Step-by-Step Program for MSPs to Fulfill Priority #1 with Microsoft 365 Business Premium

This is part of a series on MSP priorities for 2026.

Priority #1 (2026): Elevate SMB Cybersecurity and Resilience. The first key priority for MSPs serving SMBs in 2026 is to strengthen clients’ security posture in the face of rising cyber threats. Microsoft 365 Business Premium – a comprehensive productivity and security suite for up to 300 users – is an ideal foundation for this goal, as it includes Office apps, Teams, advanced security (Microsoft Defender), and device management (Intune) in one package. Below is a practical step-by-step program leveraging Business Premium to achieve the outcomes outlined in Priority #1, focusing on identity protection, device and data security, threat prevention, and continuous improvement. The most critical actions (enabling MFA, device compliance, threat protection) are presented first, followed by supporting measures for sustainment. [techcommun…rosoft.com]

Step 1: Enable MFA and Conditional Access for All Users

Action: Immediately protect user identities by requiring multi-factor authentication (MFA) on all accounts and applying Azure AD Conditional Access policies (enabled by Business Premium’s Entra ID Premium P1 license). Start by turning on MFA for every user, ideally via Conditional Access rather than per-user settings. For example, define a policy in Entra ID that requires MFA for all logins and blocks access from risky sign-in locations or legacy authentication protocols. Use Conditional Access “trusted locations” and device compliance conditions to fine-tune access (e.g. skip MFA on known safe networks, but enforce it elsewhere). Also enable self-service password reset with MFA (another Entra ID P1 feature) so users can securely reset credentials without helpdesk intervention. [prescripti….solutions] [prescripti….solutions], [dev.to] [dev.to]

Outcome: Dramatically reduced risk of account breaches. By implementing MFA and intelligent access rules, stolen passwords alone can’t compromise the business. This is critical given that the vast majority of SMB breaches involve compromised credentials – enabling MFA can prevent ~90% of such attacks. Conditional Access gives precise control over who and what conditions can access cloud resources, moving beyond basic security defaults to a true Zero Trust stance. Administrators gain visibility and control, rather than relying on implicit trust. [totalassure.com] [prescripti….solutions]

Best Practices: Roll this out tenant-wide using Azure AD Security Defaults off + custom policies on. Start with a baseline policy (e.g. require MFA for all users) and test using the “What If” tool in Conditional Access to verify the rules before enforcing. Educate users about the new MFA requirement in advance to ensure smooth adoption. For MSPs, standardize a template Conditional Access policy that you can deploy across all client tenants for consistency. (Microsoft 365 Business Premium is the only Business SKU that supports these Conditional Access policies, unlocking this enterprise-grade security for SMBs.) [prescripti….solutions]

Step 2: Onboard and Secure All Devices with Intune

Action: Establish device management and compliance enforcement using Microsoft Intune (included in Business Premium). Enroll every work device – laptops, desktops, and mobile devices – into Intune for centralized management. Configure automatic enrollment for Azure AD-joined or hybrid AD-joined devices so that any new device a user signs in to is prompted to enroll in Intune. For BYOD scenarios, use App Protection Policies (MAM) for mobile apps to secure company data without full device enrollment. Once devices are under management, apply compliance policies: require a minimum OS version/patch level, enable BitLocker encryption on Windows 10/11, enforce password complexity, and block jailbroken or non-compliant devices. Tie these policies back into Conditional Access – e.g. allow access to corporate apps only from compliant (Intune-managed, policy-adherent) devices. [dev.to] [dev.to], [dev.to]

Outcome: Only trusted, secure devices can access company data. Intune enrollment and compliance policies ensure every PC or mobile device meets security standards (up-to-date OS, encryption on, malware protection) before it accesses email or files. Lost or stolen devices can be remotely wiped to protect data. BYOD users get secure access via app sandboxes without risking a data leak. Uniform device management reduces the chance of an unpatched laptop or unauthorized device becoming a breach entry point. For SMBs, this brings enterprise-level endpoint governance – a major step up from the unregulated device access many had before. [dev.to]

Best Practices: Use Intune’s security baselines or template profiles for SMB-friendly settings (there are recommended baseline configurations for Windows, Edge, etc.). Implement Microsoft Defender antivirus policies via Intune to ensure real-time protection is active on all endpoints (Business Premium’s Defender for Business will also cover this – see Step 3). Leverage Windows Autopilot for zero-touch provisioning of new devices to streamline onboarding for new hires or hardware refreshes. MSPs should document a standard device configuration (OS build, required apps, policies) and apply it uniformly across clients for efficiency. Prerequisite: Ensure each Windows device is Windows Pro or higher (Business Premium includes Windows 11 Pro upgrade rights), which is required for Azure AD join and Intune MDM enrollment. [dev.to]

Step 3: Deploy Advanced Threat Protection for Email and Endpoints

Action: Now protect data, email, and endpoints from threats using Business Premium’s built-in Microsoft Defender solutions. In the Microsoft 365 Defender portal, configure Microsoft Defender for Office 365 (Plan 1) – included in Business Premium – to guard against phishing and malware in Exchange, OneDrive, SharePoint, and Teams. Enable Safe Attachments and Safe Links policies so that email attachments and URLs are scanned in real time for threats. Turn on anti-phishing policies to use machine learning for detecting spoofed or suspicious emails. Next, deploy Microsoft Defender for Business (endpoint protection) to all workstations and supported mobile devices. Onboard devices to Defender via Intune security tasks or local script: Intune can push the Defender agent onboarding configuration to each PC automatically. This provides next-generation antivirus, endpoint detection and response (EDR), and threat intelligence on those devices, equivalent to enterprise Defender for Endpoint P1. Ensure that Microsoft 365 Apps (Office desktop apps) are also deployed and kept updated (this can be done via Intune app deployment) so that users have the latest security-enhanced versions of Office. [prescripti….solutions] [prescripti….solutions], [prescripti….solutions] [dev.to]

Outcome: Proactive threat prevention and detection across email and devices. Phishing emails and malicious links are neutralized before users click on them, greatly reducing successful breaches via email (the #1 attack vector for SMBs). Every managed endpoint runs enterprise-grade antivirus/EDR, alerting you to malware or abnormal behavior and allowing quick response (isolation, remediation) via the Defender portal. This closes the gap where over half of SMBs had no endpoint monitoring. By using the integrated Defender suite, threats are tracked holistically – for example, if a user clicks a phishing link, you can see if that device later showed odd behavior, all in one dashboard. Overall, SMB clients get a dramatically improved security posture: common threats like ransomware and credential-stealing malware are stopped in real time, and any incidents are flagged immediately for investigation. [totalassure.com], [prescripti….solutions] [totalassure.com]

Best Practices: Customize anti-phishing rules to protect high-risk users (like execs) by enabling impersonation protection and adding trusted senders/domains to prevent false positives. Use Attack Simulation Training (if available as an add-on or via Defender for Office P2) to run simulated phishing campaigns and educate users – human error is still a leading cause of incidents. In Defender for Business (endpoint), set up automated investigation and remediation so that when an alert fires, the system can attempt to quarantine files or rollback changes automatically. Also configure alerting to MSP administrators (via email or Teams) for high-severity incidents so nothing slips by. If clients use additional security products (firewalls, etc.), integrate those signals where possible or at least ensure roles are clear to avoid gaps.

Step 4: Protect Sensitive Data and Ensure Compliance

Action: Implement basic data protection policies using Microsoft 365’s built-in capabilities, to prevent accidental data leaks and bolster compliance with any industry regulations. In the Microsoft Purview compliance portal (accessible with Business Premium), configure Data Loss Prevention (DLP) policies for common sensitive data types – for example, prevent emails or Teams chats from sharing credit card numbers, social security numbers, or other PII outside the organization. Even the base Business Premium license allows setting up Exchange Online DLP rules to detect sensitive info and either warn the user or block the message. Enable BitLocker drive encryption via Intune (as noted in Step 2) to ensure data on laptops is safe even if lost. Encourage use of OneDrive/SharePoint for file storage instead of local disks, so that data benefits from cloud security controls and backups. Also consider applying Sensitivity Labels (if available) to classify documents – for instance, tag files as “Confidential” vs “Public” – and apply encryption or access restrictions based on those labels. Sensitivity labeling (via Azure Information Protection Plan 1, included in EMS) lets protection travel with the file (the label policies can encrypt files or prevent external sharing). Finally, if clients have compliance requirements (like HIPAA, GDPR, or cyber insurance mandates), use the Compliance Manager in Purview to assess and track adherence to various control frameworks. [techcommun…rosoft.com], [techcommun…rosoft.com] [dev.to] [techcommun…rosoft.com]

Outcome: Minimized risk of data leakage and compliance violations. DLP policies will automatically block or report attempts to send sensitive customer data where it doesn’t belong (e.g. someone accidentally emailing a client’s credit card info). Encryption and labeling ensure that even if files are stolen or misdirected, unauthorized parties can’t read them. These measures give SMBs protections similar to large enterprises, keeping client trust and meeting legal requirements without heavy overhead. In sectors like finance or healthcare, these safeguards are essential and can be a selling point for the MSP’s services. Even for less regulated businesses, showing that strong data controls are in place differentiates your offering and reduces the chance of costly incidents. [techcommun…rosoft.com]

Best Practices: Start with pre-built templates in the DLP policy creation wizard (e.g. template for GDPR data, or US Financial Data) and customize as needed, rather than building rules from scratch. Pilot the DLP policies in audit mode first – this logs potential violations without blocking – to fine-tune the rules and minimize false positives. Educate the client’s employees about what the policies mean if they trigger (e.g. if they see a popup that they’re about to share sensitive info, they should heed it). Keep the compliance configuration lean: focus on a few high-impact policies rather than trying to cover every scenario at once. As a managed service, periodically review policy reports and adjust them to the client’s evolving needs. Additional tip: If clients require more advanced compliance features (insider risk management, encryption customer key, etc.), Microsoft now offers add-on suites for Business Premium – you can plan for these as an upsell, but the base Business Premium already provides a solid starting point. [techcommun…rosoft.com], [techcommun…rosoft.com]

Step 5: Continuous Monitoring, Improvement, and User Education

Action: Operationalize security as an ongoing program. Leverage Microsoft Secure Score to continuously assess each client tenant’s security posture and identify improvement actions. Secure Score aggregates recommendations across Azure AD, Intune, Defender, and more – use it monthly to track progress (for example, after deploying MFA and device compliance, the score will rise) and to spot any regressions. For MSPs managing many customers, set up Microsoft 365 Lighthouse – a free tool for partners – which provides a unified dashboard to monitor security alerts, device compliance, and user risk across all your Business Premium customer tenants. In Lighthouse, configure alerts and incident queues so your team can respond quickly to any customer’s issues from one screen. Additionally, implement a routine of security awareness training for users: deliver short training modules or phishing simulation (third-party tools or Microsoft’s Attack Simulator if available) on a regular basis. Users should learn to recognize phishing attempts, use MFA properly, and follow clean device practices, reinforcing the technology measures with good behavior. Perform periodic security reviews (e.g. quarterly business reviews focused on security) with each client: show them improvements (metrics like Secure Score increase, or number of threats blocked), discuss new threats or Microsoft feature updates, and plan next steps. This keeps the client engaged and aware of the value being delivered. [cloudpartn…rosoft.com] [prnewswire.com], [totalassure.com]

Outcome: Sustained high security posture and adaptability. By treating security as a continuous cycle, MSPs ensure that the initial gains from deploying Business Premium do not erode over time. The organization’s defenses stay current with emerging threats – for instance, if new ransomware tactics appear, you adjust policies or training accordingly. Centralized tools like Secure Score and Lighthouse provide measurable validation of security improvements and help catch any gaps (e.g. if an admin turned off a policy by mistake, score would drop). Regular user training fosters a security-first culture, attacking the human element of risk (notably, 95% of breaches involve some human error as a factor). Overall, the MSP can demonstrate ongoing value through reports and dashboards, and SMB clients maintain confidence that their protection is always up-to-date. In practical terms, this reduces incident rates and ensures faster response when issues do occur, limiting damage and downtime. [totalassure.com]

Best Practices: Automate what you can – for example, set Secure Score reports to email out monthly and use Lighthouse’s task automation or Azure scripts for common remediations (some Secure Score improvement actions can even be triggered via Graph API). Keep a runbook for incident response so that if an alert comes in (e.g. a detected malware outbreak), your team knows the steps to investigate and remediate promptly. Engage in Microsoft’s partner security communities or training (Microsoft offers MSP-specific workshops and bootcamps for Business Premium security) to stay ahead of new features (like recent additions in Entra ID or Defender). Finally, regularly revisit Priority #1’s objectives with the client’s leadership – as you improve their baseline, the conversation can evolve from “fixing vulnerabilities” to enabling new capabilities securely (e.g. deploying Microsoft 365 Copilot or other advanced tools in a secure manner), aligning security improvements with business goals. [cloudpartn…rosoft.com]


Summary of Steps, Tools, and Outcomes: The table below summarizes each step in the program, the key Microsoft 365 Business Premium tools used, expected outcomes, and prerequisites or setup notes for each step:

StepMicrosoft 365 Business Premium ToolsExpected OutcomePrerequisites/Notes
1. Enforce MFA & Conditional AccessAzure AD (Entra ID) Premium P1 – Conditional Access policies; Microsoft Authenticator app for MFAAll user logins are protected by MFA and risk-based policies, drastically reducing unauthorized access [totalassure.com]. Only compliant, verified sign-ins are allowed (Zero Trust) [prescripti….solutions].Business Premium licenses assigned to all users. Disable legacy auth and inform users about MFA rollout. Have break-glass admin account excluded from CA (for safety).
2. Manage & Secure Devices (Intune)Microsoft Intune (Endpoint Manager); Azure AD join; Compliance Policy and Configuration Profile features; Autopilot deployment100% of PCs and mobile devices accessing corporate data are inventoried and meet security standards (encrypted, updated, protected) [dev.to]. Ability to remotely wipe lost devices. No unmanaged or outdated device can access data.Devices running supported OS (Win 10/11 Pro, iOS, Android). Users sign in with Entra ID accounts. Configure baseline policies (enrollment required, BitLocker ON, etc.) before enforcement.
3. Deploy Threat Protection (Email & Endpoint)Microsoft Defender for Office 365 (Plan 1) – Safe Links, Safe Attachments, Anti-phishing; Microsoft Defender for Business (endpoint AV/EDR) via Intune or script; Microsoft 365 Defender security portalPhishing emails and malware are actively blocked or quarantined before causing harm [prescripti….solutions]. Every endpoint has next-gen antivirus and is monitored for threats (with alerts to IT) [prescripti….solutions]. Rapid detection and response to incidents, reducing breach impact.Exchange Online mailboxes in use (for Defender for O365 to apply). Endpoint devices enrolled in Intune or accessible to run onboarding script. Admins should familiarize with Defender portal and set notification rules.
4. Protect Data & ComplianceMicrosoft Purview compliance portal – Data Loss Prevention policies; Sensitivity Labels (AIP); BitLocker (via Intune); Exchange Online retention and data encryption settingsSensitive data (financial, personal, etc.) is identified and controlled – preventing accidental leaks via email or Teams [techcommun…rosoft.com]. All laptops have encrypted drives, and company data is safer in cloud storage. Supports regulatory compliance and client data privacy commitments.Identify key data types to protect (e.g. HIPAA data, credit cards). Business Premium includes basic DLP; for advanced needs, consider add-ons [techcommun…rosoft.com]. Roll out in stages to avoid user friction.
5. Monitor & Improve ContinuouslyMicrosoft Secure Score (security.microsoft.com); Microsoft 365 Lighthouse (multi-tenant management); Azure AD risk reports; User training content (Microsoft Learn or third-party)Sustained security posture with quantifiable improvements (higher Secure Score). Threats and alerts across all clients are centralized for fast response [cloudpartn…rosoft.com]. Users are more security-aware, reducing risky behavior. The MSP can proactively address issues and demonstrate ongoing value.Set a schedule (monthly/quarterly) for reviews. Lighthouse requires CSP partner access to customer tenants. Use reports to show value to clients. Keep admins and users updated on new features and threats (e.g., via newsletters or training sessions).

Each of these steps builds upon the previous to form a comprehensive security program. By standardizing on Microsoft 365 Business Premium across their SMB clientele, MSPs can deliver enterprise-grade protection in a repeatable, cost-effective way. The result for Priority #1 is clear: stronger defenses against cyberattacks, improved compliance, and a more resilient business for clients, all achieved with the integrated toolset that Business Premium provides, backed by Microsoft’s latest innovations. This step-by-step roadmap not only fulfills the outcomes detailed in item one of the outlook, but also creates a platform for MSPs to continue expanding services (such as advanced compliance, analytics, or AI solutions) in a secure manner throughout 2026 and beyond. [prescripti….solutions].

Key Priorities for MSPs in 2026: A Global Outlook (SMB Focus)

Managed Service Providers (MSPs) serving small and medium-sized businesses (SMBs) must elevate their game in 2026 to meet rising expectations and rapid technology changes. Globally, the MSP market continues to expand (projected at $424–$511 billion by 2026), and SMBs are channeling unprecedented investments (over $90 billion in new managed IT spending through 2026). However, with this opportunity comes intense pressure: clients demand better cybersecurity, optimized cloud services, meaningful use of AI, improved service experiences, strict compliance, greater automation, and skilled support. Many MSPs today struggle with gaps in these areas – from reactive security postures to talent shortages – which must be addressed for sustained growth. [deskday.com]

The table below summarizes key operational areas, where MSPs often fall short at present, and the essential focus and actions needed in 2026 to improve:

AreaCurrent Gaps / Needs Improvement2026 Focus & Actions
CybersecurityReactive approach prevalent; advanced threat detection, incident response, and user security training are often insufficient [provaltech.com].Adopt 24/7 threat monitoring (MDR/SOC), implement zero-trust & MFA, run regular security awareness training, and offer compliance guidance (e.g. PCI/GDPR) [deskday.com], [provaltech.com].
Cloud ServicesFocus often limited to migration; many lack expertise in multi-cloud management, cost optimization, and robust cloud security [deskday.com].Provide end-to-end cloud support: manage hybrid/multi-cloud environments, practice FinOps for cost control, ensure cloud backup & DR, and leverage edge computing for low-latency needs [deskday.com], [deskday.com].
AI IntegrationSlow adoption of AI – only ~30% of MSPs use AI to automate tasks, as others remain cautious or lack skills [kaseya.com] (smaller MSPs risk falling behind larger competitors [channele2e.com]).Embed AI in operations: deploy AI-driven ticket triage/chatbots for Tier-1 support, use predictive analytics to prevent outages, and develop client-facing AI solutions (e.g. deploying productivity AI tools) [deskday.com], [channele2e.com].
Customer ExperienceOften seen as mere IT vendors rather than strategic partners – value reporting and proactive guidance lag behind client expectations [channele2e.com].Elevate client engagement: act as a vCIO with business-aligned IT roadmaps, conduct outcome-focused QBRs, provide transparent ROI dashboards (e.g. uptime improved, incidents prevented), and personalize support [channele2e.com], [provaltech.com].
Compliance & GovernanceProactive compliance management is not standard – many SMBs lack guidance on regulatory requirements and data governance [deskday.com].Offer compliance-as-a-service: audit and ensure adherence to standards (GDPR, HIPAA, PCI), deliver automated compliance reports, and keep clients ahead of regulatory changes (adopt “compliance-first” service design) [deskday.com], [deskday.com].
Process AutomationOperations still too manual – MSPs waste 100+ hours/month on tasks (ticket entry, reporting) due to disjointed tools and <25% workflow automation [suppfusion.com], [suppfusion.com].Maximize automation: integrate PSA/RMM and other tools to eliminate duplicate data entry [kaseya.com], use scripts/RPA for routine maintenance, auto-generate reports (e.g. for QBRs) to free time for strategic work [suppfusion.com], [suppfusion.com].
Workforce DevelopmentSkill shortages and burnout persist – over 52% of MSPs cite hiring skilled staff as a top challenge [deskday.com], and overworked teams (59% working holidays) reflect understaffing [kaseya.com].Bolster talent and capacity: invest in upskilling (certifications, training) [provaltech.com], improve work-life balance by offloading work (e.g. outsource NOC/SOC via white-label partners) [deskday.com], and create clear career paths to retain experts [provaltech.com].

Below, we dive into each of these focus areas, examining what MSPs are not doing well today and how they can improve in 2026, with examples and global trends in mind.

1. Strengthening Cybersecurity & Resilience

Cybersecurity is the number-one growth driver in managed services, yet many MSPs’ security offerings haven’t kept pace with evolving threats. What’s not done well: Too often, MSP security is reactive – providing basic antivirus, firewalls, and backups – but lacking in proactive threat hunting, continuous monitoring, and incident response planning. Many providers still treat security as an add-on, rather than baking it into every service. Crucially, clients now expect more: they want their MSP to be a comprehensive security partner, handling advanced threats and compliance needs, not just a help-desk for cyber issues. For example, SMBs are increasingly asking MSPs for help with compliance and cyber insurance requirements – areas in which some MSPs are underprepared. [deskday.com] [provaltech.com]

Focus for 2026: MSPs must shift from reactive to proactive security. This means adopting 24×7 threat monitoring and rapid response capabilities. For instance, a provider might set up a managed detection and response (MDR) service or partner with a Security Operations Center (SOC) to monitor client networks around the clock for intrusions. MSPs should implement zero-trust security frameworks (verify every user/device), enforce multi-factor authentication (MFA) everywhere, and regularly test backup and disaster recovery plans. Security awareness training for client employees is also key – many breaches start with human error, so MSPs should run phishing simulations and training sessions to harden the human element.

Moreover, expanding compliance services is critical. Compliance has become “table stakes” for clients in regulated industries like healthcare, finance, and manufacturing. Yet not all MSPs offer systematic compliance support today. In 2026, leading MSPs will offer Compliance-as-a-Service – e.g. continuous monitoring of compliance (using tools aligned to standards like HIPAA, PCI DSS, GDPR), automated audit reporting, and guiding clients through regulatory changes. An MSP might, for example, maintain a compliance dashboard for each client that tracks data backup practices, access controls, software patch levels, and other policy requirements in real-time. By doing so, the MSP not only protects the client’s data but also helps them avoid fines or legal issues. [deskday.com]

Example Action – Cybersecurity: One MSP serving many SMB law firms realized its basic security package was insufficient. In 2026, it invested in an AI-enhanced threat detection system and partnered with a specialized managed SIEM provider to filter and analyze logs across all client sites. It also began conducting quarterly security posture reviews for each client, showing how many attacks were blocked and recommending next steps (like encrypting all mobile devices). This proactive stance not only reduced incidents but also reassured clients with compliance concerns (e.g. demonstrating support for GDPR and emerging privacy laws). As a result, the MSP could “command premium pricing” for its security-centric services while building deeper trust with customers. [deskday.com]

In summary, cybersecurity in 2026 should permeate every aspect of an MSP’s offerings. The MSPs that succeed will be those who anticipate threats (using advanced tools and intelligence), respond swiftly to incidents, and ensure clients meet security compliance mandates. Given that cybersecurity services are growing ~18% annually (faster than the overall MSP market), investing in these capabilities is both a defensive move and a major growth opportunity. [deskday.com]

2. Optimizing Cloud Services & Infrastructure

Cloud services have become a core component of SMB IT strategies worldwide, but MSPs often struggle to move beyond basic cloud enablement. Current weaknesses: Many MSPs excel at initial cloud migrations (moving an SMB’s servers or applications to AWS/Azure or a private cloud), but fall short in ongoing optimization and multi-cloud expertise. As more businesses adopt complex architectures – e.g. hybrid clouds (mix of on-prem and cloud) and multi-cloud deployments – MSPs need deeper skill in managing and optimizing these environments. In practice, some providers still treat cloud management as a set-and-forget hosting task, missing opportunities to fine-tune performance, optimize costs, or update security configurations continuously. SMB clients, however, increasingly expect their MSP to be the cloud expert who can navigate these complexities: nearly 48% of SMBs now rely on MSPs for public cloud management (a figure climbing each year). [deskday.com]

Focus for 2026: End-to-end cloud lifecycle management should be a priority. MSPs must go beyond provisioning to deliver ongoing optimization, cost management, and integration across cloud platforms. One key area is cost optimization (FinOps) – cloud costs can spiral out of control for SMBs who lack the expertise to right-size resources. An MSP in 2026 should regularly analyze clients’ cloud usage, eliminate waste (e.g. unused VMs or over-provisioned storage), and advise on reserved instances or savings plans. This proactive cost management demonstrates tangible value. In fact, experts note that MSPs should invest in cloud optimization capabilities to meet evolving demand. [channele2e.com]

MSPs also need to handle multi-cloud and hybrid environments confidently. With 73% of organizations using hybrid cloud and multi-cloud adoption doubling in recent years, a provider might, for example, manage an SMB’s Azure infrastructure alongside a Salesforce SaaS and an on-prem file server – ensuring they all work together. Skills in cloud orchestration and monitoring tools (that work across AWS/Azure/GCP) are essential. Security in the cloud is another improvement area: MSPs should implement cloud security best practices like regular cloud vulnerability scans, proper identity & access management, encryption of data at rest and in transit, and configuration audits (using benchmarks such as CIS benchmarks for cloud). [deskday.com]

Emerging technologies present both a challenge and opportunity. Edge computing and IoT integration are on the rise, especially for industries needing real-time data processing (manufacturing, retail, smart devices). In response, MSPs should be prepared to manage distributed edge infrastructure – for example, deploying and monitoring mini-servers or appliances at client sites or in the field that sync with central cloud systems. By developing solutions for edge computing (like local data processing coupled with cloud analytics), an MSP can differentiate itself for clients who require low-latency performance. [deskday.com]

Example Action – Cloud: An MSP with several SMB clients in e-commerce noticed their cloud bills were climbing while performance issues lingered. In 2026, the MSP introduced a Cloud Cost & Performance Audit service. Using cloud management tools, it analyzed each client’s resource utilization and identified overspending (e.g. servers running at 5% utilization). It then implemented auto-scaling and schedule-based resources (shutting down non-critical systems after hours) for those clients, cutting cloud costs by 20%. They also added a multi-cloud backup solution – replicating critical data from the primary AWS environment to an Azure data center – to bolster resilience. The clients not only saved money but also gained confidence that their cloud setup was optimized and fault-tolerant, something they wouldn’t have achieved on their own.

In short, MSPs in 2026 should provide holistic cloud stewardship: from architecture planning and migration through continuous optimization, security, and new tech integration. As SMBs continue to increase spending on cloud and related services, MSPs who deliver efficiency and reliability in the cloud will deepen customer loyalty and attract new business. [channele2e.com]

3. Embracing AI-Driven Solutions and Automation

AI integration is shifting from a buzzword to a competitive necessity for MSPs. By 2026, AI won’t be optional – it will be woven into service delivery for efficiency and smarter support. Where MSPs are lagging: A surprising number of MSPs have been slow to leverage AI in their operations. Surveys show roughly 30% of MSPs are already using AI to eliminate repetitive tasks, but the majority have not yet implemented such solutions, with some firms cautious about AI’s risks or lacking in-house expertise. This reluctance is problematic: AI is rapidly changing MSP economics by automating Tier-1 support tasks, and providers not leveraging AI will struggle to compete on cost and service quality. In essence, larger MSPs (often backed by investors) are racing ahead with AI, widening the efficiency gap over smaller players. [kaseya.com] [channele2e.com]

Focus for 2026: MSPs should embed AI across their workflows to enhance both internal efficiency and customer value. A primary application is in the service desk: deploying AI-driven chatbots or virtual agents that can handle common support queries and basic troubleshooting. By 2026, an AI-powered system can automatically categorize and route tickets, suggest solutions, or even resolve issues (like password resets or simple network glitches) without human intervention. In fact, analysts predict widespread service desk automation could cut ticket volumes by 40–60% and drastically speed up resolution times. This frees up human technicians to focus on more complex issues, improving overall support quality. It’s telling that 87% of MSPs plan to increase AI investments by 2026 – the tools are becoming more accessible (built into RMM/PSA software, for instance) and MSPs recognize the ROI. [deskday.com]

Beyond support, predictive analytics is a game-changer. MSPs should use AI to analyze system logs and performance metrics to predict and prevent failures – for example, forecasting when a server might fail or when storage will run out, so they can fix it before it causes downtime. This predictive maintenance approach was once a luxury but is increasingly expected as part of proactive managed services.

MSPs can also extend AI to augment decision-making and reporting. Modern AI tools can comb through an SMB client’s data and provide insights, such as identifying security anomalies or highlighting usage trends. Some MSPs are starting to use generative AI to draft clearer client communications or create executive summaries of IT performance for quarterly reports. In 2026, we’ll see successful MSPs providing clients with AI-generated insights – for example, an automated monthly report that not only lists incidents resolved, but explains in plain language how those IT events affected the client’s business and recommends improvements (all generated with minimal human editing). [deskday.com]

Furthermore, MSPs should consider offering AI-related services to customers. SMBs often lack the knowledge to implement AI solutions themselves, so an MSP can step in as a guide. This could include setting up an AI-powered analytics platform for a client’s sales data, or integrating an AI chatbot on a client’s website for customer service. Since 55% of businesses expect their MSPs to adopt and deploy AI tech by 2026, showing expertise in practical AI applications can be a major selling point. [deskday.com]

Example Action – AI: A mid-sized MSP in 2025 handled thousands of tickets monthly and struggled with slow response times. In 2026, they integrated an AI service bot into their ticketing system. The bot uses natural language processing to understand incoming emails and chat requests from users – it automatically resolved simple issues (password resets, Wi-Fi setup instructions) and pulled up relevant knowledge base articles for technicians on more complex problems. The result was a 50% reduction in human-handled Level-1 tickets and much faster first responses. Additionally, the MSP began offering an “AI Advisory” service to clients: helping SMBs pilot tools like Microsoft’s AI Copilots or AI-based CRM add-ons to streamline their own business workflows. This not only generated a new revenue stream but also positioned the MSP as an innovation partner.

In sum, AI and automation are key to MSP efficiency and differentiation in 2026. MSPs should aim to automate away the grunt work – from repetitive troubleshooting to data reporting – so they can deliver faster service at scale. Those who fail to leverage AI will find themselves with higher costs and slower service, unable to match “AI-powered” competitors. Embracing AI is thus both a defensive strategy (to stay efficient) and an offensive one (to offer new intelligent services). [channele2e.com]

4. Enhancing Customer Experience and Strategic Value

As technology solutions commoditize, customer experience (CX) and the strategic value an MSP provides become critical differentiators. Today’s SMB clients don’t just want IT support; they want a partner who understands their business and helps it grow. Where MSPs fall short: Many MSPs still operate in a reactive, technical mindset – fixing what’s broken and maintaining systems – but not engaging at the business level or clearly demonstrating value. Clients are increasingly scrutinizing costs and asking, “What am I getting for this monthly fee?”. If the MSP only talks in technical terms (uptime, tickets closed) without linking to business outcomes, clients may feel the partnership is not delivering enough. In fact, MSP industry experts observe that successful MSPs now “sell outcomes, not just services,” using benchmarks and reviews to prove their worth. Many providers have been slow to adopt this outcomes-focused approach. [channele2e.com]

Another aspect of CX is responsiveness and personalization. SMB customers can feel neglected if their provider treats them like just another ticket number. Some MSPs could do better in maintaining regular communication, soliciting feedback, and tailoring their support to each client’s unique needs. It’s telling that clients are asking for more guidance – for example, they want help choosing which software matters, which investments to prioritize, and clarity on why MSP recommendations are made. If MSPs aren’t providing this guidance, clients may seek someone who will. [provaltech.com]

Focus for 2026: MSPs should strive to become trusted advisors to their SMB clients, not just IT fixers. This means deeply understanding each client’s industry, business goals, and challenges, and then aligning technology strategies accordingly. A concrete step is to institute regular strategic meetings – often Quarterly Business Reviews (QBRs) – but these must evolve from perfunctory report-outs to forward-looking planning sessions. Rather than just reciting metrics, the MSP should use QBRs to discuss “Here’s how your IT environment improved your business this quarter, and here’s what we recommend for the next quarter to support your goals.” For example, tie in how a new collaboration tool led to faster project completion for the client, or how the MSP’s quick incident response saved X hours of downtime, preserving the client’s revenue. Actionable outcomes should be the focus of these meetings. [provaltech.com]

To support these strategic discussions, MSPs need to provide clear, tangible reporting of value. Gone are the days of sending a generic monthly uptime report that clients might not even read. In 2026, MSPs should leverage dashboards and analytics to show key performance indicators (KPIs) that matter to the client’s leadership – whether it’s the number of cyber attacks blocked (indicating risk reduction), the time to resolve issues (operational efficiency), or improvements in system performance that enable employee productivity. As one channel expert noted, benchmarks, business reviews, and analytics dashboards have become must-haves for MSPs to prove their value. Clients also “expect more proof of value” – they want to know what was prevented, what improved, how security posture changed, and what’s coming next. Ensuring your data is clean and presented in an accessible way is vital – e.g. an MSP might implement a customer portal where the client can log in anytime to see ticket status, security alerts, and project updates in real time. [channele2e.com] [provaltech.com]

Improving customer experience also involves being proactive and consultative. An MSP should bring new ideas to the client: for instance, recommending a workflow automation tool to an accounting firm client because the MSP knows reducing manual data entry could save them money. This kind of proactive solutioneering shows the MSP is thinking about the client’s business, not just waiting for instructions. Industry trends show that clients in mature markets now expect MSPs to help predict and prevent issues and to speak the language of business outcomes. Instead of waiting for clients to ask for a technology, the MSP should be saying “We’ve analyzed your operations and we think adopting XYZ software could improve your customer satisfaction by 10%, let us help you implement it.” [deskday.com]

Personalization and responsiveness remain key to CX. Simple gestures like having a dedicated account manager who really knows the client’s environment, or sending quick status updates during a major incident, go a long way in building trust. Also, timely support (meeting or exceeding SLAs) is part of the experience – even with automation, MSPs must ensure that when a human touch is needed, they are prompt and effective.

Example Action – Customer Experience: Consider an MSP serving a chain of retail stores. Historically, they just kept the POS systems running. In 2026, the MSP shifts approach: they schedule quarterly strategy sessions with the retailer’s management. In one QBR, they present a dashboard showing that over the holiday season, their support kept 99.9% uptime, preventing an estimated 5 hours of downtime (which, for the retailer, translates to an estimated $50k of sales not lost). They also highlight that by upgrading the store’s Wi-Fi and installing a new inventory management app (their suggestion last quarter), the client’s inventory turnover improved noticeably. Going forward, the MSP recommends a customer analytics tool to help the retailer personalize marketing – a bit outside pure IT infrastructure, but a tech solution aligned to growing the retailer’s business. The client, seeing the MSP’s advice consistently improve outcomes, now views the MSP as a strategic partner rather than just an IT supplier, leading to a long-term contract and openness to more services. [provaltech.com]

In essence, the MSPs that win in 2026 will pair excellent technical service with high-touch, value-driven customer engagement. They will measure their success in the client’s terms (productivity, risk reduction, growth support) and continuously communicate that value. This shift from “vendor” to “partner” status not only improves client satisfaction but provides MSPs with opportunities to broaden their services (since satisfied clients trust them with more tasks). As one MSP CEO put it, support is essential “but strategic guidance becomes the real differentiator”. [provaltech.com]

5. Navigating Compliance and Regulatory Demands

In a world of escalating data regulations and industry-specific rules, compliance has become a critical area where MSPs need to step up. SMBs often lack dedicated compliance officers or expertise, so they look to their MSPs for help in governing IT systems according to laws and standards. Current state: Not all MSPs currently include compliance management in their service portfolio. Many focus on technology uptime and security, assuming compliance (e.g., with data privacy laws or industry regulations) is the client’s responsibility. This gap means SMBs might be unaware of vulnerabilities or violations until an audit or breach occurs. Given the proliferation of regulations – from GDPR and CCPA (privacy) to PCI DSS (payment security), HIPAA (health data), or even sector-specific cybersecurity mandates – MSPs that ignore compliance are leaving clients exposed. In 2025, forward-looking MSPs identified compliance as a major opportunity, noting that continuous compliance monitoring and audit support could command premium services. Yet execution is lagging: compliance is often addressed in a piecemeal way (e.g., enabling encryption here or there) rather than through a structured program. [deskday.com]

Focus for 2026: Make compliance and governance a proactive service, not an afterthought. MSPs should familiarize themselves with the key regulations affecting their client base. For example, if you support medical clinics, HIPAA guidelines on data protection and breach notification should be second nature; if you serve European customers, GDPR’s requirements for data handling and breach reporting must be baked into your processes. In practical terms, MSPs need to audit their clients’ systems for compliance gaps regularly. This could entail running tools that check for data that’s stored without proper encryption, or ensuring that access rights are configured according to least privilege principles.

Offering Compliance-as-a-Service (CaaS) can differentiate an MSP. CaaS might include services such as: policy development (helping an SMB craft an IT usage policy or data retention policy), continuous monitoring (monitoring logins, file transfers, and configurations against compliance benchmarks), and automated compliance reporting. For instance, an MSP can use dashboard tools to map a client’s status against frameworks like NIST or ISO 27001, showing which controls are in place and which need attention. Prior to audits or assessments, the MSP can run an “audit readiness” exercise to fix issues. It’s also wise to educate clients – e.g., hold an annual workshop on new laws (such as updates to privacy regulations) that the client needs to know about. [deskday.com]

Compliance efforts go hand-in-hand with security improvements, but have a distinct business value: they reduce risk of legal penalties and build trust with the client’s customers. SMBs may not have realized their MSP could help here, so proactively offering this service in 2026 can meet an unmet need. Industry data suggests MSPs especially in mature markets (US, Canada, EU, ANZ) are starting to adopt a “compliance-first” service design approach, making compliance a core part of every solution due to strict regulations in these regions. This trend will likely spread worldwide as more countries introduce data protection laws. [deskday.com]

Example Action – Compliance: A small finance company (client of an MSP) faces strict regulations (PCI DSS for credit card data and new cybersecurity mandates from their government). The MSP decides in 2026 to create a Compliance Dashboard for this client. Each month, the dashboard scans the client’s systems: checking that all devices have the latest security patches, that antivirus is active, that only approved personnel accessed sensitive databases, and that backups were performed. The MSP shares this dashboard during monthly calls, so the client sees they are, say, 98% compliant with PCI requirements, with specific recommendations to get to 100%. When the client undergoes its annual audit, the MSP helps generate the required reports (e.g. user access logs, incident logs) at a click of a button. The audit passes without major findings – a stark improvement from previous years. The client’s executives now sleep better knowing compliance is continuously watched by their MSP.

In short, MSPs in 2026 should integrate compliance into their offerings to protect clients not just from hackers, but also from regulators. This involves staying current on relevant laws, leveraging tools to automate compliance checks, and guiding clients through the complex maze of requirements. By doing so, MSPs add a layer of strategic value (shielding clients from fines and reputational damage) and strengthen their role as a long-term partner. Given that regulatory scrutiny is only increasing globally, a proactive stance on compliance is both a defensive necessity and a chance to build trust (clients will know their MSP “has their back” on more than just tech). [deskday.com]

6. Driving Efficiency with Process Automation

Operational efficiency is the backbone of MSP profitability and service quality. Yet, many MSPs today are held back by inefficient, manual processes, which translates into slower service for clients and squeezed margins for the MSP. What’s not working: Despite great advancements in management tools, surveys reveal that MSP teams still spend excessive time on low-value, repetitive tasks. For example, one study found MSP staff spend over 100 hours per month on manual chores like re-entering ticket data between systems, preparing reports for QBRs, and reconciling billing—tasks that could be automated. In interviews, managers admitted that engineers spend “half their week” babysitting these processes instead of focusing on higher-level projects. There’s wide acknowledgment (95% of MSP leaders agree) that automation is required for growth, and that repetitive busywork is blocking strategic initiatives. However, most MSPs estimate they’ve automated fewer than 25% of their core workflows so far. The reasons cited include lack of time to set up automations, disparate tools that don’t talk to each other, and the complexity of custom scripting. This is a clear area where MSPs are not doing well enough currently – they know automation is key, but progress has been uneven and slow. [suppfusion.com]

Focus for 2026: The coming year should be when MSPs aggressively streamline and automate their operations. Efficiency isn’t just about saving money – it directly impacts customer satisfaction (faster, error-free service) and the MSP’s ability to scale without adding headcount. Here are key targets for automation:

  • Integrating Systems: A major source of inefficiency is when the PSA (professional services automation tool, for tickets/billing) doesn’t integrate with the RMM (remote monitoring and management) or other tools – technicians end up copying data from one system to another. In 2026, MSPs should ensure their core platforms are tightly integrated or consider moving to unified platforms. It’s telling that 95% of MSPs say integrating RMM, PSA, backup, and documentation tools is essential. For instance, if a monitoring alert can automatically generate a ticket in the PSA (with all relevant info attached), and that in turn updates documentation and billing records, it cuts out a lot of swivel-chair work. Many MSPs are pursuing tool consolidation – using fewer, more integrated tools – to achieve this. [kaseya.com] [deskday.com]
  • Automating Routine Tasks: Every MSP has a set of mundane tasks that happen daily or weekly – applying patches, updating antivirus definitions, onboarding a new user account, checking backup status, etc. Scripting and RPA (Robotic Process Automation) can handle many of these. By 2026, MSPs should have automated patch management across client devices (with approvals for exceptions), scheduled scripts to resolve common alerts (e.g., auto-restart a service if it stops), and automatic user provisioning workflows (so when a client hires someone, the MSP’s system creates the necessary accounts and permissions through a predefined script). Many MSP tools come with automation capabilities that may be underutilized; now is the time to exploit them fully. As one industry CEO quipped, 2025 was the year of “we should automate that,” and 2026 is the year MSPs must do it – you can’t scale without automation. [provaltech.com]
  • Eliminating Duplicate Work in Client Reporting: As discussed in the CX section, account managers often spend hours collating data for client reports. Automating this reporting is a quick win. MSPs can set up their PSA or BI (business intelligence) tools to pull metrics (tickets resolved, SLA compliance, security events) and generate a polished report or dashboard with minimal human input. This might involve adopting a reporting tool or writing some integrations, but it pays off every quarter, and it allows account managers to spend time on analysis rather than assembly. Some MSPs are adopting client-facing dashboards that are always up-to-date, drastically reducing the need to manually build slide decks. [suppfusion.com]
  • Workflow Automation and AI Ops: Beyond individual tasks, MSPs should examine end-to-end workflows for automation opportunities. For instance, when a monitoring alert comes in (say CPU usage high on a server), a fully automated workflow might create a ticket, run a diagnostic script on the server, attach the results to the ticket, and if a simple threshold condition is met (like a runaway process), even attempt a remediation (kill or restart the process). If that fixes it, the system closes the ticket with notes; if not, it escalates to a human. Achieving such “self-healing” workflows is increasingly possible with AI Ops tools and advanced scripting. The concept of a “Zero-Touch MSP” – where AI handles 90% of tickets and routine changes – is on the horizon and some SMB-focused MSPs will start approaching that model by mastering their vendors’ automation features. [techaisle.com]

To get there, MSPs should overcome barriers by allocating time for automation projects (maybe dedicating a staff member a few hours a week to building automations) and leveraging community scripts and best practices. The new generation of MSP owners, often backed by private equity, are already pushing for this operational efficiency as a mandate. [suppfusion.com], [suppfusion.com]

Example Action – Automation: A 20-person MSP found its engineers were drowning in repetitive tasks and using 10+ different tools that didn’t sync well. In 2026, they embarked on an “Automation Sprint”: First, they consolidated from 3 separate monitoring and ticketing systems to a single unified platform to reduce context switching. Next, they identified the top 5 daily tasks that ate up engineer time – patching Windows, adding new Office365 accounts for clients, resetting passwords, updating tickets, and compiling monthly reports. They created scripts for each: patches now deploy automatically with reports of success/failure; a simple form was built for clients to request new accounts which triggers an automated user creation in all relevant systems; a self-service password reset tool was rolled out; ticket updates between their systems and a major client’s system were linked via API to stop double entry. They also set up a dashboard that pulls data from their PSA to auto-generate QBR slides. Over a few months, they measured a reduction of ~120 hours of busywork per month across the team. Technicians now spend those hours on project work and learning new skills, which benefits both the MSP and its clients through faster project delivery and more informed staff. [kaseya.com] [suppfusion.com]

The lesson is clear: streamlining operations through automation is no longer optional. In 2026, the most successful MSPs will be those who have turned efficiency into a competitive advantage – enabling them to offer faster response times, more consistent service, and even innovative pricing models (because automation can reduce the cost to serve). Clients ultimately benefit from this through fewer errors and quicker service. As MSP commentary notes, the new wave of MSP leadership “expects operational efficiency and scalability” and will prioritize automation and data-driven processes to stay competitive. MSPs should do the same, treating automation not as a one-off project but as an ongoing discipline (continuously finding new ways to eliminate waste and streamline as tools evolve). [suppfusion.com]

7. Investing in Workforce Development and Talent

Behind every successful MSP is a skilled and motivated team. In 2026, human talent remains irreplaceable – even as AI and automation handle more tasks – because people drive the complex problem-solving, relationship management, and strategic planning that set top MSPs apart. The problem: The MSP industry is facing serious talent challenges. There’s a well-documented shortage of IT professionals, especially in high-demand areas like cybersecurity and cloud architecture. According to industry surveys, 52% of MSPs identify hiring and recruiting as their primary challenge, and 68% of IT leaders in MSPs struggle to find cloud and security expertise. The talent gap often forces MSPs to either overwork their existing staff or turn down business. Indeed, burnout is an issue: nearly 40% of MSP techs were working 50+ hour weeks in recent years and 59% had to work through holidays to keep up with workload. Such strain leads to high turnover, which creates a vicious cycle of understaffing. [deskday.com] [kaseya.com]

Moreover, MSPs sometimes underinvest in training their staff. In the rush of daily operations, keeping engineers’ skillsets up-to-date (with new certifications or learning emerging technologies) can fall by the wayside. This leaves teams ill-prepared for new service offerings (like managing a new cloud platform or a new security tool) that clients might demand.

Focus for 2026: MSPs need a multi-pronged strategy to build and maintain a strong workforce, treating talent as a long-term investment:

  • Upskilling and Continuous Learning: Make 2026 the year your MSP implements a formal training program. This could include paying for certifications (e.g. Azure/AWS certifications, cybersecurity certs like CISSP, vendor-specific courses for popular tools). It might mean allocating each engineer a certain number of training hours per quarter that are sacrosanct. By upskilling existing employees, MSPs can fill skill gaps internally. For example, turning a good systems admin into a cloud architect through a structured learning path benefits the MSP far more than trying to hire a cloud architect in a tight market. As one MSP CEO advises, “the MSPs that grow will be the ones that develop the people they already have.”. Also, encourage knowledge sharing within the team (senior engineers mentoring juniors, internal workshops, etc.), which can accelerate learning and increase engagement. [provaltech.com]
  • Use External Support to Augment Staff: When hiring is tough, lean on creative solutions like outsourcing or partnerships. Many MSPs are turning to white-label service providers or contractors for certain functions – e.g. using an outsourced Network Operations Center (NOC) or Security Operations Center (SOC) service that operates under the MSP’s brand. This way, you can offer 24/7 coverage or specialized skills (like advanced cybersecurity analysis) without having to hire for every role. Notably, white-label partnerships have grown ~80% over three years in the MSP space. For an MSP, this could mean partnering with a third-party to handle after-hours support or level-1 tickets, relieving your core team at night. Or outsourcing complex tasks like mobile app support to a niche firm. The key is to convert fixed labor costs into flexible resources – scaling up when needed, scaling down when not, while your clients still experience a seamless service. In 2026, MSPs should evaluate which services are better done in-house versus through partners, and not be afraid to offload non-core or hard-to-hire areas. [deskday.com]
  • Improve Work-Life Balance and Retention: Recognize that burnout will cause you to lose the talent you have. MSP leadership should institute policies to protect their teams from perpetual overwork. This might involve hiring ahead of demand when possible, using automation (as above) to remove after-hours pager fatigue, and enforcing time-off so people can recharge. Flexible work arrangements (remote work options, which are common now) can help retain employees too. Additionally, create clear career paths within the MSP. One reason people leave is the feeling of stagnation; show your techs how they can progress to senior roles, lead specialist positions, or even vCIO-type consulting roles as they grow. Regular 1:1s discussing career goals and aligning training to those goals can improve morale and loyalty. [provaltech.com]
  • Leverage Vendor Training and Communities: Many tech vendors (Microsoft, Cisco, security vendors, etc.) offer extensive training resources for their partners. In the next year, make sure to tap into these vendor-backed training programs. For example, if a new security product is launched that you plan to offer, send engineers to the vendor’s certification course early. Encouraging staff to participate in MSP communities or events (like user groups, webinars, industry conferences) can also spark new ideas and professional growth, which they bring back to your business. The channel is expecting more vendor support in this area – so take advantage of it. [channele2e.com]

Example Action – Workforce: A growing MSP of 15 employees had trouble hiring senior cloud engineers in 2025. In 2026, they took a different approach: they identified two junior techs with interest in cloud and enrolled them in an accelerated Azure training program (funded by the MSP). Within months, those juniors earned certifications and started taking on cloud project work under supervision, filling much of the gap. To cover overnight shifts, the MSP contracted with a reputable NOC service that would handle alerts from midnight to 6 AM, so their on-call engineers could actually rest at night. They also instituted “Tech Fridays” – every second Friday afternoon, the company sets aside client work and all staff focus on learning: taking an online course, lab time, or sharing knowledge with peers. This became a valued perk and led to cross-training (e.g. the security specialist taught a class on advanced firewall management to others). By year-end, employee satisfaction (measured via survey) was up significantly, the MSP’s attrition dropped to near-zero, and their enhanced skills meant they could offer new services (like Azure database management) without external hires.

In summary, solving the talent puzzle is vital for 2026. MSPs should treat their employees as their greatest asset, because they are. A combination of developing internal talent, easing workloads through smart resourcing and automation, and fostering a positive work environment will pay dividends. Not only will this ensure you have the skills to deliver all the advanced services discussed (security, cloud, AI, etc.), but clients will notice stability and expertise in their interactions (frequent turnover or junior, untrained support is a red flag to many customers). Given the tight labor market, MSPs that invest in people will be the ones with the capacity to grow and innovate, whereas those that neglect it may find they can’t meet client needs or quality standards due to staffing shortfalls.


Conclusion: Succeeding in 2026 – From MSP to Business Partner

Entering 2026, MSPs globally – especially those catering to SMBs – must retool and refocus across these critical operational areas. The overarching theme is moving up the value chain: from putting out IT fires to delivering strategic prevention; from offering generic services to providing specialized, client-tailored solutions; from using people for every task to harnessing automation and AI for scalability. The challenges are real – cyber threats are more serious, technology is more complex, competition is fiercer, and clients are more demanding. But so are the opportunities: SMBs are investing heavily in technology and rely on MSPs more than ever for expertise. The MSPs that proactively improve in the areas discussed – security, cloud, AI, customer success, compliance, efficiency, and talent – will position themselves to capture this growth. [deskday.com]

It’s worth noting that in mature IT markets, clients now expect MSPs to behave almost like consulting partners with automation engines, blending advisory insight with flawless execution. This is a useful vision for 2026: an MSP that can talk business outcomes, ensure compliance and security, implement cutting-edge tech (cloud/AI) smoothly, and continually optimize its own operations behind the scenes. Achieving all of this at once is daunting, so MSPs should prioritize incrementally: for example, “secure first, automate second” – shoring up cybersecurity and compliance before layering fancy AI, since automation without security just accelerates risk. They should also pick a focus – mastering one vertical or technical specialty at a time – rather than try to do everything broadly. [deskday.com]

By addressing what is not being done well today and committing to these improvements, MSPs can transform their businesses in 2026. The payoff will be stronger customer relationships (and contract renewals), higher margins (through efficiency and premium services), and sustainable growth even in competitive markets. In contrast, MSPs that cling to the old break-fix, “one-size-fits-all” mindset will increasingly struggle – facing commoditization and client churn as they fail to meet rising standards. [deskday.com]

In conclusion, 2026 is set to be a pivotal year for the MSP industry. It will reward providers who are bold and strategic – those who invest in AI and automation, build deep security and compliance capabilities, tailor their services to client needs, and nurture talented teams. MSPs that embrace these changes will not just survive the evolving landscape, they will thrive as indispensable partners in their customers’ success. The blueprint is clear; now it’s about execution. As the industry saying goes, the MSPs who evolve will lead, and those who don’t will be left behind. By focusing on the areas outlined above, MSPs can ensure they are on the leading side of that equation in 2026.

How to Configure Microsoft 365 Business Premium to Block AI Browsers: A Complete Guide to Stopping Comet and Other Agentic Browsers

Executive Summary

In December 2025, Gartner issued an urgent advisory recommending that organizations “block all AI browsers for the foreseeable future” due to critical cybersecurity risks.AI browsers like Perplexity’s Comet and OpenAI’s ChatGPT Atlas introduce threats including irreversible data loss, prompt injection vulnerabilities, and unauthorized credential access.With 27.7% of organizations already having at least one user with an AI browser installed,the time to act is now. [computerworld.com]

This comprehensive guide provides step-by-step instructions for configuring Microsoft 365 Business Premium (M365 BP), specifically Microsoft Defender for Cloud Apps, to detect, monitor, and block AI-enabled browsers like Comet from accessing your enterprise resources.


Understanding the AI Browser Threat Landscape

Why AI Browsers Are Dangerous

According to Gartner analysts, “The real issue is that the loss of sensitive data to AI services can be irreversible and untraceable. Organizations may never recover lost data.” [computerworld.com]

Key Security Concerns:

  1. Autonomous Actions Without Oversight – AI browsers can autonomously navigate websites, fill out forms, and complete transactions while authenticated, creating accountability concerns for erroneous or malicious actions [computerworld.com]
  2. Traditional Controls Are Inadequate – “Traditional controls are inadequate for the new risks introduced by AI browsers, and solutions are only beginning to emerge,” according to Gartner’s senior director analyst Evgeny Mirolyubov [computerworld.com]
  3. Multi-Modal Communication Gaps – A major gap exists in inspecting multi-modal communications with browsers, including voice commands to AI browsers [computerworld.com]
  4. Immature Security Posture – Discovered vulnerabilities highlight broader concerns about the maturity of AI browser technology, with solutions likely taking “a matter of years rather than months” to mature [computerworld.com]

Prerequisites and Licensing Requirements

Required Licenses

To implement comprehensive AI browser blocking, you need: [wolkenman….dpress.com]

License OptionWhat’s Included
Microsoft 365 Business Premium + E5 Security Add-onDefender for Cloud Apps + Defender for Endpoint
Microsoft 365 E5 / A5 / G5Full suite including Conditional Access App Control
Enterprise Mobility + Security E5Defender for Cloud Apps + Defender for Endpoint
Microsoft 365 F5 Security & ComplianceAll required components
Microsoft 365 Business Premium + Defender for Cloud Apps Add-onMinimum required configuration

Technical Prerequisites

Before implementing blocking policies, ensure: [learn.microsoft.com], [learn.microsoft.com]

  • Microsoft Defender for Cloud Apps license (standalone or bundled)
  • Microsoft Entra ID P1 license (standalone or bundled)
  • Microsoft Defender for Endpoint deployed and configured
  • Cloud Protection enabled in Defender for Endpoint [learn.microsoft.com]
  • Network Protection enabled in Defender for Endpoint [learn.microsoft.com]
  • Admin permissions – Global Administrator or Security Administrator role
  • Microsoft Defender Browser Protection extension installed on non-Edge browsers [learn.microsoft.com]

Multi-Layered Defense Strategy

Blocking AI browsers requires a comprehensive, defense-in-depth approach using multiple Microsoft 365 security layers:


Configuration Guide: Step-by-Step Implementation

Phase 1: Enable Cloud Discovery for AI Applications

Objective: Gain visibility into which AI browsers and applications are being used in your organization.

Step 1.1: Access Cloud Discovery Dashboard

  1. Navigate to Microsoft Defender Portal (https://security.microsoft.com)
  2. Go to Cloud AppsCloud DiscoveryDashboard
  3. Set the time range to Last 90 days for comprehensive analysis [wolkenman….dpress.com]

Step 1.2: Filter for Generative AI Applications

  1. In the Cloud Discovery dashboard, click Category filter
  2. Select “Generative AI” from the category list [wolkenman….dpress.com]
  3. Review discovered AI applications with their risk scores
  4. Note applications with High Risk status (red indicators) [wolkenman….dpress.com]

Step 1.3: Identify AI Model Providers and MCP Servers

Beyond browsers, also identify: [wolkenman….dpress.com]

  • AI – Model Providers (Azure OpenAI API, Google Gemini API, Anthropic Claude API)
  • AI – MCP Servers (Model Context Protocol servers)

Navigate to: Cloud AppsCloud App Catalog → Filter by “AI – Model Providers” and “AI – MCP Servers”


Phase 2: Configure Defender for Endpoint Integration

Objective: Enable automatic blocking of unsanctioned apps through network-level enforcement.

Step 2.1: Enable Enforce App Access

  1. In Microsoft Defender Portal, navigate to:
  2. Toggle “Automatically block unsanctioned apps” to ON
  3. This creates automatic indicators in Defender for Endpoint when apps are marked as unsanctioned [wolkenman….dpress.com]

Step 2.2: Verify Network Protection Status

Ensure Network Protection is enabled for all browsers: [wolkenman….dpress.com]

  1. Navigate to SettingsEndpointsConfiguration Management
  2. Go to Enforcement ScopeNetwork Protection
  3. Verify status is set to “Block mode” (not just Audit mode)
  4. Apply to All devices or specific device groups

Why This Matters: Network Protection ensures that blocks work across all browsers (Chrome, Firefox, etc.), not just Microsoft Edge. [wolkenman….dpress.com]


Phase 3: Unsanction and Block Comet Browser

Objective: Mark Comet and other AI browsers as unsanctioned to trigger automatic blocking.

Step 3.1: Search for Comet in Cloud App Catalog

  1. Go to Cloud AppsCloud App Catalog
  2. Use the search function to find “Comet” or “Perplexity”
  3. Click on the application to review its risk assessment

Note: If Comet hasn’t been discovered yet in your environment, you can still add custom URLs for blocking (see Phase 6).

Step 3.2: Unsanction the Application

  1. Click the three dots (⋮) at the end of the application row
  2. Select “Unsanctioned” [learn.microsoft.com]
  3. A confirmation dialog will appear indicating the app will be blocked by Defender for Endpoint [wolkenman….dpress.com]
  4. Click Confirm

Step 3.3: Verify Indicator Creation

  1. Navigate to SettingsEndpointsIndicatorsURLs/Domains [wolkenman….dpress.com]
  2. Confirm that domains associated with Comet appear with action “Block execution”
  3. Processing may take 5-15 minutes

Example domains that may be blocked:

  • *.perplexity.ai
  • comet.perplexity.ai
  • Related CDN and API endpoints

Phase 4: Create Conditional Access Policies

Objective: Route traffic through Defender for Cloud Apps proxy for deep inspection and control.

Step 4.1: Create Base Conditional Access Policy

  1. Sign in to Microsoft Entra Admin Center (https://entra.microsoft.com)
  2. Navigate to ProtectionConditional AccessPolicies
  3. Click + New policy [learn.microsoft.com]

Step 4.2: Configure Policy Settings

Policy Name: Block AI Browsers via Session Control

Assignments: [learn.microsoft.com]

SettingConfiguration
UsersSelect All users (exclude break-glass accounts)
Target ResourcesSelect Office 365, SharePoint Online, Exchange Online
ConditionsOptional: Add device platform, location filters

Access Controls: [learn.microsoft.com]

  • Under Session → Select “Use Conditional Access App Control”
  • Choose “Use custom policy”
  • Click Select

Enable Policy: Set to Report-only initially for testing [learn.microsoft.com]

Step 4.3: Save and Validate

  1. Click Create
  2. Wait 5-10 minutes for policy propagation
  3. Test with a pilot user account

Critical Note: Ensure the “Microsoft Defender for Cloud Apps – Session Controls” application is NOT blocked by other Conditional Access policies, or session controls will fail. [learn.microsoft.com]


Phase 5: Create Session Policies to Block AI Browser User Agents

Objective: Create real-time session policies that identify and block AI browsers based on user-agent strings and behavioral patterns.

Step 5.1: Create Access Policy for User-Agent Blocking

This is one of the most effective methods to block specific browsers like Comet. [securityhq.com]

  1. In Microsoft Defender Portal, navigate to:
  2. Click Create policyAccess policy [learn.microsoft.com]

Step 5.2: Configure Access Policy Details

Basic Information: [learn.microsoft.com]

FieldValue
Policy NameBlock AI Browsers - Comet and Similar Agents
Policy SeverityHigh
CategoryAccess control
DescriptionBlocks access attempts from AI-enabled browsers including Comet, Atlas, and other agentic browsers based on user-agent detection

Step 5.3: Set Activity Filters

Activities matching all of the following: [learn.microsoft.com]

  1. App: Select applications to protect
    • Office 365
    • Exchange Online
    • SharePoint Online
    • Microsoft Teams
    • OneDrive for Business
  2. Client app: Select Browser [learn.microsoft.com]
  3. User agent tag:
    • Contains “Comet”
    • Or create custom user-agent filter (see Step 5.4)
  4. Device type: (Optional) Apply to specific device types

Step 5.4: Create Custom User-Agent String Filters

While Defender for Cloud Apps doesn’t expose direct user-agent string matching in the UI by default, you can leverage activity filters: [securityhq.com]

Known AI Browser User-Agent Patterns to Block:

User-Agent patterns (Create separate policies or use contains logic):
- Contains "Comet"
- Contains "Perplexity"
- Contains "axios" (common in automated tools)
- Contains "ChatGPT" (for Atlas browser)
- Contains "AI-Browser"
- Contains "agentic"

Advanced Method – Using Session Policy with Inspection:

  1. Create a Session Policy instead of Access Policy
  2. Set Session control type: to “Block activities” [learn.microsoft.com]
  3. Under Activity type, select relevant activities
  4. In Inspection method, configure content inspection rules

Step 5.5: Set Actions

Actions:

  • Select “Block”
  • Enable “Notify users” with custom message:
Access Denied: AI-Enabled Browser Detected

Your organization's security policy prohibits the use of AI-enabled browsers 
(such as Comet, Atlas, or similar tools) to access corporate resources due to 
data security and compliance requirements.

Please use Microsoft Edge, Chrome, or Firefox to access this resource.

If you believe this is an error, contact your IT helpdesk.

Step 5.6: Enable Governance Actions

  • Select “Send email to user”
  • Select “Alert severity” as High
  • Enable “Create an alert for each matching event”

Step 5.7: Activate the Policy

  1. Review all settings
  2. Click Create
  3. Policy becomes active immediately
  4. Monitor via Activity Log for matches

Phase 6: Block Comet Domains via Custom Indicators

Objective: Manually add Comet-related domains to Defender for Endpoint indicators for network-level blocking.

Step 6.1: Identify Comet-Related Domains

Based on Perplexity’s infrastructure, key domains include: [computerworld.com]

Primary Domains:
- perplexity.ai
- www.perplexity.ai
- comet.perplexity.ai
- api.perplexity.ai

CDN and Supporting Infrastructure:
- *.perplexity.ai (wildcard)
- assets.perplexity.ai
- cdn.perplexity.ai

Step 6.2: Create URL/Domain Indicators

  1. Navigate to SettingsEndpointsIndicatorsURLs/Domains
  2. Click + Add item

For each domain, configure:

FieldValue
Indicatorperplexity.ai
ActionBlock
ScopeAll device groups (or specific groups)
TitleBlock Perplexity Comet Browser
DescriptionBlocks access to Perplexity Comet AI browser per organizational security policy
SeverityHigh
Generate alertYes
  1. Click Save
  2. Repeat for all identified domains

Step 6.3: Test Domain Blocking

  1. From a test device with Defender for Endpoint installed
  2. Navigate to https://www.perplexity.ai in any browser
  3. You should see: [wolkenman….dpress.com]
This site has been blocked by your organization
Microsoft Defender SmartScreen blocked this unsafe site

This web page was blocked by Microsoft Defender Application Control
perplexity.ai has been blocked by your IT administrator


Phase 7: Create Cloud Discovery Policies for Alerting

Objective: Set up automated alerts when AI browsers are detected in your environment.

Step 7.1: Create App Discovery Policy

  1. Navigate to Cloud AppsPoliciesPolicy Management
  2. Click Create policyApp discovery policy [learn.microsoft.com]

Step 7.2: Configure Discovery Policy

Policy Template: Use “New risky app” template or create custom [learn.microsoft.com]

FieldConfiguration
Policy NameAlert on New AI Browser Detection
CategoryCloud discovery
Risk scoreHigh and Medium
App categorySelect “Generative AI”
Traffic volumeGreater than 10 MB (adjust as needed)

Filters:

  • App category equals Generative AI
  • Risk score less than or equal to 6 (out of 10)
  • App tag equals Unsanctioned

Governance Actions:

  • Send email to security team
  • Create alert with High severity

Testing and Validation

Validation Checklist

Monitoring and Reporting

Activity Log Monitoring:

  1. Cloud AppsActivity Log
  2. Filter by:
    • Policy: Select your AI browser blocking policies
    • Action taken: Block
    • Date range: Last 7 days

Defender for Endpoint Alerts:

  1. Incidents & AlertsAlerts
  2. Filter by:
    • Category: Custom indicator block
    • Title: Contains “Perplexity” or “Comet”

Advanced Configuration Options

Option 1: Device Compliance Requirements

Combine AI browser blocking with device compliance:

  1. In Conditional Access policy, add ConditionsDevice platforms
  2. Require devices to be Compliant or Hybrid Azure AD Joined
  3. Use Intune compliance policies to check for:
    • Comet browser installation (custom script detection)
    • Other AI browser installations

Option 2: Warn and Educate Mode

Before full blocking, consider “Warn and Educate” mode: [learn.microsoft.com]

  1. Set indicators to “Warn” instead of “Block”
  2. Users see warning message but can proceed (with logging)
  3. Collect usage data for 2-4 weeks
  4. Transition to Block mode after user education

Option 3: Scoped Blocking by Device Groups

Target specific departments first:

  1. In Defender for Endpoint, create device groups:
    • Finance Team
    • Executive Leadership
    • High-Risk Departments
  2. Apply indicators only to these groups initially
  3. Expand gradually after validation

Option 4: DLP Integration for Data Leaving via AI Browsers

Even with blocks, ensure data leakage prevention:

  1. Create Microsoft Purview DLP policies
  2. Target “All locations” including endpoints
  3. Configure rules to detect sensitive data:
    • Credit card numbers
    • Social Security numbers
    • Confidential project names
  4. Block upload/sharing of sensitive content

Identifying Comet Browser Technical Indicators

User-Agent String Analysis

While official Comet user-agent strings aren’t publicly documented by Perplexity, AI browsers typically exhibit these patterns:

Common AI Browser User-Agent Characteristics:

Mozilla/5.0 (Platform) ... Comet/[version]
Mozilla/5.0 (Platform) ... Perplexity/[version]
Chromium-based with custom identifiers
May contain "AI", "Agent", "Agentic" in UA string

Detection Strategy:

  1. Review Activity Log in Defender for Cloud Apps
  2. Filter for unknown/suspicious user agents
  3. Export activity data with user-agent strings
  4. Analyze patterns using PowerShell or Excel
  5. Update policies based on findings

Network Traffic Patterns

Comet communicates with Perplexity cloud infrastructure: [computerworld.com]

  • High-frequency API calls to api.perplexity.ai
  • WebSocket connections for real-time AI responses
  • Upload of page content and browsing context
  • Telemetry to Perplexity servers

Monitor via Defender for Cloud Apps:

  • Cloud AppsActivity Log
  • Filter by IP address ranges (if known)
  • Look for unusual upload patterns

Troubleshooting Common Issues

Issue 1: Blocks Not Working in Chrome/Firefox

Symptom: Comet/Perplexity sites accessible in non-Edge browsers

Solution: [wolkenman….dpress.com]

  1. Verify Network Protection is enabled in Defender for Endpoint
  2. Check SettingsEndpointsConfiguration Management
  3. Ensure status is “Block” not “Audit”
  4. Restart browser and test again

Issue 2: Conditional Access Policy Not Triggering

Symptom: Users can access M365 apps without session controls

Solution:

  1. Verify Conditional Access policy is in “On” mode (not Report-only) [learn.microsoft.com]
  2. Check that “Microsoft Defender for Cloud Apps – Session Controls” app is not blocked
  3. Ensure apps are listed as “Monitored” in Conditional Access App Control [securityhq.com]
  4. Clear browser cache and test in incognito mode

Issue 3: Legitimate Traffic Being Blocked

Symptom: False positives blocking valid user activity

Solution:

  1. Review Activity Log for specific blocked events
  2. Refine user-agent filters to be more specific
  3. Create exception policies for legitimate tools
  4. Use “Exclude” filters in policies for specific users/groups

Issue 4: Indicators Not Appearing in Defender for Endpoint

Symptom: Unsanctioned apps don’t create indicators

Solution:

  1. Verify “Enforce App Access” is enabled [wolkenman….dpress.com]
  2. Check that Defender for Endpoint integration is active
  3. Wait 15-30 minutes for synchronization
  4. Manually create indicators if automatic creation fails

Best Practices and Recommendations

Strategic Recommendations

  1. Phased Rollout Approach
    • Week 1-2: Report-only mode, gather usage data
    • Week 3-4: Warn mode for user education
    • Week 5+: Full block mode enforcement
  2. User Communication Strategy[computerworld.com]
    • Send organization-wide email explaining policy
    • Provide approved alternatives
    • Create FAQ document
    • Offer training on secure browsing practices
  3. Continuous Monitoring
    • Review Cloud Discovery weekly for new AI apps
    • Monitor activity logs daily for policy violations
    • Track emerging AI browser releases
    • Update indicators quarterly
  4. Exception Process
    • Create formal request process for exceptions
    • Require executive approval for high-risk apps
    • Document business justification
    • Apply additional controls for approved exceptions (DLP, session monitoring)
  5. Defense in Depth[wolkenman….dpress.com]
    • Don’t rely solely on browser blocking
    • Implement data loss prevention (DLP)
    • Use endpoint detection and response (EDR)
    • Enable Microsoft Purview for data governance
    • Deploy insider risk management

Policy Comparison Table

MethodScopeEffectivenessUser ExperienceManagement Overhead
Cloud Discovery + UnsanctioningNetwork-wide⭐⭐⭐⭐⭐Transparent (blocked before access)Low (automated)
Session PoliciesM365 Apps only⭐⭐⭐⭐May show warning messagesMedium (requires tuning)
Access PoliciesM365 Apps only⭐⭐⭐⭐⭐Blocks before session startsMedium
Manual IndicatorsAll network traffic⭐⭐⭐⭐TransparentHigh (manual updates)
Conditional AccessCloud apps only⭐⭐⭐⭐May require re-authenticationLow

Recommended Combination: Use Cloud Discovery + Unsanctioning AND Access Policies for comprehensive coverage.


Staying Current: Monitoring New AI Browsers

AI browsers are rapidly evolving. Stay ahead of threats:

Monthly Review Checklist

Cloud App Catalog Updates

  • Review newly discovered apps in Generative AI category
  • Check for new AI Model Providers
  • Assess risk scores of emerging tools

Threat Intelligence

  • Monitor Gartner reports on AI browser security [gartner.com]
  • Follow Microsoft Security Blog
  • Subscribe to CISA alerts
  • Track CVE databases for AI browser vulnerabilities

Policy Effectiveness

  • Review blocked connection attempts
  • Analyze bypass attempts
  • Update user-agent filters
  • Refine domain lists

Emerging AI Browsers to Monitor

Beyond Comet and Atlas, watch for:

  • Brave Leo Browser (AI-enhanced features)
  • Opera One (integrated AI)
  • Arc Browser (with AI capabilities)
  • SigmaOS (AI-powered browsing)
  • Browser Company products

Compliance and Documentation

Required Documentation

Maintain these records for audit purposes:

  1. Policy Documentation
    • Policy names, purposes, and justifications
    • Configuration settings and filters
    • Approval chains and stakeholder sign-offs
  2. Change Log
    • Policy modifications
    • Domain additions/removals
    • Exception approvals
  3. Incident Reports
    • Blocked access attempts
    • Policy violations
    • User complaints and resolutions
  4. Risk Assessment
    • Why AI browsers are blocked
    • Business impact analysis
    • Alternative solutions provided to users

Regulatory Considerations

Consider these compliance frameworks:

FrameworkRelevance
GDPRData processing outside organization control
HIPAAProtected health information exfiltration risk
SOXFinancial data protection requirements
PCI DSSCardholder data security
NIST 800-53Access control requirements

Conclusion: Taking Action Against AI Browser Risks

The threat posed by AI browsers like Perplexity’s Comet is real, immediate, and growing. With security experts uniformly recommending that organizations “block all AI browsers for the foreseeable future,”the time for action is now—not later. [pcmag.com], [gartner.com]

Key Takeaways:

  1. Gartner’s Warning is Clear: AI browsers introduce “irreversible and untraceable” data loss risks that traditional controls cannot adequately mitigate [computerworld.com]
  2. Multi-Layered Defense is Essential: Combining Cloud Discovery, Session Policies, Access Policies, and Network Protection provides comprehensive coverage
  3. Microsoft 365 Business Premium Provides the Tools: With Defender for Cloud Apps and Defender for Endpoint, you have enterprise-grade capabilities to detect and block AI browsers
  4. User Education is Critical: Technical controls must be paired with clear communication about why AI browsers pose risks and what alternatives are approved
  5. Continuous Vigilance Required: The AI browser landscape evolves rapidly; monthly reviews of your defenses are essential [computerworld.com]

Immediate Action Steps

This Week:

  1. ✅ Enable Cloud Discovery and filter for Generative AI apps
  2. ✅ Review current AI browser usage in your organization
  3. ✅ Enable “Enforce App Access” in Defender for Cloud Apps
  4. ✅ Verify Network Protection is enabled in Defender for Endpoint

Next Week:

  1. ✅ Create Conditional Access policy routing traffic to MDCA
  2. ✅ Unsanction Comet and other AI browsers
  3. ✅ Create custom domain indicators for Perplexity infrastructure
  4. ✅ Deploy in Report-only mode for pilot group

Within 30 Days:

  1. ✅ Create Access Policies with user-agent filtering
  2. ✅ Enable full blocking mode organization-wide
  3. ✅ Communicate policy to all users
  4. ✅ Establish ongoing monitoring processes

Additional Resources

Microsoft Documentation:

Security Research:

Community Resources:


Disabling Office Macros via ASR to Meet Essential Eight Requirements

Using M365 Business Premium

The Essential Eight Mitigation Strategy #3 – Configure Microsoft Office Macro Settings requires organizations to disable Office macros by default for users without a demonstrated business need.1In cloud-only environments using Microsoft 365 Business Premium and Microsoft Intune, this can be achieved through multiple complementary approaches: 

  1. Configuration Profiles (Settings Catalog or Imported Administrative Templates) 
  1. Attack Surface Reduction (ASR) Rules 
  1. Microsoft Defender for Endpoint capabilities (included in Business Premium) 

However, there is an important limitation: Microsoft 365 Business Premium includes Microsoft 365 Apps for Business, which has limited support for the Office Cloud Policy Service—only privacy-related policies are supported.2For full macro control policies, you must use Configuration Profiles in Intune instead.3 


Understanding Essential Eight Macro Security Requirements 

Essential Eight Maturity Level Requirements 

The Australian Cyber Security Centre (ACSC) Essential Eight framework defines specific controls for Microsoft Office macro security:4 

Key ISM Controls (March 2025) 

The Essential Eight implementation addresses multiple Information Security Manual (ISM) controls:5 

ISM Control Requirement Implementation Method 
ISM-1671 Macros disabled for users without business requirement Configure “Disable VBA for Office applications” policy 
ISM-1488 Block macros from internet sources Enable “Block macros from running in Office files from the internet” 
ISM-1675 Disable Trust Bar for unsigned macros Configure “Disable Trust Bar Notification for unsigned applications” 
ISM-1672 Enable macro antivirus scanning Set “Macro Runtime Scan Scope” to “Enable for all documents” 
ISM-1673 Block Win32 API calls from macros Deploy ASR rule 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B 
ISM-1489 Prevent users from changing macro settings Deploy policies via Intune (users cannot modify) 

Microsoft 365 Business Premium Capabilities for Macro Control 

What’s Included in Business Premium 

Microsoft 365 Business Premium includes: 

  • Microsoft Intune for device management 
  • Microsoft Defender for Business (includes Attack Surface Reduction) 
  • Microsoft 365 Apps for Business (desktop applications) 

Important Licensing Limitations 

⚠️ Critical Consideration: The Office Cloud Policy Service (config.office.com) has limited functionality with Microsoft 365 Apps for Business: 

  • Only privacy control policies are supported6 
  • Full macro security policies are NOT supported via Office Cloud Policy Service for Business licenses7 
  • You must use Intune Configuration Profiles (Settings Catalog or Administrative Templates) instead 

For full Office Cloud Policy Service support, you would need Microsoft 365 Apps for Enterprise licenses.8 


Implementation Approach: Configuration Profiles in Intune 

Method 1: Import Pre-Built ACSC Hardening Policy (Recommended) 

Microsoft provides pre-built configuration profiles aligned with ACSC guidance. This is the fastest and most reliable method for Essential Eight compliance. 

Step-by-Step: Import ACSC Office Hardening Policy 

Detailed Steps:9 

  1. Create Target User Group 
  • Create an Azure AD security group for “All Office Users” 
  • This group will receive Office apps and hardening policies 
  1. Download ACSC Policy Template 
  • Download the ACSC Office Hardening Guidelines JSON file10 
  1. Import to Intune 
  • Sign in to Microsoft Intune admin center: https://intune.microsoft.com[^1] 
  • Navigate to: Devices > Windows > Configuration profiles > Create 
  • Select: Import Policy 
  • Name: “ACSC Office Hardening – All Macros Disabled” 
  • Browse for the downloaded JSON file 
  • Click Save11 
  1. Import OLE Prevention Script 
  • Navigate to: Devices > Scripts > Add > Windows 10 and later 
  • Name: “OLE Package Prevention” 
  • Configure: 
  • Run script using logged-on credentials: Yes 
  • Enforce script signature check: No 
  • Run in 64-bit PowerShell: No12 
  • Assign to: All Office Users group13 
  1. Assign the Policy 
  • In the imported policy, go to Assignments 
  • Included groups: Select “All Office Users” 
  • Review + Save 

Method 2: Manual Configuration Using Settings Catalog 

If you prefer granular control, you can manually configure macro policies using Intune’s Settings Catalog. 

Step-by-Step: Create Custom Macro Blocking Policy 

  1. Create New Settings Catalog Policy 
  • Navigate to: Microsoft Intune admin center (intune.microsoft.com) 
  • Go to: Devices > Configuration policies > Create > New Policy 
  • Platform: Windows 10 and later 
  • Profile type: Settings catalog 
  • Name: “Office Macro Security – Disable All Macros” 
  1. Configure Settings for Each Office Application 

The following settings must be configured for each Office application (Word, Excel, PowerPoint, Access, Outlook):14 15 

Microsoft Office 2016 (Global Settings) 

Setting Path Configuration 
Microsoft Office 2016 > Security Settings  
Automation Security Enabled 
– Set Automation Security level Disable macros by default 
Disable VBA for Office applications Enabled 
Security Settings > Trust Center  
Allow mix of policy and user locations Disabled 

Microsoft Excel 2016 

Setting Path Configuration 
Excel Options > Security > Trust Center  
VBA Macro Notification Settings Enabled 
– VBA Macro Notification Disable all without notification 
Block macros from running in Office files from the Internet Enabled 
Trust access to Visual Basic Project Disabled 
Turn off trusted documents Enabled 
Turn off Trusted Documents on the network Enabled 
Excel Options > Security > Trust Center > Trusted Locations  
Allow Trusted Locations on the network Disabled 
Disable all trusted locations Enabled 

Microsoft Word 2016 

Setting Path Configuration 
Word Options > Security > Trust Center  
VBA Macro Notification Settings Enabled 
– VBA Macro Notification Disable all without notification 
Block macros from running in Office files from the Internet Enabled 
Trust access to Visual Basic Project Disabled 
Turn off trusted documents Enabled 
Turn off Trusted Documents on the network Enabled 
Word Options > Security > Trust Center > Trusted Locations  
Allow Trusted Locations on the network Disabled 
Disable all trusted locations Enabled 

Microsoft PowerPoint 2016 

Setting Path Configuration 
PowerPoint Options > Security > Trust Center  
VBA Macro Notification Settings Enabled 
– VBA Macro Notification Disable all without notification 
Block macros from running in Office files from the Internet Enabled 
Trust access to Visual Basic Project Disabled 
Turn off trusted documents Enabled 
Turn off Trusted Documents on the network Enabled 
PowerPoint Options > Security > Trust Center > Trusted Locations  
Allow Trusted Locations on the network Disabled 
Disable all trusted locations Enabled 

Microsoft Access 2016 

Setting Path Configuration 
Application Settings > Security > Trust Center  
VBA Macro Notification Settings Enabled 
– VBA Macro Notification Disable all without notification 
Block macros from running in Office files from the Internet Enabled 
Turn off trusted documents Enabled 
Turn off Trusted Documents on the network Enabled 
Application Settings > Security > Trust Center > Trusted Locations  
Allow Trusted Locations on the network Disabled 
Disable all trusted locations Enabled 

Microsoft Outlook 2016 

Setting Path Configuration 
Security > Trust Center  
Apply macro security settings to macros, add-ins and additional actions Enabled 
Security settings for macros Enabled 
– Security Level Never warn, disable all 
  1. Assign the Policy 
  • Assignments: Select your target user or device groups 
  • Review + Create 

Attack Surface Reduction (ASR) Rules for Essential Eight Compliance 

Can ASR Rules Meet Essential Eight Requirements? 

Yes, partially. Windows Attack Surface Reduction rules provide critical additional protections that complement macro blocking policies and help meet Essential Eight requirements.16 17 

ASR rules are included with Microsoft 365 Business Premium via Microsoft Defender for Business and can be deployed through Intune.18 

Essential Eight-Relevant ASR Rules 

The following ASR rules directly support Essential Eight mitigation strategies:19 20 

ASR Rules for Office Macro Security 

ASR Rule Name GUID Essential Eight Alignment ISM Control 
Block Win32 API calls from Office macros 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b ✅ Required – Prevents macros from making dangerous system calls ISM-1673 
Block Office applications from creating child processes d4f940ab-401b-4efc-aadc-ad5f3c50688a ✅ Recommended – Prevents macro-launched executables User App Hardening 
Block Office applications from creating executable content 3b576869-a4ec-4529-8536-b80a7769e899 ✅ Recommended – Prevents macros from creating .exe files User App Hardening 
Block Office applications from injecting code into other processes 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 ✅ Recommended – Prevents code injection attacks User App Hardening 
Block Office communication applications from creating child processes 26190899-1602-49e8-8b27-eb1d0a1ce869 ✅ Recommended – Protects Outlook from exploitation User App Hardening 

Step-by-Step: Deploy ASR Rules via Intune 

Detailed Implementation Steps:21 

  1. Navigate to ASR Policy Creation 
  • Go to: Endpoint security > Attack surface reduction 
  • Click: Create Policy22 
  1. Configure Policy Basics 
  • Platform: Windows 10, Windows 11, and Windows Server 
  • Profile: Attack Surface Reduction Rules 
  • Name: “Essential Eight – Office ASR Rules” 
  • Description: “ASR rules aligned with ACSC Essential Eight requirements” 
  1. Configure ASR Rules 

For each of the Essential Eight-relevant rules, configure the mode:23 

ASR Rule Initial Mode Production Mode 
Block Win32 API calls from Office macros Audit Block (Required for ISM-1673) 
Block Office applications from creating child processes Audit Block 
Block Office applications from creating executable content Audit Block 
Block Office applications from injecting code into other processes Audit Block 
Block Office communication applications from creating child processes Audit Block 

Mode Definitions: 

  • Not Configured (0): Rule is disabled 
  • Block (1): Rule is enforced 
  • Audit (2): Rule logs events but doesn’t block 
  • Warn (6): User receives warning but can bypass24 
  1. Assign the Policy 
  • Assignments
  • Included groups: “All Windows Devices” or specific pilot groups 
  • Excluded groups: Any test or exception groups 
  • Click Next and Create 
  1. Testing and Deployment Strategy 

⚠️ Important: ASR rules should be thoroughly tested before full enforcement:25 

  • Week 1-2: Deploy all rules in Audit mode 
  • Week 3-4: Review Microsoft Defender for Endpoint logs for blocked activity 
  • Week 5+: Switch rules to Block mode for full enforcement 
  • Monitor for false positives and create exclusions as needed 

Alternative: Manual ASR Deployment via Graph API 

For advanced deployments, you can use Microsoft Graph API to deploy ASR policies programmatically:26 

Step-by-Step: 

  1. Navigate to Graph Explorer 
  • Sign in with administrator credentials 
  • Grant necessary permissions 
  1. Create POST Request 
  • Method: POST 
  • Schema: Beta 
  1. Use ACSC Windows Hardening JSON 
  • Copy the JSON content and paste into the request body 
  • Modify the policy name if needed 
  • Execute the POST request 
  1. Assign Policy 
  • Use Graph API or Intune portal to assign the created policy to your device groups 

Monitoring and Validation 

Verifying Policy Application 

After deploying policies, verify they’re working correctly: 

  1. Check Policy Status in Intune 
  • Navigate to: Devices > Monitor > Device configuration 
  • Review deployment status for your macro policies 
  • Check for any errors or conflicts28 
  1. Test on End-User Device 
  • Have a test user attempt to open a macro-enabled Office file 
  • Verify that macros are blocked and no prompt appears 
  • Check that Trust Center settings are grayed out (not user-modifiable) 
  1. Review Microsoft Defender for Endpoint 

If you have Defender for Endpoint (included in Business Premium), monitor for macro-related events:29 

  • Endpoint behavioral sensors collect macro execution attempts 
  • Cloud security analytics translate signals into insights 
  • Threat intelligence identifies attacker techniques 
  • Review alerts in the Microsoft 365 Defender portal (security.microsoft.com) 
  1. Validate ASR Rule Effectiveness 
  • Navigate to: Microsoft 365 Defender portal > Reports > Attack surface reduction rules 
  • Review triggered events for each ASR rule 
  • Identify false positives and create exclusions if needed 

Exception Management: Allowing Trusted Macros 

Some users may have legitimate business requirements for macros. The Essential Eight framework accommodates this through Trusted Publishers or Trusted Locations.30 

Option 1: Trusted Publishers (Recommended) 

Trusted Publishers use digital signatures to verify macro authenticity. This is the preferred method for Essential Eight compliance.31 

Step-by-Step: Enable Trusted Publishers 

  1. Create Exception Group 
  • Create Azure AD group: “Office Macro Users – Trusted Publishers” 
  • Add users with legitimate macro needs32 
  1. Download Trusted Publisher Policy 
  1. Import to Intune 
  • Navigate to: Devices > Configuration profiles > Import Policy 
  • Browse for downloaded JSON file 
  • Name: “ACSC Office – Trusted Publishers Enabled” 
  • Assign to: “Office Macro Users – Trusted Publishers” group33 
  1. Exclude from Macro Blocking Policy 
  • Edit your “All Macros Disabled” policy 
  • Go to Assignments 
  • Excluded groups: Add “Office Macro Users – Trusted Publishers”34 
  1. Deploy Trusted Publisher Certificates 

For each approved macro publisher:35 

  • Navigate to: Devices > Configuration profiles > Create 
  • Profile type: Trusted certificate 
  • Upload the publisher’s code-signing certificate 
  • Assign to: “Office Macro Users – Trusted Publishers” group 

Certificate Requirements:36 

  • Must use V3 signature scheme (more secure) 
  • Certificate must be from a trusted Certificate Authority 
  • Each publisher should have a separate policy for easier management 
  1. Macro Vetting Process 

Before signing any macros:37 

  • Execute macros on an isolated test device with ACSC hardening applied 
  • Verify no malicious behavior 
  • Use Microsoft Defender Antivirus scanning (automatic with ACSC policies) 
  • Consider third-party macro scanning tools for additional validation 

Comprehensive Policy Summary Table 

Configuration Profile Settings 

Policy Category Setting Configuration Purpose 
VBA Macro Execution Disable VBA for Office applications Enabled Disables VBA engine globally38 
 VBA Macro Notification Settings Disable all without notification Blocks all macros silently39 
Internet Macros Block macros from Internet sources Enabled Prevents macros from untrusted sources40 
Automation Security Automation Security Level Disable macros by default Prevents COM automation attacks41 
Trust Center Turn off trusted documents Enabled Prevents trust bypass via document trust42 
 Turn off Trusted Documents on network Enabled Prevents network trust bypass43 
 Disable all trusted locations Enabled Blocks trusted location bypass44 
 Allow mix of policy and user locations Disabled Prevents user-defined trust45 
 Trust access to VBA Project Disabled Blocks programmatic VBA access46 
Macro Scanning Macro Runtime Scan Scope Enable for all documents Enables Defender AV scanning47 

Attack Surface Reduction Rules 

ASR Rule GUID Mode Purpose 
Block Win32 API calls from Office macros 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b Block Prevents dangerous API calls (ISM-1673)48 
Block Office apps creating child processes d4f940ab-401b-4efc-aadc-ad5f3c50688a Block Prevents macro-launched executables49 
Block Office apps creating executable content 3b576869-a4ec-4529-8536-b80a7769e899 Block Prevents .exe creation50 
Block Office apps injecting code 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 Block Prevents process injection51 
Block Outlook creating child processes 26190899-1602-49e8-8b27-eb1d0a1ce869 Block Protects email client52 

Key Limitations and Considerations 

Microsoft 365 Business Premium Constraints 

Testing Recommendations 

  1. Pilot Deployment: Test policies with a small group before organization-wide rollout53 
  1. Audit Mode First: Deploy ASR rules in Audit mode for 2-4 weeks before enforcement54 
  1. User Communication: Notify users about macro blocking to reduce helpdesk calls 
  1. Exception Process: Establish clear process for macro exception requests 
  1. Regular Review: Validate Trusted Publisher certificates annually55 

Complete Implementation Checklist 

  • Phase 1: Preparation 
  • Create Azure AD security groups (“All Office Users”, “Macro Exception Users”) 
  • Document current macro usage across organization 
  • Establish exception approval process 
  • Communicate changes to end users 
  • Phase 2: Baseline Policy Deployment 
  • Download ACSC Office Hardening policy from GitHub 
  • Import policy to Intune Configuration Profiles 
  • Download and import OLE prevention PowerShell script 
  • Assign policies to pilot group 
  • Test policy application on pilot devices 
  • Phase 3: ASR Rule Deployment 
  • Create ASR policy in Endpoint Security 
  • Configure 5 Office-related ASR rules in Audit mode 
  • Assign to pilot group 
  • Monitor events in Microsoft 365 Defender for 2-4 weeks 
  • Phase 4: Production Rollout 
  • Review audit logs for false positives 
  • Create ASR exclusions if needed 
  • Switch ASR rules to Block mode 
  • Expand deployment to all users 
  • Configure Trusted Publisher policies for exception users 
  • Phase 5: Ongoing Management 
  • Monitor Defender for Endpoint alerts 
  • Review exception requests quarterly 
  • Validate Trusted Publisher certificates annually 
  • Update policies as new ISM controls are released 

Conclusion 

Meeting the Essential Eight requirements for disabling Office macros in a cloud-only environment with Microsoft 365 Business Premium is achievable through: 

  1. Intune Configuration Profiles: Disable macros at the Office application level using Settings Catalog or imported administrative templates 
  1. Attack Surface Reduction Rules: Deploy complementary ASR rules to block macro-related attack behaviors 
  1. Exception Management: Use Trusted Publishers for users with legitimate macro needs 
  1. Continuous Monitoring: Leverage Microsoft Defender for Endpoint for visibility and alerting 

While Office Cloud Policy Service has limitations with Business Premium, Intune Configuration Profiles provide full macro control capabilities needed for Essential Eight compliance. ASR rules successfully accommodate Essential Eight requirements by providing the necessary technical controls, particularly ISM-1673 (blocking Win32 API calls from macros). 

The combination of these approaches provides defense-in-depth aligned with ACSC guidance and enables organizations to achieve Essential Eight Maturity Level 3 for macro security. 


References 

Microsoft Official Documentation 

Microsoft Learn – Essential Eight Guidance 

  • Essential Eight configure Microsoft Office macro settings 
  • Site: Microsoft Learn 

Microsoft Learn – Essential Eight User Application Hardening 

  • Essential Eight user application hardening 
  • Site: Microsoft Learn 

Microsoft Learn – Intune Office Policies 

  • Policies for Microsoft 365 Apps – Microsoft Intune 
  • Site: Microsoft Learn 

Microsoft Learn – Office Cloud Policy Service Overview 

  • Overview of Cloud Policy service for Microsoft 365 
  • Site: Microsoft Learn 

Microsoft Learn – Attack Surface Reduction Rules Reference 

  • Attack surface reduction rules reference – Microsoft Defender for Endpoint 
  • Site: Microsoft Learn 

Microsoft Learn – Manage ASR with Intune 

  • Manage attack surface reduction settings with Microsoft Intune 
  • Site: Microsoft Learn 

Microsoft Intune Admin Center 

  • Microsoft Intune admin center 
  • Site: Microsoft Intune 

Australian Cyber Security Centre (ACSC) Guidance 

Cyber.gov.au – Restricting Microsoft Office Macros 

  • Restricting Microsoft Office macros 
  • Site: Australian Cyber Security Centre (ACSC) 

Cyber.gov.au – Guidelines for System Hardening 

  • Guidelines for System Hardening 
  • Site: Australian Cyber Security Centre (ACSC) 

Cyber.gov.au – Hardening Microsoft 365 and Office 

  • Hardening Microsoft 365, Office 2021, Office 2019, and Office 2016 
  • Site: Australian Cyber Security Centre (ACSC) 

Cyber.gov.au – Microsoft Office Macro Security 

  • Microsoft Office Macro Security 
  • Site: Australian Cyber Security Centre (ACSC) 

Cyber.gov.au – Essential Eight Assessment Process Guide 

  • Essential Eight assessment process guide 
  • Site: Australian Cyber Security Centre (ACSC) 

Cyber.gov.au – Technical Example: Configure Macro Settings 

  • Technical example: Configure macro settings 
  • Site: Australian Cyber Security Centre (ACSC) 

ASD Blueprint for Secure Cloud 

ASD Blueprint – Office Hardening All Macros Disabled 

  • ASD Office hardening – all macros disabled 
  • Site: ASD’s Blueprint for Secure Cloud 

ASD Blueprint – Microsoft Office Macro Hardening Design 

  • Microsoft Office macro hardening 
  • Site: ASD’s Blueprint for Secure Cloud 

ASD Blueprint – Restrict Microsoft Office Macros 

  • Restrict Microsoft Office macros 
  • Site: ASD’s Blueprint for Secure Cloud 

GitHub Repositories and Templates 

Microsoft GitHub – ACSC Office Hardening Guidelines 

  • ACSC Office Hardening Guidelines (JSON) 
  • Site: GitHub – Microsoft 

Microsoft GitHub – OLE Prevention PowerShell Script 

  • OfficeMacroHardening-PreventActivationofOLE.ps1 
  • Site: GitHub – Microsoft 

Microsoft GitHub – ACSC Windows Hardening ASR Policy 

  • ACSC Windows Hardening Guidelines – Attack Surface Reduction policy (JSON) 
  • Site: GitHub – Microsoft 

GitHub – ACSC Essential 8 Office Hardening Module 

  • benjamin-robertson/acsc_e8_office_hardening 
  • Site: GitHub – Community 

Community and Technical Resources 

Reddit – Office 365 Community Discussion 

  • 365 Business Premium – GPO or config.office.com 
  • Site: Reddit – r/Office365 

Practical365 – Office Cloud Policy Service 

  • Block Macro Execution with Office Cloud Policy Service (OCPS) 
  • Site: Practical365 

Mr T-Bone’s Blog – Intune Office Policies 

  • How to use policies for Office apps in Intune 
  • Site: Mr T-Bone´s Blog 

Helge Klein – Blocking Office Macros 

  • Blocking Office Macros, Managing Windows & macOS via Intune 
  • Site: Helge Klein 

T-Minus365 – Deploy ASR Rules 

  • Deploy Attack Surface Reduction Rules from Microsoft Intune 
  • Site: T-Minus365 

Azure with Tom – Implementing ASR Policies 

  • Implementing Attack Surface Reduction Policies 
  • Site: Azure with Tom 

Additional Resources 

Microsoft Graph API – Graph Explorer 

  • Graph Explorer for API Testing 
  • Site: Microsoft Developer 

Microsoft 365 Defender Portal 

  • Microsoft 365 Defender Security Portal 
  • Site: Microsoft 365 Defender 

CISA – Disable VBA Macros Guidance 

  • Disable Visual Basic for Applications (VBA) Macros (CM0056) 
  • Site: Cybersecurity and Infrastructure Security Agency (CISA) 

CIAOPS Academy deprecation notification

Screenshot 2025-11-10 194840

The CIAOPS Academy has now reached the end of lts life. I will soon remove the ability to subscribe to any existing courses and aim to fully close it down within the next twelve (12) months. Existing subscribers will still be able to access any courses until full closure in December 2026, however no additional course will be added and existing courses will not be updated.

Why have I decided to do this? The main reasons are:

1. When I look at the metrics I see that well below 5% of course subscriber’s complete their course. Most complete nothing more than the first lesson.

2. Microsoft is changing the the M365 screens more and more regularly. People want courses to match the exact current displays in M365 and this would require an inordinate amount of work on my part refreshing each course as the interfaces continue to evolve and change.

3. In a world of AI, YouTube, etc people no longer want full courses. They instead, typically, consume content piecemeal and on demand. Few are willing to invest in a multi-lesson course it seems.

4. I rarely receive feedback on the existing course content or what people would like to see made available in new courses. People are looking elsewhere for their information.

For these and other reasons (e.g. increasing hosting costs) I have decided to fully shut down the CIAOPS Academy.

I will be moving all new content directly into the CIAOPS Patron Community (www.ciaopspatron.com) going forward. You can still sign up to my free Microsoft Team. You can use Robert.Agent to have all your M365 question answered directly via email.

In an evolving landscape where AI is rapidly commoditising knowledge, the CIAOPS Academy is losing relevancy and simply becoming too hard to maintain and I believe this is mirrored in fewer and fewer people consuming the course material.

All good things must come to and end and so it is for the CIAOPS Academy.

Configuring Exchange Online Mailbox Logging – Best Practices and Step-by-Step Guide

Important: Mailbox Auditing is Already ON by Default

Good news! Since 2019, Microsoft automatically enables mailbox auditing for all Exchange Online organizations. This means logging is already active for your mailboxes without requiring any manual configuration.

Should You Enable All Available Logging?

No, you should NOT enable all available logging. Here’s why:

  • Microsoft’s Recommendation: Use the default audit configuration, which Microsoft automatically manages and updates
  • Storage Impact: Audit logs consume storage space in each mailbox’s Recoverable Items folder (counts against the 30GB default limit)
  • Performance Consideration: Excessive logging can impact mailbox performance
  • Automatic Updates: Microsoft automatically adds new important actions to the default audit configuration as they’re released

What’s Logged by Default

The default configuration logs these critical actions:

ActionAdminDelegateOwner
Create (Calendar items)
HardDelete
MoveToDeletedItems
SendAs
SendOnBehalf
SoftDelete
Update
UpdateFolderPermissions
UpdateInboxRules

Step-by-Step Configuration Guide

Method 1: PowerShell (Recommended)

Step 1: Connect to Exchange Online PowerShell

Install-Module -Name ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

Step 2: Verify Organization-Wide Auditing is Enabled

Get-OrganizationConfig | Format-List AuditDisabled

Result should show False (meaning auditing is enabled)

Step 3: Check Current Mailbox Audit Status

# For a specific mailbox
Get-Mailbox -Identity "user@domain.com" | Format-List Name,AuditEnabled,DefaultAuditSet

# For all mailboxes
Get-Mailbox -ResultSize Unlimited | Format-Table Name,AuditEnabled,DefaultAuditSet

Step 4: Use Default Settings (Recommended)

# Restore default auditing for a mailbox that was customized
Set-Mailbox -Identity "user@domain.com" -DefaultAuditSet Admin,Delegate,Owner

Step 5: Only If Necessary – Customize Specific Actions

# Example: Add MailboxLogin tracking for owner actions
Set-Mailbox -Identity "user@domain.com" -AuditOwner @{Add="MailboxLogin"}

# Example: Set specific admin actions (overwrites defaults - not recommended)
Set-Mailbox -Identity "user@domain.com" -AuditAdmin MessageBind,FolderBind,HardDelete

Step 6: Configure Retention Period

# Default is 90 days, can extend up to 365 days (E5 license required for >180 days)
Set-Mailbox -Identity "user@domain.com" -AuditLogAgeLimit 180

# Apply to all mailboxes
Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuditLogAgeLimit 180

Step 7: Verify Configuration

# Check what actions are being audited
Get-Mailbox -Identity "user@domain.com" | Select-Object -ExpandProperty AuditAdmin
Get-Mailbox -Identity "user@domain.com" | Select-Object -ExpandProperty AuditDelegate
Get-Mailbox -Identity "user@domain.com" | Select-Object -ExpandProperty AuditOwner

Method 2: Microsoft 365 Admin Center (Limited Options)

Note: The GUI provides limited mailbox audit configuration options. Most settings require PowerShell.

To Search Audit Logs via GUI:

  1. Navigate to Microsoft Purview compliance portal
  2. Go to Audit in the left navigation
  3. Ensure audit log search is turned on (banner will appear if it’s not)
  4. Use the search interface to query audit logs
  5. Filter by:
    • Activities (e.g., “Mailbox activities”)
    • Date range
    • Users
    • File, folder, or site
  6. Export results as needed

To Export Mailbox Audit Logs via Classic EAC:

  1. Navigate to the Classic Exchange Admin Center
  2. Go to Compliance ManagementAuditing
  3. Click “Export mailbox audit logs”
  4. Specify date range and recipients
  5. Submit the export request

Best Practices Summary

  1. Keep default auditing enabled – It’s already on and Microsoft manages it
  2. Don’t enable all actions – Avoid FolderBind and MessageBind for owners (creates excessive logs)
  3. Retention considerations:
    • Standard licenses: 180 days retention
    • E5 licenses: 1 year retention by default
    • 10-year retention available with additional licensing
  4. Monitor storage: Check Recoverable Items folder size periodically
  5. Use PowerShell for configuration: GUI options are limited
  6. Test before mass deployment: If customizing, test on pilot mailboxes first

When to Customize Auditing

Only customize mailbox auditing if you have specific compliance requirements such as:

  • Regulatory requirements for specific action tracking
  • Security investigation needs
  • Tracking mailbox login events (MailboxLogin)
  • Monitoring specific delegate activities

Understanding FolderBind and MessageBind Logging for Mailbox Owners

What FolderBind and MessageBind Actually Log

FolderBind

What it logs: Every time a mailbox folder is accessed or opened

  • Records when someone navigates to or opens any folder (Inbox, Sent Items, Deleted Items, custom folders, etc.)
  • Captures the folder GUID and path
  • Logs the timestamp, client IP address, and application used
  • For delegates, entries are consolidated (one record per folder per 24-hour period to reduce volume)
  • Important: Not consolidated for owners – every folder access creates a separate log entry

MessageBind

What it logs: Every time a message is viewed in the preview pane or opened

  • Records when someone reads or opens an individual email message
  • Captures the message subject and ItemID
  • Logs whether the message was previewed or fully opened
  • Records the client application and IP address
  • Note: For E5 licensed users, this is replaced by the more sophisticated MailItemsAccessed action

Why These Actions Are NOT Enabled for Owners by Default

1. Massive Log Volume

The Reality: A typical user might:

  • Access 20-50 folders per day during normal email activity
  • View 50-200+ messages daily
  • Generate thousands of audit entries weekly
  • Create up to 100,000+ audit entries annually per mailbox

2. Storage Impact

  • Audit logs are stored in the mailbox’s Recoverable Items folder (Audits subfolder)
  • Count against the 30GB default quota (or 100GB with holds)
  • Maximum 3 million items can be stored in the Audits subfolder
  • Heavy users could hit these limits within months

3. Performance Considerations

  • Every folder navigation and message view triggers a write operation
  • Can impact mailbox performance, especially for heavy email users
  • Increases server-side processing load
  • May slow down email client responsiveness

4. Signal-to-Noise Ratio

  • 99.9% of owner FolderBind/MessageBind events are legitimate daily activity
  • Makes it extremely difficult to identify suspicious activity
  • Investigation tools often filter out FolderBind by default because of the noise

Legitimate Scenarios for Enabling FolderBind/MessageBind for Owners

1. Insider Threat Detection

Use Case: Monitoring high-risk individuals or sensitive roles

  • Executives with access to M&A information
  • Employees on performance improvement plans or termination notice
  • Users with access to intellectual property or trade secrets
  • Detecting unusual access patterns (e.g., accessing old emails before resignation)

2. Compliance Requirements

Use Case: Specific regulatory mandates

  • Financial services requiring complete audit trails (SEC, FINRA)
  • Healthcare organizations tracking PHI access (HIPAA)
  • Government contractors with security clearance requirements
  • Legal hold scenarios requiring complete activity documentation

3. Forensic Investigations

Use Case: Post-incident analysis

  • Determining if a compromised account’s emails were actually read
  • Investigating data exfiltration attempts
  • Proving or disproving unauthorized access claims
  • Building timeline of activities during security incidents

4. Privileged Account Monitoring

Use Case: Enhanced monitoring for administrative accounts

  • Service accounts that shouldn’t have regular email activity
  • Shared mailboxes with sensitive information
  • Discovery mailboxes used for legal searches
  • Executive assistant mailboxes with delegated access

Best Practices If You Enable FolderBind/MessageBind for Owners

1. Selective Implementation

# Enable only for specific high-risk mailboxes
Set-Mailbox -Identity "CEO@company.com" -AuditOwner @{Add="FolderBind","MessageBind"}

# Create a list of VIP users
$VIPUsers = "CEO@company.com","CFO@company.com","Legal@company.com"
foreach ($user in $VIPUsers) {
    Set-Mailbox -Identity $user -AuditOwner @{Add="FolderBind","MessageBind"}
}

2. Increase Retention Period

# Extend audit log retention to accommodate increased volume
Set-Mailbox -Identity "CEO@company.com" -AuditLogAgeLimit 365

3. Monitor Storage Impact

# Check audit folder size regularly
Get-MailboxFolderStatistics -Identity "CEO@company.com" -FolderScope RecoverableItems | 
    Where-Object {$_.Name -eq 'Audits'} | 
    Format-List FolderPath,FolderSize,ItemsInFolder

4. Implement Automated Analysis

  • Export logs to SIEM systems for pattern analysis
  • Set up alerts for unusual access patterns
  • Use machine learning to baseline normal behavior
  • Focus on deviations from typical patterns

5. Consider Alternative Solutions

  • For E5 Users: Use MailItemsAccessed instead (more intelligent, less noisy)
  • Microsoft Defender: Use insider risk management policies
  • Third-party tools: Consider specialized insider threat detection solutions
  • DLP policies: Focus on preventing data loss rather than tracking all access

The MailItemsAccessed Alternative (E5 Licenses)

For organizations with E5 licenses, MailItemsAccessed is a superior alternative that:

  • Intelligently aggregates similar activities (reduces noise by 80-90%)
  • Provides both sync and bind operation tracking
  • Includes deduplication (removes duplicate entries within 1-hour windows)
  • Records InternetMessageId for precise message tracking
  • Better suited for forensic investigations
  • Automatically enabled for E5 users

Summary Recommendation

Enable FolderBind/MessageBind for owners ONLY when:

  1. You have specific compliance or security requirements
  2. Monitoring high-risk individuals or during investigations
  3. You have the resources to analyze the massive data volume
  4. Storage and performance impacts have been evaluated
  5. You’ve implemented automated analysis tools

Otherwise: Stick with the default configuration and use alternative methods like DLP policies, insider risk management, and the MailItemsAccessed action (for E5 users) for more effective security monitoring.


Implementing a Phased Rollout of Conditional Access Policies Requiring Device Compliance in Microsoft 365

Overview

Implementing Conditional Access policies requiring device compliance in Microsoft 365 requires careful planning and a phased approach to minimize disruption while maintaining security. This comprehensive guide provides step-by-step instructions specifically tailored for small businesses.

1. Prerequisites and Initial Setup

Required Licenses

  • Microsoft Entra ID P1 or P2 – Required for Conditional Access
  • Microsoft Intune – Required for device compliance management
  • Microsoft 365 Business Premium or higher for small businesses

Essential Preparations

  1. Configure Emergency Access Accounts
    • Create at least two emergency access (break-glass) accounts
    • Exclude these accounts from ALL Conditional Access policies
    • Store credentials securely and separately
  2. Create Device Compliance Policies First
    • Define minimum OS version requirements
    • Set encryption requirements
    • Configure password/PIN requirements
    • Establish jailbreak/root detection settings
  3. Enable User Registration for MFA
    • Allow users to register authentication methods before enforcing policies
    • Communicate registration requirements to all users

2. Phased Rollout Strategy

Phase 1: Foundation (Weeks 1-2)

Objective: Establish baseline security and prepare infrastructure

  1. Create policies in Report-Only Mode
  2. Block legacy authentication protocols
  3. Secure the MFA registration page
  4. Target privileged accounts first with phishing-resistant MFA

Phase 2: Pilot Testing (Weeks 2-4)

Objective: Test with limited user groups

Pilot Group Selection

  • Start with 5-10% of your organization
  • Include IT staff and willing early adopters
  • Avoid executives and VIPs initially
  • Ensure representation from different departments

Creating the Policy in Report-Only Mode

  1. Navigate to Microsoft Entra admin centerConditional AccessPolicies
  2. Create new policy with these settings:
    • Name: “Require Device Compliance – Pilot”
    • Users: Select pilot group
    • Cloud apps: Start with non-critical apps
    • Grant: Require device to be marked as compliant
    • Enable policy: Report-only

Phase 3: Gradual Expansion (Weeks 4-8)

Objective: Progressively include more users and applications

Automated Phased Rollout Approach

If using the Conditional Access Optimization Agent (requires Microsoft Security Copilot):

  1. The agent automatically creates a 5-phase rollout plan
  2. Groups are assigned based on risk and impact analysis
  3. Automatic progression between phases based on success metrics
  4. Built-in safeguards pause rollout if sign-in success rate drops below 90%

Manual Phased Rollout Approach

  1. Phase 3a: Add 25% more users (low-risk departments)
  2. Phase 3b: Add another 25% (medium-risk departments)
  3. Phase 3c: Add remaining standard users
  4. Phase 3d: Include executives and VIPs
  5. Phase 3e: Apply to all cloud applications

Phase 4: Full Deployment (Week 8+)

  1. Switch policy from Report-only to On
  2. Monitor for 2 weeks before removing report-only policies
  3. Clean up redundant or test policies

3. Monitoring Strategies

Real-Time Monitoring Tools

A. Sign-in Logs Analysis

  1. Navigate to Microsoft Entra admin centerMonitoring & healthSign-in logs
  2. Filter by:
    • Conditional Access status
    • Failure reasons
    • Affected users
  3. Review the Report-only tab for policy impact without enforcement

B. Conditional Access Insights Workbook

Requires Azure Monitor subscription:

  • Provides aggregate view of policy impacts
  • Identifies potential issues before enforcement
  • Shows user impact analysis

C. Device Compliance Dashboard

  1. Access via Intune admin centerReportsDevice compliance
  2. Monitor:
    • Compliance status by policy
    • Non-compliant device trends
    • Error patterns in compliance evaluation

Key Metrics to Track

  • Sign-in success rate: Should remain above 90%
  • Device compliance rate: Target 95%+ before full enforcement
  • Help desk tickets: Monitor for unusual spikes
  • User productivity impact: Track application access patterns

4. Rollback Procedures

Immediate Rollback Options

Option 1: Disable the Policy

  1. Navigate to the Conditional Access policy
  2. Change Enable policy from “On” to “Off”
  3. Takes effect within minutes for new sign-ins

Option 2: Switch to Report-Only Mode

  1. Edit the policy
  2. Change Enable policy to “Report-only”
  3. Maintains visibility while removing enforcement

Option 3: Exclude Affected Users/Groups

  1. Edit policy → AssignmentsUsers
  2. Under Exclude, add affected users or groups
  3. Use sparingly and temporarily

Grace Period Configuration

Configure grace periods in Intune compliance policies:

  1. Navigate to Intune admin centerDevicesCompliance policies
  2. Edit policy → Actions for noncompliance
  3. Set grace period (recommended: 3-7 days for initial rollout)
  4. Users maintain access during grace period while fixing compliance issues

Recovery from Deleted Policies

  • Deleted policies can be recovered within 30 days
  • Access soft-deleted policies through Microsoft Entra admin center
  • Restore maintains original configuration and assignments

5. Best Practices and Recommendations

Communication Strategy

  1. Pre-deployment: 2 weeks advance notice with requirements
  2. During pilot: Weekly updates to pilot users
  3. Rollout phases: 48-hour notice before including new groups
  4. Post-deployment: Success confirmation and support resources

Testing Checklist

  • ✓ Test with multiple device platforms (Windows, iOS, Android)
  • ✓ Verify enrollment process for new devices
  • ✓ Confirm excluded accounts remain accessible
  • ✓ Test rollback procedures in development environment
  • ✓ Validate help desk escalation procedures

Common Pitfalls to Avoid

  1. Not excluding emergency accounts – Can result in complete lockout
  2. Skipping report-only mode – Misses opportunity to identify issues
  3. Moving too quickly between phases – Insufficient time to identify problems
  4. Inadequate user communication – Leads to confusion and resistance
  5. Not monitoring device check-in intervals – Compliance updates may be delayed

PowerShell Monitoring Example


# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Policy.Read.All"

# Get all Conditional Access policies
$policies = Get-MgIdentityConditionalAccessPolicy

# Filter for device compliance policies
$compliancePolicies = $policies | Where-Object { 
    $_.GrantControls.BuiltInControls -contains "compliantDevice" 
}

# Display policy status
$compliancePolicies | Format-Table DisplayName, State, CreatedDateTime

Implementing Risk-Based Conditional Access Policies for Small Business

Risk-based Conditional Access policies provide adaptive security that automatically adjusts authentication requirements based on the risk level of sign-ins and user behavior, helping you maintain an optimal balance between security and productivity.

Prerequisites and Licensing

  • Microsoft Entra ID P2 license required for risk-based policies (includes Identity Protection)
  • Microsoft 365 Business Premium includes Conditional Access features for small businesses
  • Users must be registered for Multi-Factor Authentication (MFA) before policy enforcement
  • Configure trusted network locations to reduce false positives

Step-by-Step Implementation Guide

Phase 1: Foundation Setup (Week 1)

  1. Create Emergency Access Accounts
    • Set up at least two break-glass accounts excluded from all policies
    • These prevent complete lockout if policies are misconfigured
  2. Start with Report-Only Mode
    • Deploy all new policies in report-only mode first
    • Monitor for at least 7-14 days to understand impact
    • Review sign-in logs to identify potential issues

Phase 2: Sign-in Risk Policy Configuration

  1. Navigate to Microsoft Entra admin center > Conditional Access
  2. Create new policy: “Require MFA for risky sign-ins”
  3. Configure settings:
    • Users: Include all users, exclude emergency accounts
    • Cloud apps: All cloud apps
    • Conditions > Sign-in risk: Select Medium and High
    • Grant: Require multi-factor authentication
    • Session: Sign-in frequency – Every time
    • Enable policy: Report-only (initially)

Phase 3: User Risk Policy Configuration

  1. Create new policy: “Require password change for high-risk users”
  2. Configure settings:
    • Users: Include all users, exclude emergency accounts
    • Cloud apps: All cloud apps
    • Conditions > User risk: Select High
    • Grant: Require password change + Require MFA
    • Enable policy: Report-only (initially)

Microsoft’s Recommended Risk Levels for Small Business

  • Sign-in Risk: Require MFA for Medium and High risk levels
    • Provides security without excessive user friction
    • Allows self-remediation through MFA completion
  • User Risk: Require secure password change for High risk only
    • Prevents account lockouts from overly aggressive policies
    • Users can self-remediate compromised credentials

Balancing Security and Productivity

Enable Self-Remediation

  • Sign-in risks: Users complete MFA to prove identity and continue working
  • User risks: Users perform secure password change without admin intervention
  • Reduces helpdesk tickets and minimizes productivity disruption

Progressive Deployment Strategy

  1. Pilot Group (Week 1-2)
    • Start with IT staff and power users
    • Monitor and gather feedback
    • Adjust risk thresholds if needed
  2. Phased Rollout (Week 3-4)
    • Expand to departments gradually
    • Provide user communication and training
    • Document self-remediation procedures
  3. Full Deployment (Week 5+)
    • Switch policies from Report-only to On
    • Monitor sign-in logs for blocked legitimate users
    • Fine-tune based on real-world usage

PowerShell Implementation Example

Import-Module Microsoft.Graph.Identity.SignIns

# Create Sign-in Risk Policy
$signInRiskPolicy = @{
    displayName = "Require MFA for risky sign-ins"
    state = "enabledForReportingButNotEnforced"
    conditions = @{
        signInRiskLevels = @("high", "medium")
        applications = @{
            includeApplications = @("All")
        }
        users = @{
            includeUsers = @("All")
            excludeGroups = @("emergency-access-group-id")
        }
    }
    grantControls = @{
        operator = "OR"
        builtInControls = @("mfa")
    }
    sessionControls = @{
        signInFrequency = @{
            isEnabled = $true
            type = "everyTime"
        }
    }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $signInRiskPolicy

Key Monitoring and Success Metrics

  • Sign-in Success Rate: Should remain above 95% for legitimate users
  • MFA Prompt Frequency: Monitor for excessive prompting that impacts productivity
  • Risk Detection Accuracy: Review false positive rates weekly
  • Self-Remediation Rate: Track percentage of users successfully self-remediating
  • Helpdesk Tickets: Should decrease after initial deployment

Best Practices for Small Business

  1. Start Conservative: Begin with High risk only, then add Medium risk after validation
  2. Communicate Clearly: Provide user guides explaining why MFA prompts occur
  3. Enable Modern Authentication: Block legacy authentication to prevent policy bypass
  4. Regular Reviews: Analyze risk detection patterns monthly and adjust as needed
  5. Document Exceptions: Maintain clear records of any policy exclusions
  6. Test Rollback Procedures: Know how to quickly disable policies if issues arise