing in the tenant was changed. The evidence was written to an investigation file with no secrets in it.

The outcome was straightforward: routine Exchange Online maintenance, no incident. It was all resolved the next morning, within minutes of the access being granted.

Example prompts

These are the kinds of prompts I would start with if you want the same behaviour.

Set the bot’s role:

You are a read-only Microsoft 365 security monitoring bot for an MSP. Watch the unified audit log for unusual mailbox permission changes, forwarding, and similar high-impact events. When you see something that looks unusual, ask me whether it was expected before you investigate. Stay read-only. If you hit a permission gap, tell me what you cannot see and what access would close that gap. Do not request or grant yourself extra permission.

Create a recurring check:

Create a routine called Mailbox permission watch. Every weekday at 8:15am Sydney time, search the unified audit log for mailbox permission changes since the last run, including Full Access grants and forwarding changes. If nothing material happened, tell me that in this chat and stop. If something looks unusual, summarise it in plain English and ask me whether it was expected before investigating further. Stay read-only.

When an alert appears:

I made no mailbox changes yesterday. Please investigate further. Stay read-only. Identify the actor, what was changed, whether any user mailbox was touched, and whether forwarding was set. If the actor looks like a Microsoft system account, check the official Microsoft documentation and tell me if this is a known maintenance pattern. If you cannot confirm the current permissions, say so clearly and do not try to expand your own access.

After you have granted extra read access:

I have granted the access we discussed. Connect app-only to Exchange Online PowerShell, run only Get-* cmdlets, confirm whether the permission is still in place, then disconnect. Record the findings in an investigation file with no secrets. Change nothing in the tenant.

How to set up a similar read-only check

You can do most of this in chat. The only app locations I will point you to are ones I have verified: the per-agent info pane, and Settings for timezone.

1. Give a bot a clear role

Use a dedicated bot for tenant monitoring, so investigation work is not mixed with unrelated chats. Click the agent’s name in the chat header, or use Cmd+Shift+I, to open the per-agent info pane. The gear beside the X opens the per-agent settings for avatar, name, title and description. Give it a clear description: read-only monitoring, ask first, investigate on request, state gaps honestly, never escalate its own permissions.

2. Start with read-only audit access

Give that bot read-only access to the unified audit log through an app you control. Start with enough access to search the log, and nothing more. The investigation above got a long way on audit events alone.

3. Save the behaviour in chat

Use the role prompt above. Be explicit that the bot must ask you before digging in, must stay read-only, and must not request or grant itself extra permission.

4. Add Microsoft Learn for official checks

Add the Microsoft Learn connector if you want official documentation checked during an investigation, rather than after the fact. I walked through that setup in How to Set Up MCP Connectors in Grok Bot with Microsoft Learn.

5. Create a routine

Create the routine in chat. You can review saved routines in the same per-agent info pane, under the computer preview. Check the timezone under Settings, on the General tab, opened from the sidebar account button at the bottom-left, or with Cmd+,. Routines usually start within a few minutes either side of the time you set. If the run must start right on the minute, say “exactly” or “sharp”.

6. Grant extra access yourself when a gap appears

For a current mailbox permission check, that means Exchange.ManageAsApp with admin consent, plus a view-only role. Prefer View-Only Organization Management if you only need Exchange visibility. Use Global Reader only if you have a reason for the broader Microsoft 365 read access, and make that choice deliberately.

7. Keep an investigation trail

A file of findings with no secrets in it is more useful the next time the same maintenance burst appears.

What I took from it

The first lesson is the oldest one in this kind of work: verify before you panic. A Full Access grant is worth taking seriously. In this case it was Microsoft putting a documented default back where it already belonged. The audit log looked worrying because it showed an identifier instead of a familiar name. That is not a reason to ignore the alert. It is a reason to investigate it properly.

The second is least privilege. The bot did not help itself to more access when it ran out of visibility. I granted the extra permission, and I accepted a broader role than the narrowest option on the table. I am comfortable with that choice. I would not have been comfortable if the tool had made it for me.

The third is to keep the human in charge. The useful pattern was simple. The bot watched, asked, investigated, admitted a gap, explained the access it needed, paused when a screenshot might have been the wrong tenant, ran only read commands, and wrote down what it found. I still made the calls that mattered.

That is what simplified the security check. Not a dashboard, and not a promise that every alert is harmless. I went from a worrying Full Access grant to a documented, no-incident conclusion the next morning, without the tool quietly expanding its own reach. For an MSP, that is the difference between an audit event that ruins the start of the day and one that has already been explained.

Keeping Everything Forever Is Hurting Your Security and Your AI

Professional holding one neat folder amid towering stacks of old archive boxes

Most businesses I work with have the same retention policy, even if nobody wrote it down: keep everything, forever, just in case. Storage feels cheap, deleting feels risky, and nobody wants to be the person who threw out the one file the lawyers asked for.

I get it. But in a world of Copilot and constant breaches, “keep everything” isn’t the safe option anymore. It’s quietly making both your security and your AI worse.

More data, more risk

Every file you keep is a file someone can steal. An old client spreadsheet from 2014 does nothing for you today, but it’s just as damaging when it turns up in a breach. The bigger the pile, the bigger the attack surface and the more there is to lose.

Old data is also usually the worst-governed data. Sites from long-finished projects still have “Everyone” links. Ex-staff’s shares never got cleaned up. And if you ever end up in a dispute, everything you kept is potentially discoverable, including things you’d forgotten existed.

For Australian businesses there’s a legal angle too. Under APP 11.2, once you no longer need personal information for any permitted purpose, you must take reasonable steps to destroy or de-identify it (with limited exceptions). Hoarding isn’t neutral. It can be a compliance problem.

Why Copilot cares about your mess

Microsoft is clear that Copilot “only surfaces organizational data to which individual users have at least view permissions.” (Microsoft Learn). That’s good security design, but it means Copilot grounds its answers in everything a user can reach, rubbish included.

Picture asking Copilot for the current pricing policy. It finds five versions across SharePoint, Teams and someone’s OneDrive, including the 2019 draft that was never approved. Stale, duplicated and conflicting content produces confused answers, and users then decide “AI doesn’t work”.

Worse is oversharing. Copilot doesn’t create permission problems, it reveals them. The salary file that was technically open to everyone but buried six folders deep can suddenly appear in an answer. I wrote more about this in Data Governance Is the Real Copilot Readiness Test.

What good looks like: Microsoft’s tools for tidying up

The good news is Microsoft 365 already has the tools. Here’s where I’d start:

Tidy data is a competitive advantage

Deleting things feels scary. Keeping everything feels safe. The reality is the reverse. A smaller, well-governed data estate is easier to secure, cheaper to defend in a dispute, and gives Copilot something worth reasoning over.

If you’re an MSP, this is a conversation worth having with every client now. Start with retain-then-delete and inactive sites. Your clients’ security and their AI results will both thank you.

Microsoft Is Retiring Its SMS and Voice MFA: What the Dates Actually Mean

IT professional weighing an old mobile phone against a modern smartphone in a dim office

Microsoft is retiring the SMS and voice MFA it delivers itself, and I’ve already seen plenty of confusion about what actually happens and when. Message Center post MC1519855 has a few dates in it, and they’re easy to squash together. So here’s how they fit, quoted straight from Microsoft’s documentation.

The short version: Microsoft stops sending the texts and making the calls, but you can keep using SMS and voice MFA after that by bringing your own telephony provider. Nothing has to be done by 30 October or 1 November. That said, the clock is definitely ticking.

What each date means

  • 30 October 2026: the third-party provider option becomes available. Nothing is turned off. The Message Center post says: “Starting October 30, 2026, Microsoft Entra ID will make Choose Your Own Telephony Provider (CYOT) generally available.” and “organizations can choose to configure a supported telephony provider.” It’s something you opt into, not a deadline. Microsoft-provided SMS and voice keep working as they do now.
  • 1 February 2027: Microsoft stops providing SMS and voice for most users. Microsoft Learn says: “From February 1, 2027, Microsoft-provided telephony delivery for SMS and voice will be retired for all users except Global Administrators and external users.” Internal guest users are included in this date.
  • 1 July 2027: the same retirement applies to Global Administrators and external users.
  • Already happening, since 1 September 2026: users enabled for SMS or voice “are auto-enabled and nudged for Passkey registration upon MFA sign-in.” That’s why your users may already be seeing passkey prompts.

One wrinkle worth knowing. The Message Center says the provider option is generally available from 30 October, but at the time of writing the Learn page on telephony providers still describes it as a private preview. I expect the documentation to catch up, but don’t be surprised if what you read on Learn and in the admin centre don’t quite line up for a while.

What users see after their retirement date

If a user’s only MFA method is SMS or voice and the tenant hasn’t set up a provider, they’re “required to register a passkey during sign-in to continue accessing their account. This prompt is blocking.” Microsoft adds: “There is no opt out.”

Picture the Monday morning helpdesk queue at a 30-seat business where half the staff never moved off text codes. Users who already have Authenticator, a passkey, Windows Hello or another method aren’t blocked, although they may still be nudged to register a passkey. Everyone else hits a wall.

Keeping SMS and voice after February

Yes, you can. Microsoft Learn says the option “lets organizations continue using SMS or voice authentication with a supported telephony provider.” Here’s what that involves:

  • Where you buy it: you choose the provider through Microsoft Security Store, and “manage their commercial relationship directly with the provider.” The provider bills you, not Microsoft.
  • Which providers: “Soprano and Telesign are the initial telephony providers” in the private preview, with “more providers” by general availability. Soprano offers per-user or per-transaction pricing.
  • What you need to buy it: “an Azure billing subscription and resource group, plus the appropriate Azure subscription role.” Microsoft also says to review “provider pricing and expected Azure infrastructure charges,” and links a cost calculator, so expect some Azure hosting cost on top of the provider’s fees.
  • Who does what: Entra “continues to enforce your authentication method policies,” and the provider just delivers the texts and calls. You’re responsible for “reviewing its regional coverage and terms, completing the provider agreement, configuring the provider… and monitoring the service.”
  • Microsoft’s own advice: use a provider “only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication.”

I couldn’t find Australian pricing or confirmation of Australian coverage in what’s been published so far, so check those with the provider directly before you promise anything to a client.

What MSPs should be doing now

  1. Find out who uses SMS or voice in every tenant. Microsoft provides a PowerShell script for this, which needs Global Reader, Authentication Policy Administrator or Security Reader.
  2. Move those users to Authenticator or passkeys well before 1 February, and get Global Admins done before 1 July. Admins shouldn’t be on SMS anyway.
  3. Tighten the policies behind it. Once users are off text codes, make sure Conditional Access actually requires the stronger methods. I covered why that matters in Your Conditional Access Is Stuck in 2018.
  4. Only consider a provider for the genuine edge cases, such as shared phones, sites where phones aren’t allowed, or a regulatory requirement, and budget for the provider’s fees plus the Azure costs.

Like everything else in security, this is a shared job. Microsoft is giving us passkey defaults and a provider option. It’s up to us to get users across before the dates arrive, rather than letting a blocking prompt do it for us.

Microsoft sources

How to Use Grok Bot to Monitor MSP News and Security Updates

Two professionals reviewing a morning news and security brief on a laptop and monitor

Most MSP owners I talk to already “keep an eye on the news”. In practice that is newsletters, a few vendor blogs, and whatever appears before the first ticket of the day. The useful items — an exploited vulnerability, an ACSC alert, a Microsoft 365 change that will hit your SMB tenants — sit in the same pile as marketing.

I wanted a brief that arrives in the morning, is filtered for an Australian MSP, cites its sources, and is sitting in chat so I can ask a follow-up. I run a dedicated News bot for this: a morning brief on Microsoft 365, Copilot and security, with an SMB lens, from official and reputable sources only. This post is how to set that up, with the chat prompts I would use, and a fair look at where this beats RSS, alerts or a generic chatbot — and where it does not.

Why MSPs need a monitoring system

MSPs sit in the middle of three streams that do not wait for a quiet week: Microsoft 365 and Copilot changes, security advisories, and channel news that affects how you explain those changes to clients.

If you miss a critical advisory, you may need to tell a client the same day. If you only read US sources, you can miss Australian Cyber Security Centre (ACSC) guidance your local customers will ask about. Manual checking does not scale, especially after a long weekend.

A monitoring system is not another inbox. It is a short, repeatable brief with a clear lens, source links, and a way to turn one item into a client note when it matters.

Step-by-step configuration

Everything below is done in chat, except for two verified places in the app: the per-agent info pane, and Settings for timezone. I am not going to invent extra menus.

1. Pick a bot and give it a clear role

I use a dedicated News bot so the brief is not mixed with other work. You can do the same, or add the routines to a bot you already use. A bot can have its own name, title and description, and it can remember your preferences.

To set the persona in the app, click the agent’s name in the chat header (or use Cmd+Shift+I) to open the per-agent info pane. The gear beside the X opens the per-agent Settings for avatar, name, title and description.

You can also do it in chat:

Set this bot’s name to News and set the description to: You prepare a morning brief of Microsoft 365, Copilot, MSP industry and security news for an Australian MSP audience. Use official and reputable sources only. Filter for SMB and MSP impact. Always include source links. Skip rumour and marketing fluff.

2. Choose your sources

Be specific about where the bot should look. These are public pages I have checked. Microsoft 365 Message Center is not on the list: it lives in the Microsoft 365 admin centre and needs tenant access, so it is not a public source for an unattended routine. For product changes without a tenant sign-in, use the public Microsoft 365 roadmap, which Microsoft now presents as the AI at Work roadmap.

For news and security monitoring, use these sources when they are relevant. Prefer official pages over secondary write-ups, and always cite the URL:
- Microsoft 365 roadmap: https://www.microsoft.com/microsoft-365/roadmap
- Microsoft Security Response Center blog: https://msrc.microsoft.com/blog/
- Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- ACSC alerts and advisories: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories
- Microsoft Tech Community: https://techcommunity.microsoft.com/
- Channel Dive: https://www.channeldive.com/
- CRN: https://www.crn.com/
- ChannelE2E: https://www.channele2e.com/
- MSSP Alert: https://www.msspalert.com/
- ConnectWise Trust Center: https://www.connectwise.com/company/trust
- Kaseya Information Security: https://www.kaseya.com/trust-center/information-security/

Add or remove vendor pages to match the tools you actually deploy.

Grok Bot can search and fetch public pages on its own. If you want official Microsoft documentation as a follow-up, add the Microsoft Learn connector — I walked through that in How to Set Up MCP Connectors in Grok Bot with Microsoft Learn. Optional extras are Outlook, Gmail or Teams for later drafting, and public reads on X. Add those in chat, for example: “Add the Microsoft Learn MCP server at https://learn.microsoft.com/api/mcp.”

3. Set the filters

A source list without filters still produces noise. Save the lens in the same chat:

Apply these filters to every brief. MSP and SMB lens — explain why an item matters to a managed service provider or a small business tenant. Severity first — put actively exploited or critical security items at the top. Australian relevance when it exists, including ACSC guidance and Microsoft 365 changes that affect Australian tenants. Official or reputable sources only. Every item needs a source link. Ignore vendor marketing, partner-program noise and generic consumer tech news.

4. Create two routines

A routine in Grok Bot is a saved prompt plus a trigger. The useful trigger here is a schedule in your local time. It runs while you are away, and the result is posted to this bot’s chat unless you name another destination. When you ask the bot to create a routine, you may see a confirmation card before it is saved.

You can review saved routines in the same per-agent info pane, under the computer preview. Check your timezone under Settings, in the General tab, opened from the sidebar account button at the bottom-left, or with Cmd+,. Routines usually start within a few minutes either side of the time you set. If the run must start right on the minute, say “exactly” or “sharp”.

Create the news brief first:

Create a routine called Morning MSP news brief. Every weekday at 7:12am Sydney time, check the Microsoft 365 roadmap, Microsoft Tech Community, ACSC alerts, Channel Dive, CRN, ChannelE2E and MSSP Alert for new items since the last run that matter to an Australian MSP. Summarise each item in a few sentences, say why it matters for an MSP or SMB tenant, and include the source link. Official and reputable sources only. If nothing material has changed, say so in this chat and stop. Deliver the brief to me in this chat.

Then a separate security routine, so a quiet news day does not bury a vulnerability:

Create a separate routine called Security alert watch. Every weekday at 8:12am Sydney time, check the CISA Known Exploited Vulnerabilities catalog, the MSRC blog and Security Update Guide, ACSC alerts and advisories, and the ConnectWise Trust Center and Kaseya information security pages for new or updated items. Flag anything that is actively exploited, critical, or affects common MSP tools. Include the official link and a short note on what I should check. If nothing new is relevant, tell me that in this chat and stop. Deliver the result to me in this chat.

Keep both prompts as intent, not a rigid script, so the bot looks up current pages each run.

5. Test it, then tune the schedule

Do not wait until tomorrow to find out the brief is too long or too vague:

Run the Morning MSP news brief once now, as a test. Do not change the schedule.

Read the result the way you would read a junior analyst’s draft. If it buries the important item, missed ACSC, or cited a weak source, say so and ask the bot to tighten the saved prompt.

To change frequency, be direct:

Change the Security alert watch to Monday, Wednesday and Friday at 8:12am Sydney time.
Pause the Morning MSP news brief while I am on leave, then resume it on the following Monday.

Start with a weekday morning cadence. Hourly checks are rarely worth the usage.

I have written before about Grok Bot taking on recurring MSP work in What Happens to MSPs When Grok Bot Can Do the Work?. A news brief is a smaller version of the same idea: the bot does the first pass, and you decide what to do with it.

Example prompts you can copy

Paste these as-is, then tighten them for your stack and clients.

Daily digest

  1. Give me this morning’s MSP news brief using my saved sources and filters. Include why each item matters and the source URL. If nothing material changed, say so.
  2. What has changed since yesterday in Microsoft 365, Copilot and MSP industry news that would affect an Australian SMB tenant? Cite links.

Security and CVE watch

  1. Check the CISA Known Exploited Vulnerabilities catalog for entries added or updated in the last seven days. Flag anything relevant to Microsoft 365, Windows, common MSP remote tools or vendors I named. Include the official CISA link.
  2. Check the MSRC blog, the Security Update Guide and ACSC alerts and advisories for anything new today. Summarise only what an Australian MSP should act on, with links.
  3. Urgent only: if there is a new actively exploited or critical advisory in my security sources that affects tools I deploy, summarise it with the official link and what I should check. If there is nothing in that category, reply with one line and stop.

Vendor watch

  1. Check the ConnectWise Trust Center and Kaseya information security pages for new advisories or security bulletins. Summarise only what is new, with links.
  2. Look for new security advisories that affect [your RMM, PSA or backup vendor]. Prefer the vendor’s own trust or security page, and cite the URL.

Microsoft 365 changes

  1. Check the public Microsoft 365 roadmap and Microsoft Tech Community for recent Copilot or Microsoft 365 changes that affect Business Premium or other SMB plans. Ignore items that are enterprise-only unless they will still land in a typical customer tenant.
  2. For this Microsoft 365 change, use Microsoft Learn to pull the official guidance and any admin steps. Include the Learn URL. Do not change any tenant.

Weekly client summaries, advisories and drafts

  1. Turn this week’s brief into a one-page client-facing summary I can send on Friday. Plain language, no hype, and a link for every item I include.
  2. Turn this story into a short client advisory. Audience: a 40-seat Australian professional services firm on Microsoft 365 Business Premium. Include what changed, who is affected, what we recommend, and the official source.
  3. Draft a short blog post or LinkedIn update from this item, in my usual practical tone, with the source link. Do not publish it.
  4. From this week’s items, what should I mention in my standing client update, and what can wait? Give a short recommended list with links.

Follow-up

  1. I have a signed-in Outlook connector. Draft an email to my internal ops list from this advisory. Do not send it until I confirm.
  2. What should I verify in a typical SMB Microsoft 365 tenant before I act on this item? Give a checklist, and cite official documentation where you can.

Benefits compared with other options

I still use newsletters, and I still open official pages when something is urgent. The question is what does the first pass for you.

An RSS reader gives you everything a site publishes, in the order it arrives. It will not apply an MSP lens or answer a follow-up. Keyword alerts are useful for a named product, but they match words, not severity or audience, so the noise is high. Newsletters arrive on someone else’s cadence and judgement. That can be excellent, and it is still not tuned to your stack or ready for a “turn this into a client advisory” request. A generic chatbot can summarise a link you paste, but it will not run unattended every weekday unless you set that up. Manual checking works until you are busy.

What Grok Bot does well here is more specific than a vague promise about AI. Scheduled routines run while you are away. The brief can be filtered to an MSP and SMB lens, including Australian relevance. You can insist on source links. One run can combine official pages, trade press and, if you have added them, connectors such as Microsoft Learn. The bot can remember your preferences. The result lands in chat, where you can ask a follow-up, request a client advisory, or draft a message for Outlook or Teams.

Limits and tips

This is a first pass, not a decision. Verify anything you might act on — a patch, a client email or a configuration change — against the official page. Trade press is often useful and sometimes paywalled; if the bot cannot read the full article, it should say so and fall back to the official source.

Ask for links every time. If a brief arrives without URLs, treat it as unverified and tell the bot to retry with citations. Keep the routines lean: two weekday morning runs are enough for most MSPs. Tightening the schedule “just in case” consumes usage.

Do not expect a public routine to read Microsoft 365 Message Center. That is tenant-scoped. Use the public roadmap for unattended product-change watching, and treat Message Center as a separate, signed-in admin task.

Closing

Monitoring fails when it depends on a quiet morning and a good memory. A Grok Bot routine will not replace your judgement, but it will do the first read, apply a consistent filter, and leave the result in chat with the links attached.

Give a news bot a clear role, name your sources and filters, then create two weekday routines — one for industry and Microsoft 365 news, one for security. Test them with a “run it once now” prompt, tighten what you get, and leave the schedule alone until you have a reason to change it. The value is not more information. It is a shorter, sourced brief you can actually use.

How to Set Up MCP Connectors in Grok Bot with Microsoft Learn

Two professionals reviewing documentation on dual monitors in a teal-and-amber lit office

I get asked a lot how Grok Bot stays current on Microsoft 365. The short answer is connectors. In the Grok Bot app, those connectors are MCP servers — Model Context Protocol endpoints that give the bot live tools, not just whatever it remembered during training.

This post is a step-by-step walkthrough using Microsoft’s official Microsoft Learn MCP server. It needs no tenant sign-in, it is free, and it is useful on day one for MSPs and smart businesses.

What MCP is, in plain words

MCP is an open standard for connecting AI agents to external tools and data. Think of it as a USB plug for AI: the host (Grok Bot) talks to a server over a shared protocol, and the server exposes named tools the agent can call while answering you.

Without MCP, an agent guesses from training data or browses the public web and hopes for the best. With MCP, it can search a trusted source, fetch a full page, or pull a code sample, then ground the answer in that content.

Microsoft publishes a remote Learn MCP server at https://learn.microsoft.com/api/mcp. Official overview: Microsoft Learn MCP Server overview. No authentication is required. There is no charge to use it. It exposes public Learn documentation only — not training records, not your tenant, not your profile.

I covered the broader idea of MCP for smaller organisations earlier in Small Business, Big AI Impact: Understanding the AI MCP Server. This post is the Grok Bot how-to.

Why Microsoft Learn makes a good first connector

Three practical reasons:

  1. No sign-in. You do not need Microsoft 365 admin consent to add it. That removes the usual “which account?” friction.
  2. Trusted content. Answers can cite official Learn pages instead of a random blog from 2021.
  3. MSP-shaped tools. The server exposes three tools: search docs, fetch a full article as markdown, and search code samples. That covers Conditional Access, Intune, Graph PowerShell and Copilot licensing.

If you have used Learn inside Copilot Studio before, this is the same family of idea. I walked through that path in Integrating Microsoft Learn Docs with Copilot Studio using MCP. Here we are wiring Learn into Grok Bot itself.

Step-by-step setup in Grok Bot

In Grok Bot, MCP servers show up as connectors. The reliable way to add one is to ask the bot in chat.

1. Open a chat with Grok Bot

Start a normal conversation with the agent that should use the connector.

2. Ask it to add Microsoft Learn

Paste:

Add the Microsoft Learn MCP server at https://learn.microsoft.com/api/mcp

That is enough. Grok Bot can search the connector catalog for a match, or add a remote MCP endpoint by URL when you give it one. Microsoft Learn’s public endpoint needs no auth token and no tenant access.

If the bot shows a connector confirmation card, approve it. For Learn there is nothing to sign in to — Microsoft’s docs state authentication is not required.

3. Wait for confirmation

When it is connected, the bot should tell you Microsoft Learn is available. On my account it appears as a connected HTTP connector with three tools:

  • microsoft_docs_search
  • microsoft_docs_fetch
  • microsoft_code_sample_search

4. Optional: add other connectors the same way

Once Learn works, add signed-in connectors (Outlook, Teams, OneDrive, Azure and so on) by naming the service in chat — for example, “add the Outlook connector” — and completing any sign-in card. Start with Learn so you see the pattern without a login wall.

Checking that it works

Do not assume the connector is live until you ask a real question:

Using Microsoft Learn, summarise how to create a Conditional Access policy that requires MFA for all users. Include the official Learn link.

A healthy reply will pull current Entra admin centre steps (Conditional Access → Policies, report-only first, exclude break-glass accounts), include a learn.microsoft.com URL, and avoid invented clicks.

I ran that live while writing this. It returned Microsoft’s “Require multifactor authentication for all users” guidance, including the authentication strength grant and the report-only recommendation.

Second check — force a code sample:

Using Microsoft Learn, give me a Graph PowerShell sample that lists users with Get-MgUser. Include the Learn source link.

Live result: samples such as Import-Module Microsoft.Graph.Users then Get-MgUser -Top 5, plus Connect-MgGraph -Scopes "User.Read.All" patterns, each with a Learn URL.

If the bot answers from memory with no Learn links, say: “Use the Microsoft Learn connector and cite the page.”

Example prompts you can copy

Paste these as-is, then tighten them for your tenant or client.

Quick answers

  1. Using Microsoft Learn, what are the eligible prerequisite licences for Microsoft 365 Copilot? Summarise the commercial table and link the page.
  2. Using Microsoft Learn, what does an Intune Windows compliance policy check for firewall, BitLocker and Defender? Bullet list with the Learn link.
  3. Using Microsoft Learn, explain the difference between Require multifactor authentication and authentication strength in Conditional Access. Cite the docs.

Live Copilot check: Learn returned the licence options page — Copilot as an add-on on qualifying Microsoft 365 / Office 365 / Business plans, with Copilot Business aimed at organisations up to 300 users — plus the requirements page covering identity and mailbox prerequisites.

Step-by-step admin guides

  1. Using Microsoft Learn, walk me through creating a Conditional Access policy that requires MFA for all users. Start in report-only. Exclude break-glass accounts. List every click path from the Entra admin centre and include the official URL.
  2. Using Microsoft Learn, give me the steps to create a Windows device compliance policy in Intune that requires Secure Boot, BitLocker and Microsoft Defender real-time protection. Include prerequisites and the Learn link.
  3. Using Microsoft Learn, how do I assign Microsoft Copilot licences in the Microsoft 365 admin centre after purchase? Include the assign-licences doc link.

PowerShell and Graph code samples

  1. Using Microsoft Learn code samples, show Graph PowerShell to connect with Connect-MgGraph and list the first 50 users (DisplayName, Id). Include the source page.
  2. Using Microsoft Learn, find a PowerShell sample that disables a user with Get-MgUser and Update-MgUser. Warn me about hybrid implications and cite Learn.
  3. Using Microsoft Learn, search for PowerShell samples to work with Conditional Access policies. Prefer official samples and link them.

Comparing options

  1. Using Microsoft Learn, compare Microsoft Copilot Chat vs Microsoft 365 Copilot licensing requirements for a 40-seat Business Premium tenant. Table format, with source links.
  2. Using Microsoft Learn, compare requiring MFA for all users vs requiring MFA only for directory roles. When would Microsoft recommend each? Cite the policy pages.

Client docs, checklists and routines

  1. Using Microsoft Learn, draft a one-page checklist for an MSP onboarding a new Microsoft 365 client: MFA baseline, Intune compliance for Windows, and Copilot licence prerequisites. Every checklist item must include a Learn URL.
  2. Every Monday, use Microsoft Learn to check whether Conditional Access MFA baseline guidance has changed this week. Summarise any material change and link the pages. Do not change my tenant.
  3. Read the latest ticket in Outlook about Intune compliance failures, then use Microsoft Learn to pull the matching Windows compliance settings and suggest what to verify. Do not change policies until I confirm.

Those last two prompts are where Grok Bot gets useful for MSP work, not just another chatbot. One runs on a weekly schedule, and the other combines tenant evidence from a signed-in connector with public guidance from Learn.

Tips and limits

  • Public docs only. Learn MCP does not see your tenant, users, licences or policies.
  • Content refresh. Microsoft says the knowledge service refreshes incrementally and does a full refresh about once a day, so brand-new articles can lag briefly.
  • Ask for sources. Tell the bot to include Learn URLs. If it cannot cite one, treat the answer as unverified.
  • Verify before you run scripts. Test Graph and PowerShell samples in a lab, check scopes, and confirm the Microsoft Graph PowerShell SDK modules.
  • Report-only first. When Learn returns Conditional Access steps, keep Microsoft’s advice: create in report-only, review impact, then enable.
  • Terms of use. Using the Learn MCP server means you agree to the Microsoft Learn Terms of Use.

Closing

MCP connectors are how Grok Bot stops guessing and starts working from live tools. Microsoft Learn is the easiest first connector because it is public, free and immediately useful for Microsoft 365 work.

Add it with one chat prompt, test it with a Conditional Access or Copilot licensing question, then keep a short list of copy-paste prompts next to your admin checklist. From there you can layer signed-in connectors for mail, calendar, files and tenants — with Learn sitting underneath as the shared source of truth for “what does Microsoft say right now?”

Official starting point: https://learn.microsoft.com/en-us/training/support/mcp

Want to Know Where You’re Heading? Look Back

A business owner standing on a long highway at dusk, looking back at the road he has travelled

Nobody can tell you exactly where your business will be in two years. I certainly can’t. But I’ve found a surprisingly reliable way to get a preview, and it doesn’t involve forecasts, vision boards or a strategy offsite. It involves turning around.

Instead of staring at the horizon, look at the road behind you. Specifically, the last 90 days.

The honest 90-day review

Ask yourself a few plain questions. Are you making more money than you were three months ago? Are you spending more of your week on work you actually enjoy? Do you have more freedom, or less? Are you enjoying your life, or just getting through it?

The answers are usually one of three: yes, no or sorta. Most MSP owners I speak with land on sorta. Revenue is fine. The team is busy. Tickets get closed. Yet the owner is still the escalation point for everything, still writing proposals at 10pm and still promising themselves that next quarter will be different.

Here’s the uncomfortable part. Sorta is not a resting place. It’s a direction.

Your trajectory is already set

The easiest way to see where you’ll end up is to take what you did over the last 90 days and extend the line. Picture repeating the same actions, and just as importantly the same inactions, every single day for the next two years.

The Copilot licence you bought but never rolled out properly. The SharePoint clean-up you keep deferring. The documentation that lives in one tech’s head. The pricing review you haven’t had time for. None of these feel urgent today. Multiply them by 730 days and they become the shape of your business.

So where does that line take you? Somewhere great? Somewhere not so great? Or just okay? Be honest, because okay compounds too.

Use the tools to read the road

This is one place where I find Microsoft 365 Copilot genuinely useful, not as a magic fix but as a mirror. Your last 90 days are already sitting in Outlook, Teams, Planner and your Excel reports. Picture asking Copilot to summarise what consumed your calendar this quarter, which client conversations kept recurring, or what you committed to in meetings and never followed up. The patterns are often obvious once someone lays them out in front of you.

Then do the same for your team. Where are the repeated questions? Which processes in your PSA or SharePoint keep generating rework? A short, honest review like this tells you more about your future than any five-year plan.

Small changes in direction matter more than big declarations. I wrote earlier about how worthwhile change accumulates in Give It Time to Become Something, and that applies here. Shift the daily habits and the two-year destination moves with them.

If you’re already heading somewhere great

Maybe your review comes back as a clear yes. More revenue, better clients, more freedom. Brilliant. Keep doing what’s working.

But between you and me, I reckon there’s a way to get you there faster. It usually comes from removing the busywork that still drags on your best people, rather than adding more effort. Automate the repetitive reporting with Power Automate. Let Copilot draft the first pass of the QBR deck. And as I said in Stop Acting Like the Business You Have Not Built Yet, stop carrying overhead you don’t need yet.

Take an hour this week. Look back at the last 90 days, then extend the line. If you don’t like where it ends, today is the cheapest day to change the angle.

MSP Summer School 2027: The AI MSP Make the Successful Transition

image

For a number of years I’ve run an MSP Summer School during January.

For January 2027, I want to tackle what I believe is one of the biggest changes the MSP industry has faced:

The transition to becoming an AI-enabled MSP.

AI isn’t simply another product that MSPs need to understand so they can sell it to customers.

I think the change is much bigger than that.

For the past 20 years, MSPs have helped customers navigate major technology transitions. We’ve moved customers from servers to cloud, perpetual licensing to subscriptions, on-premises infrastructure to Microsoft 365 and traditional security models towards Zero Trust.

This time, the MSP itself needs to make the transition.

That’s what the 2027 MSP Summer School will be about.

The AI MSP: Make the Successful Transition

The plan is to run four live online sessions during January:

DateTime
Wednesday, 6 January 202710:00 am–12:00 pm AEDT
Wednesday, 13 January 202710:00 am–12:00 pm AEDT
Wednesday, 20 January 202710:00 am–12:00 pm AEDT
Wednesday, 27 January 202710:00 am–12:00 pm AEDT

That’s eight hours across four Wednesday mornings, with a week between sessions to take what we discuss, try it inside your MSP and come back with the results.

The program will follow a simple progression:

Understand → Build → Sell → Operate

This won’t be eight hours of AI theory.

The objective is to help you start building the AI-enabled version of your MSP.

Week 1: The AI MSP

What does an MSP need to become?

We’ll begin with the strategic question.

What does AI actually mean for the MSP business model?

We’ll look at areas including:

  • how AI changes the way an MSP operates
  • where existing MSP revenue may come under pressure
  • what customers will increasingly expect from their technology provider
  • AI-enabled service delivery
  • Microsoft 365 Copilot, agents and automation
  • opportunities for new recurring services
  • moving towards managed business outcomes
  • Shadow AI, security and governance
  • assessing your current AI maturity

The objective will be to start creating an AI MSP Transition Map for your business.

Week 2: Build the AI-enabled MSP

Use it yourself before you try to sell it

I strongly believe MSPs need to start using AI internally before attempting to advise customers on their own AI transformation.

We’ll therefore get practical.

We’ll look at opportunities across:

  • service desk
  • technical documentation
  • sales
  • marketing
  • proposals
  • account management
  • customer reporting
  • project delivery
  • security
  • administration
  • knowledge management
  • business process automation

We’ll also explore technologies such as Microsoft 365 Copilot, Copilot Chat, Copilot Studio, agents, Power Automate, Azure AI, RAG, private/local AI and MCP.

One question will feature heavily:

Would I currently pay an employee to do this manually?

If the answer is yes, we should at least investigate whether AI can assist, accelerate or automate some of that work.

The objective will be for each participant to identify at least 10 processes inside the MSP that could potentially be redesigned using AI.

Week 3: Selling AI

How do we turn this into revenue?

Using AI internally is only half of the opportunity.

The next challenge is turning AI knowledge and experience into something customers will actually buy.

I don’t think simply offering “AI consulting” or “prompt engineering” is enough.

We need packaged outcomes.

For example:

  1. AI Readiness Assessment
  2. AI Governance Foundation
  3. Microsoft 365 Copilot Readiness and Deployment
  4. AI Productivity Workshop
  5. Business Process Automation
  6. Custom AI Agents
  7. Managed AI Services

We’ll work through customer discovery, demonstrations, packaging, pricing, ROI and the increasingly common objection:

“We’re already using ChatGPT.”

The goal will be for every MSP to leave this session with the foundations of three AI services that could be taken to customers.

Week 4: Operating the AI MSP

Turn the ideas into action

The final week brings everything together.

We’ll explore areas including:

  • AI governance
  • customer data protection
  • identity and access
  • Microsoft Purview
  • DLP
  • Shadow AI
  • agent governance
  • human oversight
  • AI acceptable-use policies
  • quality assurance
  • measuring AI ROI
  • developing staff skills
  • internal AI champions
  • continuous improvement

Most importantly, every MSP should finish January with a:

90-Day AI MSP Transition Plan

That could look something like this.

Days 1–30: Adopt

Start internal AI adoption, establish governance, train staff and identify repeatable use cases.

Days 31–60: Build

Package offerings, create demonstrations, establish pricing and identify pilot customers.

Days 61–90: Sell

Deliver pilots, measure results, capture case studies and start converting successful projects into managed services.

The question at the end of Summer School will be very simple:

What is your MSP going to do differently on Monday morning?

Constant Recording. Constant Iteration.

There’s another idea I want to explore throughout Summer School.

Record → Analyse → Improve → Repeat

Subject to appropriate privacy, consent and governance, MSPs generate enormous amounts of useful information every day:

  • customer questions
  • support interactions
  • meetings
  • sales conversations
  • customer objections
  • procedures
  • documentation
  • repetitive tasks
  • successful prompts
  • failed approaches
  • automation opportunities

Historically much of that information disappeared as soon as the conversation or interaction ended.

AI potentially changes that.

Activity can become knowledge.

Knowledge can produce insight.

Insight can drive automation.

Automation can produce better processes.

That leads to a principle I want to explore throughout Summer School:

Constant recording. Constant iteration. Constant improvement.

You’ll be doing, not just watching

I don’t want this to be four webinars where everyone watches presentations for two hours.

Each session will combine:

  • current AI developments
  • key concepts
  • live demonstrations
  • MSP-specific examples
  • practical workshops
  • group discussion
  • take-home challenges

There will also be work between sessions.

After Week 1

Identify 20 repetitive activities inside your MSP.

After Week 2

Select five and experiment with AI.

After Week 3

Have an AI-focused conversation with three customers.

After Week 4

Choose one AI service to launch.

The goal isn’t simply to attend Summer School.

It’s to start building your AI MSP during Summer School.

What will it cost?

I’m proposing to price Summer School per MSP rather than per person.

That’s deliberate.

I’d much rather an MSP owner bring a technical lead, service manager or salesperson along so that multiple people inside the business understand what needs to change.

Each registration will therefore cover up to three people from the same MSP.

Proposed pricing
RegistrationPrice + GSTSaving
StandardA$895–
Patron memberA$795A$100
AI Dojo memberA$745A$150
Patron + AI Dojo memberA$645A$250

For those who are members of both Patron and AI Dojo, you’ll receive the special combined-member price rather than having to work out multiple overlapping discounts.

Member prices won’t stack with other promotional offers.

I’m also considering an additional post-Summer School implementation clinic for people who are members of both Patron and AI Dojo.

What’s included?

My current plan is for registration to include:

  • four live two-hour sessions
  • up to three participants from the same MSP
  • session recordings
  • practical worksheets
  • templates
  • AI MSP planning resources
  • AI service development frameworks
  • exercises to complete inside your MSP
  • your own 90-Day AI MSP Transition Plan

The emphasis throughout will be firmly on practical outcomes rather than AI theory.

Who is Summer School for?

I’m designing this primarily for:

  • MSP owners and principals
  • practice managers
  • technical leaders
  • service managers
  • sales and business development leaders

You certainly don’t need to be an AI expert.

In fact, that’s rather the point.

If you’re asking questions such as:

What does AI actually mean for my MSP?

Where should I start?

How should we use AI internally?

What AI services should I take to customers?

How can we make money from this?

How do we manage the security and governance risks?

How do I stop AI becoming another technology distraction?

then this is exactly the sort of program I’m planning.

Interested? Register your interest now

At this stage I’m asking MSPs to register their interest.

There’s no commitment simply from expressing interest. It will help me gauge demand for the January program and keep interested people informed as the final agenda, registration arrangements and supporting material are confirmed.

Register your interest in MSP Summer School 2027

If you’re considering joining me in January, register your interest now so I can keep you updated as the program takes shape.

The goal

I’m not going to promise that eight hours of Summer School will magically transform an MSP.

I think there’s a much more useful objective.

By the end of January, I want participating MSPs to understand:

Where they are now.

Where AI could take their business.

What they should use internally.

What they could sell to customers.

What they shouldn’t do.

And, most importantly:

What they are going to do next.

Because the basic premise behind Summer School 2027 is straightforward:

MSPs have spent the last 20 years helping customers make successful technology transitions.

Now it’s our turn.

MSP Summer School 2027

The AI MSP: Make the Successful Transition

6, 13, 20 and 27 January 2027
10:00 am–12:00 pm AEDT
Live online

Standard: A$895 + GST per MSP
Patron: A$795 + GST
AI Dojo: A$745 + GST
Patron + AI Dojo: A$645 + GST

Up to three attendees from the same MSP.

Register your interest

Your Market Needs a Mayor. Why Not You?

A professional standing confidently in a busy town square at golden hour as people turn to them for guidance

Most MSPs I talk to want to be seen as the leader in their patch. They want the referrals, the respect and the clients who call them first. Then they try to get there by being louder. More ads, more logos on more slides, more posts about how great they are. I think that misses the point. Leading a market isn’t a title you claim. It’s a job you do. Think of it as being the mayor of your town, and the mayor’s real job has never been prestige. It’s service. Whoever is most useful gets the role.

Usefulness beats volume

Your clients are drowning in noise right now. Copilot keeps changing. Every week brings a new security scare. Microsoft licensing still confuses people who have bought it for a decade. Nobody needs another voice shouting. They need someone calm who makes sense of it all.

I wrote earlier about how to make your business easier to buy. This is the same idea seen from the other side. When you’re consistently the person who explains things clearly, buying from you stops feeling like a risk. People already trust your judgement before they ever see a quote.

Three jobs every mayor takes on

The way I see it, the work comes down to three habits.

  • Turn fear into confidence. When a scary phishing story hits the news, don’t wait for panicked emails. Send clients a short note covering what it means for them, what you’ve already checked in Entra and Defender, and the one thing they should do.
  • Turn uncertainty into clarity. Picture running a twenty-minute monthly Copilot briefing in Teams. Show what changed, what’s worth trying in Outlook or Word, and what to ignore. No pitch, just clarity.
  • Answer before they ask. If Microsoft is about to change something in Teams or Outlook, you already know the question your clients will raise. Put a plain-English explainer in their inbox first. When licensing shifts again, give them a one-page summary in SharePoint showing what it means for their seats and their budget.

None of this needs a marketing department. It needs attention and a willingness to share what you already know. Copilot can even help you draft these updates faster, as long as the judgement in them is yours.

The rewards follow the service

Here’s what I’ve seen over many years. Status, influence and revenue rarely go to the loudest operator in town. They drift towards the person everyone already relies on. When people know you’ll tell them the truth, they bring you their problems. That’s a far stronger position than any campaign can buy.

It also changes how you sell, or rather how little you need to. In Stop Selling. Start Letting People Decide. I argued that pressure drives good clients away. Being genuinely useful is the opposite of pressure. You give first, consistently, and let people come to you when they’re ready.

Being useful also compounds. Every clear explanation makes the next one more trusted. Every early warning makes clients a little more likely to forward your notes to a colleague. Over time you’re no longer one provider among many. You’re the person the town turns to.

Take the job

So here’s my challenge. Pick your market, whether that’s a suburb, an industry or a niche within Microsoft 365. Then commit to being the most useful person in it. Start this month with one briefing, one explainer or one early warning. Nobody is going to hand you the mayor’s chain. You earn it by showing up and serving. The job is open. Take it today.