Step-by-Step Program to Achieve Priority #3 with Microsoft 365 Business Premium

This is part of a series on MSP priorities for 2026.

AI-Driven Automation Program for MSPs (SMB Clients)

Objective: Enable SMB clients to embrace AI-driven solutions and automation using Microsoft 365 Business Premium, through a phased program with clear steps, timelines, roles, and measurable outcomes. The program focuses on quick wins in efficiency and security, structured adoption of AI (e.g. Microsoft 365 Copilot, Power Automate), and ongoing optimization – all delivered in an executive-friendly, outcome-focused manner.

Phase 1: Assessment & Strategy (Weeks 1–2)

Key Actions: Kick off the program with a joint MSP–client assessment of the client’s current processes, pain points, and readiness for AI. The MSP conducts an AI readiness audit covering technology and workflow gaps, while client stakeholders (business managers and IT leads) catalog repetitive, labor-intensive processes and key data sources. Together, define 3–5 high-impact use cases where AI or automation can add value – focusing on tasks with heavy manual effort, clear rules, and measurable outcomes (e.g. time saved, fewer errors). For example, candidates might include automating invoice approvals, using an AI assistant for helpdesk ticket triage, or auto-generating routine reports. Additionally, establish success criteria for each use case (such as “reduce invoice processing time by 50%” or “save 10 hours/month on helpdesk responses”). Finally, align on scope, timeline, and sponsorship: ensure an executive sponsor is in place to communicate vision and support change management. The output of this phase is a clear automation roadmap (target use cases, required Microsoft 365 tools, and KPIs) and a shared understanding of responsibilities. [eatonassoc.com]

Roles: The MSP leads the assessment by bringing templates and expertise (e.g. conducting workshops to surface improvement areas). The client’s executives and process owners provide business context: for instance, “Office managers list the top 10 repetitive processes… IT leaders map where data resides”. This collaboration ensures the strategy focuses on relevant business priorities. The MSP also identifies which Microsoft 365 Business Premium capabilities will be leveraged for each opportunity – for example, Power Automate for workflow automation, Teams + Power Virtual Agents or Copilot for AI-driven assistance, and Azure AD/Intune for identity or device needs. Both parties agree on a high-level plan before moving forward. [eatonassoc.com]

Phase 2: Foundation & Quick Wins (Weeks 3–6)

Key Actions: Before rolling out advanced AI, the environment must be “AI-ready.” In this phase, the MSP establishes a strong foundation on the client’s Microsoft 365 Business Premium tenant. This includes implementing critical security and compliance controls and any pre-requisites for safe AI usage. For example, enforce Azure AD Conditional Access and MFA for all users if not already in place, and enable data protection policies (sensitivity labels, DLP for sensitive info) – essentially “minimum governance guardrails” to ensure AI is deployed on a secure identity and data foundation. Business Premium’s built-in tools (like Defender for Business, Intune, Conditional Access) are utilized here to harden security and manage devices, since successful AI adoption requires trust that corporate data is handled safely. The MSP also sets up an early win by deploying one or two simple automations immediately. For example, using Power Automate to streamline a common task: perhaps an approval workflow or an email alert integration that addresses a known pain point. These quick wins demonstrate tangible improvement within weeks. As one guide notes, introducing basic automations for common repetitive tasks can “deliver a quick efficiency win” and open clients’ eyes to the power of their M365 tools.

In parallel, the MSP finalizes any needed licensing or tool enablement for AI. Notably, Microsoft has introduced “Microsoft 365 Copilot Business” SKUs for SMBs (including one for Business Premium) that add AI capabilities. If the client opts for Copilot, the MSP ensures those licenses are in place and initial Copilot configurations (permissions, content accessibility) are set according to best practices. By the end of Phase 2, the client’s tenant should have a solid security posture and one or two automated workflows live – boosting confidence and setting the stage for broader AI rollout. [connectwise.com]

Roles: The MSP takes charge of technical execution in this phase. They configure M365 Business Premium features for security (e.g. enabling MFA, Intune policies, Defender) and build the initial Power Automate flows or other scripts. The MSP also advises on governance policies – for instance, deciding which data sources Copilot can access or which users should get early AI access. The client’s IT stakeholders assist by providing necessary approvals or information (e.g. which compliance policies apply, who should be in pilot groups). Client leadership should communicate to employees about upcoming improvements (“We are implementing new tools to eliminate manual drudgery and improve security”), helping set expectations and a positive tone. Early user involvement might be limited, but any quick-win automation that goes live should be explained to affected staff so they understand the new, easier process. [connectwise.com], [eatonassoc.com]

Measurable Outcomes (Phase 2): Quick security improvements and initial efficiency gains can be tracked. For example, after enforcing MFA and security baselines, the client’s Microsoft Secure Score should jump upward (a quantifiable security metric). A quick-win automation might be measured by the reduction in time to complete that process. Although Phase 2 is largely foundational, it should already yield visible results – e.g. “automated alerting for form submissions eliminated an hour of manual email sorting per week” – to build momentum.

Phase 3: AI Pilot Implementation (Weeks 7–10)

Key Actions: With the groundwork laid, the program moves to an AI pilot phase. The MSP now implements the core AI-driven solutions for the prioritized use cases, initially on a small scale. This typically involves:

Deploying AI Tools to a Pilot Group: For instance, enabling Microsoft 365 Copilot for a set of pilot users (such as a few people in sales, finance, or HR who will exercise it in their daily work), or developing a prototype AI chatbot in Teams for the helpdesk, or using Power Automate with GPT-based actions. The pilot group should be representative and enthusiastic, and they should have clear objectives for what to try (e.g. sales team uses Copilot to draft proposals and get data insights; helpdesk uses an AI assistant to classify and respond to common tickets).
Integrating and Configuring AI Workflows: Ensure the AI solutions are properly integrated with the client’s data and workflows. For example, if rolling out Copilot, the MSP checks that it’s grounded in the client’s SharePoint/OneDrive content in a governed way (respecting permissions set in Phase 2). If building a custom automation, connect it to relevant data sources (e.g. linking Outlook, Teams, or a third-party system via connectors). Business Premium provides a robust base here – identity and device management from Phase 2 help ensure only authorized, compliant data feeds into AI, addressing a key concern that AI adoption “must be built on the right identity controls, data permissions, and governance”. The MSP might use tools like the new Copilot Studio or Power Platform capabilities to create tailored AI agents or flows, and leverage their expertise to handle any API or integration work needed. [connectwise.com] [eatonassoc.com]
Executing the Pilot and Collecting Feedback: The pilot users start using the AI-driven solutions in real scenarios, while the MSP closely monitors usage and outcomes. It’s critical to measure baseline vs. post-pilot metrics to validate the impact. For each use case, track things like: time to complete a task (before vs. after automation), number of manual steps or touchpoints eliminated, and quality indicators (e.g. error rates or response accuracy). Also gather subjective feedback: are users finding the AI helpful? Any confusion or adjustments needed? The program should allow for quick iteration – if the AI workflow isn’t yielding the expected result, tweak the prompts or logic. For example, if an AI helpdesk agent is piloted, measure if first-response resolution rates improve or if it correctly routes issues, and refine it if it’s missing certain categories. [eatonassoc.com]

During this phase, success means proving out value on a small scale. A well-run pilot will show, for instance, that generating a monthly report with Copilot takes 5 minutes instead of 2 hours, or that an automated approval cuts a three-day waiting process down to same-day. These results should be documented as they will justify expansion. Notably, MSPs are encouraged to “make Copilot outcomes measurable” – define concrete metrics and track them – so that the AI rollout is tied to business value from the start. [connectwise.com]

Roles: In the pilot, MSP experts build and oversee the AI solutions, while pilot users (client employees) actively participate and provide feedback. The MSP’s responsibilities include technical development (e.g. configuring Copilot, creating Power Automate flows with AI integrations) and ensuring the solution works within the client’s environment (taking care of any integration with line-of-business systems or adjusting security settings as needed). The MSP also acts as a coach: training the pilot users in how to use the new AI tools effectively (for example, showing them how to ask Copilot for certain analyses, or how to trigger and monitor the new automated workflow). The client stakeholders during this phase should include the business owners of each pilot use case – they will validate that the AI is producing acceptable outputs. For instance, the finance manager in the pilot can confirm that the AI-generated invoice summaries are accurate. These stakeholders help set the acceptance criteria for the pilot (“we need at least 90% accuracy on categorizing helpdesk tickets” or “proposal drafts should require minimal editing”). They work closely with the MSP to tweak rules or provide sample data to train/guide the AI if needed. Importantly, the client’s IT and compliance officers verify that all pilot activities stay within policy – e.g. that AI is not accessing restricted data or that any sensitive outputs are handled properly. This collaborative pilot execution ensures that by the end of Phase 3, there is solid evidence (in performance metrics and user satisfaction) that the AI-driven solutions deliver the promised outcomes.

Measurable Outcomes (Phase 3): Each pilot use case will have its own success measures, but collectively the pilot should demonstrate at least some of the following improvements: significantly reduced cycle times for the targeted processes, reduction in manual workload (e.g. “we eliminated 5 manual data entry steps in onboarding”), and improved responsiveness (e.g. “customer emails are now answered by the AI assistant within seconds, with an option for human follow-up”). Quantitatively, the team should capture things like “X hours of work saved per week” or “Y% increase in output per staff member” for pilot tasks. Early indications of user adoption are also key: if the majority of pilot users stick with the AI tool and find it beneficial, that’s a green light. (Many organizations see over 80% user adoption within 3 months when AI pilots are well-scoped and demonstrably improve daily work – the pilot phase aim is to hit such high adoption and enthusiasm in the test group.) [eatonassoc.com]

Phase 4: Full Deployment & Training (Weeks 11–16)

Key Actions: After a successful pilot, the program scales the AI-driven solutions to the broader organization. This phase is about deployment at scale, change management, and ensuring all users are enabled to use the new tools effectively. Key activities include:

Gradual Rollout: The MSP and client plan a phased rollout of the AI and automation solutions to additional departments or the entire company as appropriate. Rather than a big bang, it’s wise to sequence the deployment. For example, if an AI automation was piloted in Accounts Payable, extend it next to the Purchasing team, then to other finance functions. If Copilot was piloted with a handful of users, consider rolling it out to a larger group in waves (perhaps all managers first, then all knowledge workers). This staged approach allows any minor issues to be addressed and avoids overwhelming the support capacity. Microsoft 365 Business Premium with Copilot (if in use) will now be broadly enabled – this is where having Business Premium pays off, as it “already has identity, device management, and security controls in place, making secure AI adoption easier to operationalize”. In other words, scaling up Copilot or Power Automate usage is straightforward because the necessary licenses and security measures were handled in earlier phases. [eatonassoc.com] [connectwise.com]
Comprehensive User Training & Awareness: A critical focus in Phase 4 is getting users comfortable and proficient with the new AI-driven processes. The MSP (or a training specialist) delivers targeted training sessions for different user groups. For instance, host a workshop for all employees on “Using Microsoft 365 Copilot for daily tasks” covering how to ask it to draft documents, find information, or generate insights. Likewise, if automated workflows affect certain roles, provide documentation or live demos of the new process (e.g. “how expense approvals happen in Teams now via automation”). It’s important to convey not just the how but the why – reassure staff that automation isn’t a threat but a means to eliminate drudgery so they can focus on higher-value work. Also set guidelines (especially for AI tools): clarify appropriate use, data handling, and any limitations. For example, train sales and marketing teams on how to review and refine AI-generated content to maintain quality. Executive sponsorship is crucial here: leadership should visibly endorse the changes, for example by using Copilot themselves in meetings and sharing success stories, which “sets an example that motivates employees”. When employees see managers actively embracing the new AI tools, it reinforces cultural adoption.
Governance and Policy Refinement: As AI usage becomes widespread, formalize the governance policies. In Phase 2 and 3, interim guardrails were set; now the MSP helps the client institute lasting policies and documentation. For instance, update the company IT policies to include AI acceptable use (what cannot be asked of Copilot, data categories that shouldn’t be fed into prompts, etc.), and ensure audit logging is enabled for AI-related activities for compliance. Microsoft 365 provides auditing and DLP tools that can track sensitive data usage even in AI scenarios. If not already done, define data access boundaries for AI – essentially confirming “what data AI tools can and cannot access” and setting any needed restrictions. Also, establish an internal support process: if users have questions or if the AI produces uncertain output, how should they escalate it? The MSP might set up a feedback channel (like a Teams channel for AI Q\&A or issues) to gather user inputs post-rollout. [eatonassoc.com]

By the end of Phase 4, the AI-driven solutions should be fully embedded in daily operations. All intended users have access, have been trained, and are actively using them for their work. The organization should start realizing the broader benefits: faster workflows across the board, more consistent outputs, and employees leveraging AI as a “copilot” in various tasks.

Roles: During full deployment, MSP responsibilities include technical rollout (e.g. pushing any required client-side updates or ensuring all targeted user accounts have the necessary licenses and access) and acting as the program manager for adoption. They will coordinate training sessions, prepare user guides or cheat-sheets, and remain on standby to troubleshoot any technical snags as user counts grow. The MSP continues to ensure security as new users come online – for example, confirming new users adhere to MFA and that any new devices are Intune-compliant, so the expansion doesn’t introduce vulnerabilities. The client’s leadership and managers hold a vital role in change management: they must encourage their teams to embrace the new ways of working. For example, a sales director might mandate that the team uses the AI proposal generation tool for all new proposals, or an operations manager might set a goal that 90% of routine service requests go through the AI triage bot. Managers should also celebrate early successes (e.g., “Our finance team closed the books in 3 days instead of 5, thanks to the automation – kudos to the team!”). Meanwhile, end-users are responsible for integrating these tools into their routine and providing feedback if something is not working well. The client’s IT support should now be prepared to handle basic inquiries about the AI tools (with the MSP as Tier-2 support for more complex issues). Essentially, in this phase the MSP gradually hands over day-to-day operation of the solution to the client (while still overseeing it), so clearly documented SOPs (Standard Operating Procedures) are created for the client’s IT team regarding the maintenance of these new systems. [eatonassoc.com]

Measurable Outcomes (Phase 4): By the end of the full deployment phase, the program should be hitting its targeted outcomes on a broad scale. Key metrics to look at include: User Adoption Rate – e.g. what percentage of employees are actively using Copilot or following the new automated process. The goal is high adoption; as a benchmark, >75% of the target users consistently using the AI tools is excellent (studies show many SMBs reach ~80% AI adoption in a few months with the right training and incentives). Productivity/Efficiency Gains – quantify the overall impact, such as “automated workflows now handle 100+ transactions per week that used to be manual” or “the average helpdesk ticket resolution time dropped from 4 hours to 1 hour after AI triage.” If the program included customer-facing improvements (like faster responses), customer satisfaction scores could be measured (e.g. an uptick in CSAT due to quicker service). Financial impact should also start to emerge: for example, if each hour saved is reinvested, calculate the notional cost savings. It’s not unrealistic to see on the order of $500–$2,000 per month in savings for an SMB through efficiencies and error reduction, as 66% of AI-adopting SMBs in one survey reported within a few months. The outcomes should be compiled into a report or dashboard – something an executive can glance at to see that, say, “AI automation has saved 50 worker-hours this month, prevented 10 potential errors, and improved our proposal turnaround by 2 days.” These concrete results validate the investment and set a baseline for continuous improvement. [eatonassoc.com]

Phase 5: Ongoing Monitoring & Optimization (Continuous)

Key Actions: The final “phase” is an ongoing effort that runs indefinitely once the solutions are in place. Achieving the outcomes is not a one-time event; sustaining and expanding them requires continuous monitoring and improvement. In this stage, the MSP transitions into a steady-state support and optimization role (often as part of a managed service agreement), and the client’s teams continue to refine their use of AI. Key activities:

Performance Monitoring & Support: The MSP (or client IT) should track key metrics on an ongoing basis – usage statistics, success rates of automations, system performance – using dashboards or reports. Regular reviews (e.g. monthly) are scheduled with client stakeholders to review these metrics and any incidents. For example, if Copilot usage data shows some departments lagging, the MSP can arrange additional training or investigate if there’s a blockage. If an automated workflow fails or is bypassed frequently, troubleshoot why and enhance it. It’s advisable to hold quarterly executive checkpoints focusing on AI/automation outcomes: in these, discuss ROI realized to date and decide on any course corrections or further investments. [connectwise.com]
Continuous Improvement & New Use Cases: With the first wave of AI solutions delivering value, identify further opportunities to leverage AI across the business. The MSP should help the client plan the next set of improvements. This might mean iterating on the current solutions (e.g. expanding an AI chatbot’s knowledge base to handle more queries) or applying AI to new domains in the organization. For instance, after seeing success in internal operations, the client may want to explore an AI-driven customer FAQ bot, or use Power BI with AI visuals for advanced analytics. Because technology evolves, new features in Microsoft 365 (especially around AI) will continue to emerge – the MSP keeps the client informed of relevant updates (for example, if Microsoft releases a new Copilot capability or integration, the MSP evaluates if it can help the client). Essentially, the MSP and client establish a cycle of innovation: pilot, rollout, measure, optimize, then repeat with new ideas. This prevents stagnation and ensures the client continues to benefit from the latest improvements. It also turns the initial project into a long-term partnership, where the MSP acts as a virtual CIO continuously aligning tech advances with the client’s business strategy.
Roles & Responsibilities Formalization: Over time, some responsibilities may shift more to the client’s internal team. Part of optimization is ensuring the client can manage day-to-day operations of the automations (with runbooks or admin guides provided by the MSP). However, areas like advanced AI tuning, major updates, or building new automations might remain the MSP’s role. It’s important to clearly define this in the ongoing phase to avoid gaps. Typically, the MSP handles system health, updates, and complex changes, while the client handles basic user administration and identifies business needs. Regular governance meetings should also ensure compliance is maintained – e.g. review audit logs to ensure AI usage is within policy, and update policies if regulations or business needs change.

Measurable Outcomes (Ongoing): In the long run, the program’s success is gauged by sustained and improved metrics. Efficiency gains should accumulate – for example, if in the first quarter 200 hours were saved, aim for 300+ hours saved in the next with further optimizations. User adoption should remain high or even increase as new features are added (you might target near-100% adoption for applicable roles after ample time and improvements). Business impact can be measured in higher-level terms too: perhaps the SMB client can handle a greater volume of business without adding headcount, or employees report higher satisfaction because they can focus on more creative tasks instead of routine work (this could be measured via employee surveys). The ultimate outcome is that the client organization is now more agile, efficient, and AI-augmented than before: they have, as the blog put it, truly “embraced AI-driven solutions and automation” in their day-to-day operations. The MSP should also track the ROI of the project for the client (e.g. productivity gains quantified in dollar value versus the cost of the solution over time), as well as for the MSP’s own business (since a successful outcome often leads to contract renewals, referrals, and case studies for the MSP).

Roles and Responsibilities Overview

To ensure clarity, the table below summarizes the key roles and responsibilities for the MSP and the client throughout this program:

MSP (Service Provider)	Client (SMB Stakeholders)
Strategic Advisor & Project Lead: Drive the overall program plan, phase by phase. MSP consultants perform the initial environment and process audit, uncovering automation opportunities [eatonassoc.com]. They define the solution architecture (which M365 Premium tools and AI services to use) and set success KPIs in consultation with client executives.	Executive Sponsor & Stakeholder Alignment: Assign a senior sponsor (e.g. CEO or Principal) to champion the initiative and communicate its importance. Ensure department heads are engaged to define business pain points and priorities. For example, finance and operations managers enumerate the manual processes and pain points that need improvement [eatonassoc.com], providing clear goals for the MSP to target.
Technical Implementation & Integration: Configure Microsoft 365 Business Premium security features, deploy Copilot/AI tools, and build Power Automate flows or bots as needed. The MSP handles all technical setup, from enabling licenses to integrating AI with line-of-business data [eatonassoc.com], ensuring solutions work seamlessly in the client’s environment. They maintain a secure and compliant configuration throughout (e.g. enforcing identity controls, data access limits as defined).	IT Coordination & Data Provisioning: Client’s IT staff or primary IT contact works with the MSP to provide access to systems and data required for automation (e.g. ensuring the MSP can connect to a CRM or database if needed). They validate that security and compliance requirements are met from the client’s perspective, approving changes like security policy updates. IT also prepares to support the new tools post-deployment (with documentation from MSP).
Training & Enablement: Educate and guide users on the new AI-driven processes. The MSP creates user-friendly documentation and conducts training sessions (live demos, Q&A) for various teams.	They also set usage guidelines (in line with company policies) for AI tools, so employees know how to use Copilot or automated workflows effectively and responsibly.	Employee Adoption & Change Management: The client’s management ensures that employees attend trainings and actually use the new tools. Leaders lead by example – e.g. management demonstrates its own use of AI tools in meetings – to foster a culture that embraces automation.	Department heads monitor their teams’ adoption and address any resistance or issues (with feedback to the MSP for further support if needed).
Monitoring & Optimization: Continuously monitor solution performance and results. The MSP tracks metrics (usage, time saved, errors prevented, etc.) and reports these to the client in regular reviews [connectwise.com]. They proactively fine-tune workflows or AI configurations to improve outcomes. The MSP also keeps the client informed about new Microsoft 365 features or AI updates that could enhance the solution, proposing enhancements over time.	Feedback & Continuous Improvement: Client stakeholders provide ongoing feedback on what’s working or where further improvements are needed. For instance, end-users report if an AI-generated report needs tweaking or if an automated process could cover more scenarios. Business units also identify new areas where automation could help. This feedback loop allows the program to adapt and expand, keeping the automation roadmap aligned with evolving business needs.

Measurable Outcomes and Success Metrics

By following this structured program, MSPs and their SMB clients can achieve concrete outcomes. Below are key success metrics to track, which tie back to the goals of “embracing AI-driven solutions and automation”:

Productivity Gains: Significant reduction in manual effort and process cycle times. Aim for on the order of 20+ hours per month of routine work eliminated for key teams (e.g. through automated workflows) – indeed, over half of SMBs using AI report saving at least 20 hours monthly by automating repetitive tasks. For example, if an approval process that used to take 3 days (with human reminders) is now done in half a day via Power Automate and Teams notifications, that translates to faster results and labor hours returned to the business. We should document such improvements for each automated process (e.g. “X process now 70% faster, saving Y hours per week”). Over a year, these efficiency gains should reflect as either capacity to handle more work with the same staff or cost savings by reallocation of effort. [eatonassoc.com]
User Adoption & Engagement: High adoption of AI tools across the organization, indicating user buy-in. A successful outcome is when a substantial majority of employees (75%+) in scope are actively using the provided AI-driven solutions in their day-to-day work. As a benchmark, many SMB deployments have seen around 80% of users adopting AI tools within 3 months when those tools clearly help in their job. We will track metrics like number of Copilot queries per user, number of tasks run through the automated workflows vs. old manual way, etc. A rising trend and broad usage means the workforce has embraced the change. Qualitatively, positive employee feedback – e.g. users saying “the new system saves me an hour each day” – signals cultural acceptance of AI. [eatonassoc.com]
Process Accuracy and Quality: Automation and AI should not only speed things up but also reduce errors and improve consistency. We will measure error rates or rework instances before vs. after. For example, if manual data entry in a report often had mistakes, and now an AI-driven process generates that report, the error rate should drop to near-zero. Similarly, an AI helpdesk triage might decrease misrouting of tickets. These quality improvements may be seen in metrics like a reduction in corrections needed or higher compliance (since automated steps occur the same way each time). In surveys, employees might report that outputs from AI (emails, analyses, etc.) meet quality standards most of the time, which is an improvement over previous human variability.
Business Impact & ROI: Ultimately, the program’s success will reflect in business-level outcomes. This can include cost savings, capacity for growth, and better service delivery. We will translate efficiency metrics into financial terms – for instance, 20 hours saved per month in a department is equivalent to approximately 0.5 FTE, which for an SMB might mean ~$1,000 in cost saved or re-deployable value (in line with findings that ~66% of AI-using SMBs save $500–$2,000 monthly through such optimizations). If automation allowed the company to avoid hiring an additional employee despite growth, that’s a direct cost avoidance benefit. Additionally, faster response times and improved deliverable quality can enhance customer satisfaction, which may lead to revenue retention or growth (though harder to measure short-term, we can use customer feedback or NPS as indicators if available). The MSP and client should agree on a few top-level KPIs that matter to leadership – for example, average project delivery time, monthly sales proposals completed, or customer ticket resolution rate – and see how those move after the AI implementations. These tie the technological outcomes to business outcomes like revenue growth or risk reduction. [eatonassoc.com]
Security & Compliance Posture: An often overlooked but crucial outcome of introducing automation under Business Premium is that it can increase security and compliance rather than risking it. By using M365’s secure ecosystem, the client’s data is now more centrally governed. We will note improvements such as an improved Microsoft Secure Score, 100% MFA coverage (if it was lower before), and adherence to data handling policies even as AI tools are used (verified via audit logs). A secure foundation means the AI-driven operations run without incidents – success is measured by the absence of security breaches or compliance violations despite increased automation. In other words, the client achieves efficiency without sacrificing security, thanks to the MSP’s careful governance (this addresses a key requirement that AI adoption be “measurable, compliant, and built to scale”). [connectwise.com]

In summary, by the end of this program the MSP-enabled initiative should deliver clear, executive-level results: faster workflows, empowered employees, and tangible savings. For example, an executive report might read: “Through AI-driven automation, the organization improved operational efficiency by 30%, saving an estimated 120 hours of work per month and $XV in costs. User adoption of the new tools is at 85%, and error rates in key processes have dropped to near zero. These enhancements were achieved while strengthening security (Secure Score up by 15 points), enabling the company to scale effectively into 2026.” Such outcomes demonstrate that the MSP’s step-by-step program not only met the objectives of item three (“Embracing AI-Driven Solutions and Automation”) but did so in a structured, risk-managed way that delivers value to the SMB client’s bottom line. [eatonassoc.com]

Key Priorities for MSPs in 2026: A Global Outlook (SMB Focus)

Managed Service Providers (MSPs) serving small and medium-sized businesses (SMBs) must elevate their game in 2026 to meet rising expectations and rapid technology changes. Globally, the MSP market continues to expand (projected at $424–$511 billion by 2026), and SMBs are channeling unprecedented investments (over $90 billion in new managed IT spending through 2026). However, with this opportunity comes intense pressure: clients demand better cybersecurity, optimized cloud services, meaningful use of AI, improved service experiences, strict compliance, greater automation, and skilled support. Many MSPs today struggle with gaps in these areas – from reactive security postures to talent shortages – which must be addressed for sustained growth. [deskday.com]

The table below summarizes key operational areas, where MSPs often fall short at present, and the essential focus and actions needed in 2026 to improve:

Area	Current Gaps / Needs Improvement	2026 Focus & Actions
Cybersecurity	Reactive approach prevalent; advanced threat detection, incident response, and user security training are often insufficient [provaltech.com].	Adopt 24/7 threat monitoring (MDR/SOC), implement zero-trust & MFA, run regular security awareness training, and offer compliance guidance (e.g. PCI/GDPR) [deskday.com], [provaltech.com].
Cloud Services	Focus often limited to migration; many lack expertise in multi-cloud management, cost optimization, and robust cloud security [deskday.com].	Provide end-to-end cloud support: manage hybrid/multi-cloud environments, practice FinOps for cost control, ensure cloud backup & DR, and leverage edge computing for low-latency needs [deskday.com], [deskday.com].
AI Integration	Slow adoption of AI – only ~30% of MSPs use AI to automate tasks, as others remain cautious or lack skills [kaseya.com] (smaller MSPs risk falling behind larger competitors [channele2e.com]).	Embed AI in operations: deploy AI-driven ticket triage/chatbots for Tier-1 support, use predictive analytics to prevent outages, and develop client-facing AI solutions (e.g. deploying productivity AI tools) [deskday.com], [channele2e.com].
Customer Experience	Often seen as mere IT vendors rather than strategic partners – value reporting and proactive guidance lag behind client expectations [channele2e.com].	Elevate client engagement: act as a vCIO with business-aligned IT roadmaps, conduct outcome-focused QBRs, provide transparent ROI dashboards (e.g. uptime improved, incidents prevented), and personalize support [channele2e.com], [provaltech.com].
Compliance & Governance	Proactive compliance management is not standard – many SMBs lack guidance on regulatory requirements and data governance [deskday.com].	Offer compliance-as-a-service: audit and ensure adherence to standards (GDPR, HIPAA, PCI), deliver automated compliance reports, and keep clients ahead of regulatory changes (adopt “compliance-first” service design) [deskday.com], [deskday.com].
Process Automation	Operations still too manual – MSPs waste 100+ hours/month on tasks (ticket entry, reporting) due to disjointed tools and <25% workflow automation [suppfusion.com], [suppfusion.com].	Maximize automation: integrate PSA/RMM and other tools to eliminate duplicate data entry [kaseya.com], use scripts/RPA for routine maintenance, auto-generate reports (e.g. for QBRs) to free time for strategic work [suppfusion.com], [suppfusion.com].
Workforce Development	Skill shortages and burnout persist – over 52% of MSPs cite hiring skilled staff as a top challenge [deskday.com], and overworked teams (59% working holidays) reflect understaffing [kaseya.com].	Bolster talent and capacity: invest in upskilling (certifications, training) [provaltech.com], improve work-life balance by offloading work (e.g. outsource NOC/SOC via white-label partners) [deskday.com], and create clear career paths to retain experts [provaltech.com].

Below, we dive into each of these focus areas, examining what MSPs are not doing well today and how they can improve in 2026, with examples and global trends in mind.

1. Strengthening Cybersecurity & Resilience

Cybersecurity is the number-one growth driver in managed services, yet many MSPs’ security offerings haven’t kept pace with evolving threats. What’s not done well: Too often, MSP security is reactive – providing basic antivirus, firewalls, and backups – but lacking in proactive threat hunting, continuous monitoring, and incident response planning. Many providers still treat security as an add-on, rather than baking it into every service. Crucially, clients now expect more: they want their MSP to be a comprehensive security partner, handling advanced threats and compliance needs, not just a help-desk for cyber issues. For example, SMBs are increasingly asking MSPs for help with compliance and cyber insurance requirements – areas in which some MSPs are underprepared. [deskday.com] [provaltech.com]

Focus for 2026: MSPs must shift from reactive to proactive security. This means adopting 24×7 threat monitoring and rapid response capabilities. For instance, a provider might set up a managed detection and response (MDR) service or partner with a Security Operations Center (SOC) to monitor client networks around the clock for intrusions. MSPs should implement zero-trust security frameworks (verify every user/device), enforce multi-factor authentication (MFA) everywhere, and regularly test backup and disaster recovery plans. Security awareness training for client employees is also key – many breaches start with human error, so MSPs should run phishing simulations and training sessions to harden the human element.

Moreover, expanding compliance services is critical. Compliance has become “table stakes” for clients in regulated industries like healthcare, finance, and manufacturing. Yet not all MSPs offer systematic compliance support today. In 2026, leading MSPs will offer Compliance-as-a-Service – e.g. continuous monitoring of compliance (using tools aligned to standards like HIPAA, PCI DSS, GDPR), automated audit reporting, and guiding clients through regulatory changes. An MSP might, for example, maintain a compliance dashboard for each client that tracks data backup practices, access controls, software patch levels, and other policy requirements in real-time. By doing so, the MSP not only protects the client’s data but also helps them avoid fines or legal issues. [deskday.com]

Example Action – Cybersecurity: One MSP serving many SMB law firms realized its basic security package was insufficient. In 2026, it invested in an AI-enhanced threat detection system and partnered with a specialized managed SIEM provider to filter and analyze logs across all client sites. It also began conducting quarterly security posture reviews for each client, showing how many attacks were blocked and recommending next steps (like encrypting all mobile devices). This proactive stance not only reduced incidents but also reassured clients with compliance concerns (e.g. demonstrating support for GDPR and emerging privacy laws). As a result, the MSP could “command premium pricing” for its security-centric services while building deeper trust with customers. [deskday.com]

In summary, cybersecurity in 2026 should permeate every aspect of an MSP’s offerings. The MSPs that succeed will be those who anticipate threats (using advanced tools and intelligence), respond swiftly to incidents, and ensure clients meet security compliance mandates. Given that cybersecurity services are growing ~18% annually (faster than the overall MSP market), investing in these capabilities is both a defensive move and a major growth opportunity. [deskday.com]

2. Optimizing Cloud Services & Infrastructure

Cloud services have become a core component of SMB IT strategies worldwide, but MSPs often struggle to move beyond basic cloud enablement. Current weaknesses: Many MSPs excel at initial cloud migrations (moving an SMB’s servers or applications to AWS/Azure or a private cloud), but fall short in ongoing optimization and multi-cloud expertise. As more businesses adopt complex architectures – e.g. hybrid clouds (mix of on-prem and cloud) and multi-cloud deployments – MSPs need deeper skill in managing and optimizing these environments. In practice, some providers still treat cloud management as a set-and-forget hosting task, missing opportunities to fine-tune performance, optimize costs, or update security configurations continuously. SMB clients, however, increasingly expect their MSP to be the cloud expert who can navigate these complexities: nearly 48% of SMBs now rely on MSPs for public cloud management (a figure climbing each year). [deskday.com]

Focus for 2026: End-to-end cloud lifecycle management should be a priority. MSPs must go beyond provisioning to deliver ongoing optimization, cost management, and integration across cloud platforms. One key area is cost optimization (FinOps) – cloud costs can spiral out of control for SMBs who lack the expertise to right-size resources. An MSP in 2026 should regularly analyze clients’ cloud usage, eliminate waste (e.g. unused VMs or over-provisioned storage), and advise on reserved instances or savings plans. This proactive cost management demonstrates tangible value. In fact, experts note that MSPs should invest in cloud optimization capabilities to meet evolving demand. [channele2e.com]

MSPs also need to handle multi-cloud and hybrid environments confidently. With 73% of organizations using hybrid cloud and multi-cloud adoption doubling in recent years, a provider might, for example, manage an SMB’s Azure infrastructure alongside a Salesforce SaaS and an on-prem file server – ensuring they all work together. Skills in cloud orchestration and monitoring tools (that work across AWS/Azure/GCP) are essential. Security in the cloud is another improvement area: MSPs should implement cloud security best practices like regular cloud vulnerability scans, proper identity & access management, encryption of data at rest and in transit, and configuration audits (using benchmarks such as CIS benchmarks for cloud). [deskday.com]

Emerging technologies present both a challenge and opportunity. Edge computing and IoT integration are on the rise, especially for industries needing real-time data processing (manufacturing, retail, smart devices). In response, MSPs should be prepared to manage distributed edge infrastructure – for example, deploying and monitoring mini-servers or appliances at client sites or in the field that sync with central cloud systems. By developing solutions for edge computing (like local data processing coupled with cloud analytics), an MSP can differentiate itself for clients who require low-latency performance. [deskday.com]

Example Action – Cloud: An MSP with several SMB clients in e-commerce noticed their cloud bills were climbing while performance issues lingered. In 2026, the MSP introduced a Cloud Cost & Performance Audit service. Using cloud management tools, it analyzed each client’s resource utilization and identified overspending (e.g. servers running at 5% utilization). It then implemented auto-scaling and schedule-based resources (shutting down non-critical systems after hours) for those clients, cutting cloud costs by 20%. They also added a multi-cloud backup solution – replicating critical data from the primary AWS environment to an Azure data center – to bolster resilience. The clients not only saved money but also gained confidence that their cloud setup was optimized and fault-tolerant, something they wouldn’t have achieved on their own.

In short, MSPs in 2026 should provide holistic cloud stewardship: from architecture planning and migration through continuous optimization, security, and new tech integration. As SMBs continue to increase spending on cloud and related services, MSPs who deliver efficiency and reliability in the cloud will deepen customer loyalty and attract new business. [channele2e.com]

3. Embracing AI-Driven Solutions and Automation

AI integration is shifting from a buzzword to a competitive necessity for MSPs. By 2026, AI won’t be optional – it will be woven into service delivery for efficiency and smarter support. Where MSPs are lagging: A surprising number of MSPs have been slow to leverage AI in their operations. Surveys show roughly 30% of MSPs are already using AI to eliminate repetitive tasks, but the majority have not yet implemented such solutions, with some firms cautious about AI’s risks or lacking in-house expertise. This reluctance is problematic: AI is rapidly changing MSP economics by automating Tier-1 support tasks, and providers not leveraging AI will struggle to compete on cost and service quality. In essence, larger MSPs (often backed by investors) are racing ahead with AI, widening the efficiency gap over smaller players. [kaseya.com] [channele2e.com]

Focus for 2026: MSPs should embed AI across their workflows to enhance both internal efficiency and customer value. A primary application is in the service desk: deploying AI-driven chatbots or virtual agents that can handle common support queries and basic troubleshooting. By 2026, an AI-powered system can automatically categorize and route tickets, suggest solutions, or even resolve issues (like password resets or simple network glitches) without human intervention. In fact, analysts predict widespread service desk automation could cut ticket volumes by 40–60% and drastically speed up resolution times. This frees up human technicians to focus on more complex issues, improving overall support quality. It’s telling that 87% of MSPs plan to increase AI investments by 2026 – the tools are becoming more accessible (built into RMM/PSA software, for instance) and MSPs recognize the ROI. [deskday.com]

Beyond support, predictive analytics is a game-changer. MSPs should use AI to analyze system logs and performance metrics to predict and prevent failures – for example, forecasting when a server might fail or when storage will run out, so they can fix it before it causes downtime. This predictive maintenance approach was once a luxury but is increasingly expected as part of proactive managed services.

MSPs can also extend AI to augment decision-making and reporting. Modern AI tools can comb through an SMB client’s data and provide insights, such as identifying security anomalies or highlighting usage trends. Some MSPs are starting to use generative AI to draft clearer client communications or create executive summaries of IT performance for quarterly reports. In 2026, we’ll see successful MSPs providing clients with AI-generated insights – for example, an automated monthly report that not only lists incidents resolved, but explains in plain language how those IT events affected the client’s business and recommends improvements (all generated with minimal human editing). [deskday.com]

Furthermore, MSPs should consider offering AI-related services to customers. SMBs often lack the knowledge to implement AI solutions themselves, so an MSP can step in as a guide. This could include setting up an AI-powered analytics platform for a client’s sales data, or integrating an AI chatbot on a client’s website for customer service. Since 55% of businesses expect their MSPs to adopt and deploy AI tech by 2026, showing expertise in practical AI applications can be a major selling point. [deskday.com]

Example Action – AI: A mid-sized MSP in 2025 handled thousands of tickets monthly and struggled with slow response times. In 2026, they integrated an AI service bot into their ticketing system. The bot uses natural language processing to understand incoming emails and chat requests from users – it automatically resolved simple issues (password resets, Wi-Fi setup instructions) and pulled up relevant knowledge base articles for technicians on more complex problems. The result was a 50% reduction in human-handled Level-1 tickets and much faster first responses. Additionally, the MSP began offering an “AI Advisory” service to clients: helping SMBs pilot tools like Microsoft’s AI Copilots or AI-based CRM add-ons to streamline their own business workflows. This not only generated a new revenue stream but also positioned the MSP as an innovation partner.

In sum, AI and automation are key to MSP efficiency and differentiation in 2026. MSPs should aim to automate away the grunt work – from repetitive troubleshooting to data reporting – so they can deliver faster service at scale. Those who fail to leverage AI will find themselves with higher costs and slower service, unable to match “AI-powered” competitors. Embracing AI is thus both a defensive strategy (to stay efficient) and an offensive one (to offer new intelligent services). [channele2e.com]

4. Enhancing Customer Experience and Strategic Value

As technology solutions commoditize, customer experience (CX) and the strategic value an MSP provides become critical differentiators. Today’s SMB clients don’t just want IT support; they want a partner who understands their business and helps it grow. Where MSPs fall short: Many MSPs still operate in a reactive, technical mindset – fixing what’s broken and maintaining systems – but not engaging at the business level or clearly demonstrating value. Clients are increasingly scrutinizing costs and asking, “What am I getting for this monthly fee?”. If the MSP only talks in technical terms (uptime, tickets closed) without linking to business outcomes, clients may feel the partnership is not delivering enough. In fact, MSP industry experts observe that successful MSPs now “sell outcomes, not just services,” using benchmarks and reviews to prove their worth. Many providers have been slow to adopt this outcomes-focused approach. [channele2e.com]

Another aspect of CX is responsiveness and personalization. SMB customers can feel neglected if their provider treats them like just another ticket number. Some MSPs could do better in maintaining regular communication, soliciting feedback, and tailoring their support to each client’s unique needs. It’s telling that clients are asking for more guidance – for example, they want help choosing which software matters, which investments to prioritize, and clarity on why MSP recommendations are made. If MSPs aren’t providing this guidance, clients may seek someone who will. [provaltech.com]

Focus for 2026: MSPs should strive to become trusted advisors to their SMB clients, not just IT fixers. This means deeply understanding each client’s industry, business goals, and challenges, and then aligning technology strategies accordingly. A concrete step is to institute regular strategic meetings – often Quarterly Business Reviews (QBRs) – but these must evolve from perfunctory report-outs to forward-looking planning sessions. Rather than just reciting metrics, the MSP should use QBRs to discuss “Here’s how your IT environment improved your business this quarter, and here’s what we recommend for the next quarter to support your goals.” For example, tie in how a new collaboration tool led to faster project completion for the client, or how the MSP’s quick incident response saved X hours of downtime, preserving the client’s revenue. Actionable outcomes should be the focus of these meetings. [provaltech.com]

To support these strategic discussions, MSPs need to provide clear, tangible reporting of value. Gone are the days of sending a generic monthly uptime report that clients might not even read. In 2026, MSPs should leverage dashboards and analytics to show key performance indicators (KPIs) that matter to the client’s leadership – whether it’s the number of cyber attacks blocked (indicating risk reduction), the time to resolve issues (operational efficiency), or improvements in system performance that enable employee productivity. As one channel expert noted, benchmarks, business reviews, and analytics dashboards have become must-haves for MSPs to prove their value. Clients also “expect more proof of value” – they want to know what was prevented, what improved, how security posture changed, and what’s coming next. Ensuring your data is clean and presented in an accessible way is vital – e.g. an MSP might implement a customer portal where the client can log in anytime to see ticket status, security alerts, and project updates in real time. [channele2e.com] [provaltech.com]

Improving customer experience also involves being proactive and consultative. An MSP should bring new ideas to the client: for instance, recommending a workflow automation tool to an accounting firm client because the MSP knows reducing manual data entry could save them money. This kind of proactive solutioneering shows the MSP is thinking about the client’s business, not just waiting for instructions. Industry trends show that clients in mature markets now expect MSPs to help predict and prevent issues and to speak the language of business outcomes. Instead of waiting for clients to ask for a technology, the MSP should be saying “We’ve analyzed your operations and we think adopting XYZ software could improve your customer satisfaction by 10%, let us help you implement it.” [deskday.com]

Personalization and responsiveness remain key to CX. Simple gestures like having a dedicated account manager who really knows the client’s environment, or sending quick status updates during a major incident, go a long way in building trust. Also, timely support (meeting or exceeding SLAs) is part of the experience – even with automation, MSPs must ensure that when a human touch is needed, they are prompt and effective.

Example Action – Customer Experience: Consider an MSP serving a chain of retail stores. Historically, they just kept the POS systems running. In 2026, the MSP shifts approach: they schedule quarterly strategy sessions with the retailer’s management. In one QBR, they present a dashboard showing that over the holiday season, their support kept 99.9% uptime, preventing an estimated 5 hours of downtime (which, for the retailer, translates to an estimated $50k of sales not lost). They also highlight that by upgrading the store’s Wi-Fi and installing a new inventory management app (their suggestion last quarter), the client’s inventory turnover improved noticeably. Going forward, the MSP recommends a customer analytics tool to help the retailer personalize marketing – a bit outside pure IT infrastructure, but a tech solution aligned to growing the retailer’s business. The client, seeing the MSP’s advice consistently improve outcomes, now views the MSP as a strategic partner rather than just an IT supplier, leading to a long-term contract and openness to more services. [provaltech.com]

In essence, the MSPs that win in 2026 will pair excellent technical service with high-touch, value-driven customer engagement. They will measure their success in the client’s terms (productivity, risk reduction, growth support) and continuously communicate that value. This shift from “vendor” to “partner” status not only improves client satisfaction but provides MSPs with opportunities to broaden their services (since satisfied clients trust them with more tasks). As one MSP CEO put it, support is essential “but strategic guidance becomes the real differentiator”. [provaltech.com]

5. Navigating Compliance and Regulatory Demands

In a world of escalating data regulations and industry-specific rules, compliance has become a critical area where MSPs need to step up. SMBs often lack dedicated compliance officers or expertise, so they look to their MSPs for help in governing IT systems according to laws and standards. Current state: Not all MSPs currently include compliance management in their service portfolio. Many focus on technology uptime and security, assuming compliance (e.g., with data privacy laws or industry regulations) is the client’s responsibility. This gap means SMBs might be unaware of vulnerabilities or violations until an audit or breach occurs. Given the proliferation of regulations – from GDPR and CCPA (privacy) to PCI DSS (payment security), HIPAA (health data), or even sector-specific cybersecurity mandates – MSPs that ignore compliance are leaving clients exposed. In 2025, forward-looking MSPs identified compliance as a major opportunity, noting that continuous compliance monitoring and audit support could command premium services. Yet execution is lagging: compliance is often addressed in a piecemeal way (e.g., enabling encryption here or there) rather than through a structured program. [deskday.com]

Focus for 2026: Make compliance and governance a proactive service, not an afterthought. MSPs should familiarize themselves with the key regulations affecting their client base. For example, if you support medical clinics, HIPAA guidelines on data protection and breach notification should be second nature; if you serve European customers, GDPR’s requirements for data handling and breach reporting must be baked into your processes. In practical terms, MSPs need to audit their clients’ systems for compliance gaps regularly. This could entail running tools that check for data that’s stored without proper encryption, or ensuring that access rights are configured according to least privilege principles.

Offering Compliance-as-a-Service (CaaS) can differentiate an MSP. CaaS might include services such as: policy development (helping an SMB craft an IT usage policy or data retention policy), continuous monitoring (monitoring logins, file transfers, and configurations against compliance benchmarks), and automated compliance reporting. For instance, an MSP can use dashboard tools to map a client’s status against frameworks like NIST or ISO 27001, showing which controls are in place and which need attention. Prior to audits or assessments, the MSP can run an “audit readiness” exercise to fix issues. It’s also wise to educate clients – e.g., hold an annual workshop on new laws (such as updates to privacy regulations) that the client needs to know about. [deskday.com]

Compliance efforts go hand-in-hand with security improvements, but have a distinct business value: they reduce risk of legal penalties and build trust with the client’s customers. SMBs may not have realized their MSP could help here, so proactively offering this service in 2026 can meet an unmet need. Industry data suggests MSPs especially in mature markets (US, Canada, EU, ANZ) are starting to adopt a “compliance-first” service design approach, making compliance a core part of every solution due to strict regulations in these regions. This trend will likely spread worldwide as more countries introduce data protection laws. [deskday.com]

Example Action – Compliance: A small finance company (client of an MSP) faces strict regulations (PCI DSS for credit card data and new cybersecurity mandates from their government). The MSP decides in 2026 to create a Compliance Dashboard for this client. Each month, the dashboard scans the client’s systems: checking that all devices have the latest security patches, that antivirus is active, that only approved personnel accessed sensitive databases, and that backups were performed. The MSP shares this dashboard during monthly calls, so the client sees they are, say, 98% compliant with PCI requirements, with specific recommendations to get to 100%. When the client undergoes its annual audit, the MSP helps generate the required reports (e.g. user access logs, incident logs) at a click of a button. The audit passes without major findings – a stark improvement from previous years. The client’s executives now sleep better knowing compliance is continuously watched by their MSP.

In short, MSPs in 2026 should integrate compliance into their offerings to protect clients not just from hackers, but also from regulators. This involves staying current on relevant laws, leveraging tools to automate compliance checks, and guiding clients through the complex maze of requirements. By doing so, MSPs add a layer of strategic value (shielding clients from fines and reputational damage) and strengthen their role as a long-term partner. Given that regulatory scrutiny is only increasing globally, a proactive stance on compliance is both a defensive necessity and a chance to build trust (clients will know their MSP “has their back” on more than just tech). [deskday.com]

6. Driving Efficiency with Process Automation

Operational efficiency is the backbone of MSP profitability and service quality. Yet, many MSPs today are held back by inefficient, manual processes, which translates into slower service for clients and squeezed margins for the MSP. What’s not working: Despite great advancements in management tools, surveys reveal that MSP teams still spend excessive time on low-value, repetitive tasks. For example, one study found MSP staff spend over 100 hours per month on manual chores like re-entering ticket data between systems, preparing reports for QBRs, and reconciling billing—tasks that could be automated. In interviews, managers admitted that engineers spend “half their week” babysitting these processes instead of focusing on higher-level projects. There’s wide acknowledgment (95% of MSP leaders agree) that automation is required for growth, and that repetitive busywork is blocking strategic initiatives. However, most MSPs estimate they’ve automated fewer than 25% of their core workflows so far. The reasons cited include lack of time to set up automations, disparate tools that don’t talk to each other, and the complexity of custom scripting. This is a clear area where MSPs are not doing well enough currently – they know automation is key, but progress has been uneven and slow. [suppfusion.com]

Focus for 2026: The coming year should be when MSPs aggressively streamline and automate their operations. Efficiency isn’t just about saving money – it directly impacts customer satisfaction (faster, error-free service) and the MSP’s ability to scale without adding headcount. Here are key targets for automation:

Integrating Systems: A major source of inefficiency is when the PSA (professional services automation tool, for tickets/billing) doesn’t integrate with the RMM (remote monitoring and management) or other tools – technicians end up copying data from one system to another. In 2026, MSPs should ensure their core platforms are tightly integrated or consider moving to unified platforms. It’s telling that 95% of MSPs say integrating RMM, PSA, backup, and documentation tools is essential. For instance, if a monitoring alert can automatically generate a ticket in the PSA (with all relevant info attached), and that in turn updates documentation and billing records, it cuts out a lot of swivel-chair work. Many MSPs are pursuing tool consolidation – using fewer, more integrated tools – to achieve this. [kaseya.com] [deskday.com]
Automating Routine Tasks: Every MSP has a set of mundane tasks that happen daily or weekly – applying patches, updating antivirus definitions, onboarding a new user account, checking backup status, etc. Scripting and RPA (Robotic Process Automation) can handle many of these. By 2026, MSPs should have automated patch management across client devices (with approvals for exceptions), scheduled scripts to resolve common alerts (e.g., auto-restart a service if it stops), and automatic user provisioning workflows (so when a client hires someone, the MSP’s system creates the necessary accounts and permissions through a predefined script). Many MSP tools come with automation capabilities that may be underutilized; now is the time to exploit them fully. As one industry CEO quipped, 2025 was the year of “we should automate that,” and 2026 is the year MSPs must do it – you can’t scale without automation. [provaltech.com]
Eliminating Duplicate Work in Client Reporting: As discussed in the CX section, account managers often spend hours collating data for client reports. Automating this reporting is a quick win. MSPs can set up their PSA or BI (business intelligence) tools to pull metrics (tickets resolved, SLA compliance, security events) and generate a polished report or dashboard with minimal human input. This might involve adopting a reporting tool or writing some integrations, but it pays off every quarter, and it allows account managers to spend time on analysis rather than assembly. Some MSPs are adopting client-facing dashboards that are always up-to-date, drastically reducing the need to manually build slide decks. [suppfusion.com]
Workflow Automation and AI Ops: Beyond individual tasks, MSPs should examine end-to-end workflows for automation opportunities. For instance, when a monitoring alert comes in (say CPU usage high on a server), a fully automated workflow might create a ticket, run a diagnostic script on the server, attach the results to the ticket, and if a simple threshold condition is met (like a runaway process), even attempt a remediation (kill or restart the process). If that fixes it, the system closes the ticket with notes; if not, it escalates to a human. Achieving such “self-healing” workflows is increasingly possible with AI Ops tools and advanced scripting. The concept of a “Zero-Touch MSP” – where AI handles 90% of tickets and routine changes – is on the horizon and some SMB-focused MSPs will start approaching that model by mastering their vendors’ automation features. [techaisle.com]

To get there, MSPs should overcome barriers by allocating time for automation projects (maybe dedicating a staff member a few hours a week to building automations) and leveraging community scripts and best practices. The new generation of MSP owners, often backed by private equity, are already pushing for this operational efficiency as a mandate. [suppfusion.com], [suppfusion.com]

Example Action – Automation: A 20-person MSP found its engineers were drowning in repetitive tasks and using 10+ different tools that didn’t sync well. In 2026, they embarked on an “Automation Sprint”: First, they consolidated from 3 separate monitoring and ticketing systems to a single unified platform to reduce context switching. Next, they identified the top 5 daily tasks that ate up engineer time – patching Windows, adding new Office365 accounts for clients, resetting passwords, updating tickets, and compiling monthly reports. They created scripts for each: patches now deploy automatically with reports of success/failure; a simple form was built for clients to request new accounts which triggers an automated user creation in all relevant systems; a self-service password reset tool was rolled out; ticket updates between their systems and a major client’s system were linked via API to stop double entry. They also set up a dashboard that pulls data from their PSA to auto-generate QBR slides. Over a few months, they measured a reduction of ~120 hours of busywork per month across the team. Technicians now spend those hours on project work and learning new skills, which benefits both the MSP and its clients through faster project delivery and more informed staff. [kaseya.com] [suppfusion.com]

The lesson is clear: streamlining operations through automation is no longer optional. In 2026, the most successful MSPs will be those who have turned efficiency into a competitive advantage – enabling them to offer faster response times, more consistent service, and even innovative pricing models (because automation can reduce the cost to serve). Clients ultimately benefit from this through fewer errors and quicker service. As MSP commentary notes, the new wave of MSP leadership “expects operational efficiency and scalability” and will prioritize automation and data-driven processes to stay competitive. MSPs should do the same, treating automation not as a one-off project but as an ongoing discipline (continuously finding new ways to eliminate waste and streamline as tools evolve). [suppfusion.com]

7. Investing in Workforce Development and Talent

Behind every successful MSP is a skilled and motivated team. In 2026, human talent remains irreplaceable – even as AI and automation handle more tasks – because people drive the complex problem-solving, relationship management, and strategic planning that set top MSPs apart. The problem: The MSP industry is facing serious talent challenges. There’s a well-documented shortage of IT professionals, especially in high-demand areas like cybersecurity and cloud architecture. According to industry surveys, 52% of MSPs identify hiring and recruiting as their primary challenge, and 68% of IT leaders in MSPs struggle to find cloud and security expertise. The talent gap often forces MSPs to either overwork their existing staff or turn down business. Indeed, burnout is an issue: nearly 40% of MSP techs were working 50+ hour weeks in recent years and 59% had to work through holidays to keep up with workload. Such strain leads to high turnover, which creates a vicious cycle of understaffing. [deskday.com] [kaseya.com]

Moreover, MSPs sometimes underinvest in training their staff. In the rush of daily operations, keeping engineers’ skillsets up-to-date (with new certifications or learning emerging technologies) can fall by the wayside. This leaves teams ill-prepared for new service offerings (like managing a new cloud platform or a new security tool) that clients might demand.

Focus for 2026: MSPs need a multi-pronged strategy to build and maintain a strong workforce, treating talent as a long-term investment:

Upskilling and Continuous Learning: Make 2026 the year your MSP implements a formal training program. This could include paying for certifications (e.g. Azure/AWS certifications, cybersecurity certs like CISSP, vendor-specific courses for popular tools). It might mean allocating each engineer a certain number of training hours per quarter that are sacrosanct. By upskilling existing employees, MSPs can fill skill gaps internally. For example, turning a good systems admin into a cloud architect through a structured learning path benefits the MSP far more than trying to hire a cloud architect in a tight market. As one MSP CEO advises, “the MSPs that grow will be the ones that develop the people they already have.”. Also, encourage knowledge sharing within the team (senior engineers mentoring juniors, internal workshops, etc.), which can accelerate learning and increase engagement. [provaltech.com]
Use External Support to Augment Staff: When hiring is tough, lean on creative solutions like outsourcing or partnerships. Many MSPs are turning to white-label service providers or contractors for certain functions – e.g. using an outsourced Network Operations Center (NOC) or Security Operations Center (SOC) service that operates under the MSP’s brand. This way, you can offer 24/7 coverage or specialized skills (like advanced cybersecurity analysis) without having to hire for every role. Notably, white-label partnerships have grown ~80% over three years in the MSP space. For an MSP, this could mean partnering with a third-party to handle after-hours support or level-1 tickets, relieving your core team at night. Or outsourcing complex tasks like mobile app support to a niche firm. The key is to convert fixed labor costs into flexible resources – scaling up when needed, scaling down when not, while your clients still experience a seamless service. In 2026, MSPs should evaluate which services are better done in-house versus through partners, and not be afraid to offload non-core or hard-to-hire areas. [deskday.com]
Improve Work-Life Balance and Retention: Recognize that burnout will cause you to lose the talent you have. MSP leadership should institute policies to protect their teams from perpetual overwork. This might involve hiring ahead of demand when possible, using automation (as above) to remove after-hours pager fatigue, and enforcing time-off so people can recharge. Flexible work arrangements (remote work options, which are common now) can help retain employees too. Additionally, create clear career paths within the MSP. One reason people leave is the feeling of stagnation; show your techs how they can progress to senior roles, lead specialist positions, or even vCIO-type consulting roles as they grow. Regular 1:1s discussing career goals and aligning training to those goals can improve morale and loyalty. [provaltech.com]
Leverage Vendor Training and Communities: Many tech vendors (Microsoft, Cisco, security vendors, etc.) offer extensive training resources for their partners. In the next year, make sure to tap into these vendor-backed training programs. For example, if a new security product is launched that you plan to offer, send engineers to the vendor’s certification course early. Encouraging staff to participate in MSP communities or events (like user groups, webinars, industry conferences) can also spark new ideas and professional growth, which they bring back to your business. The channel is expecting more vendor support in this area – so take advantage of it. [channele2e.com]

Example Action – Workforce: A growing MSP of 15 employees had trouble hiring senior cloud engineers in 2025. In 2026, they took a different approach: they identified two junior techs with interest in cloud and enrolled them in an accelerated Azure training program (funded by the MSP). Within months, those juniors earned certifications and started taking on cloud project work under supervision, filling much of the gap. To cover overnight shifts, the MSP contracted with a reputable NOC service that would handle alerts from midnight to 6 AM, so their on-call engineers could actually rest at night. They also instituted “Tech Fridays” – every second Friday afternoon, the company sets aside client work and all staff focus on learning: taking an online course, lab time, or sharing knowledge with peers. This became a valued perk and led to cross-training (e.g. the security specialist taught a class on advanced firewall management to others). By year-end, employee satisfaction (measured via survey) was up significantly, the MSP’s attrition dropped to near-zero, and their enhanced skills meant they could offer new services (like Azure database management) without external hires.

In summary, solving the talent puzzle is vital for 2026. MSPs should treat their employees as their greatest asset, because they are. A combination of developing internal talent, easing workloads through smart resourcing and automation, and fostering a positive work environment will pay dividends. Not only will this ensure you have the skills to deliver all the advanced services discussed (security, cloud, AI, etc.), but clients will notice stability and expertise in their interactions (frequent turnover or junior, untrained support is a red flag to many customers). Given the tight labor market, MSPs that invest in people will be the ones with the capacity to grow and innovate, whereas those that neglect it may find they can’t meet client needs or quality standards due to staffing shortfalls.

Conclusion: Succeeding in 2026 – From MSP to Business Partner

Entering 2026, MSPs globally – especially those catering to SMBs – must retool and refocus across these critical operational areas. The overarching theme is moving up the value chain: from putting out IT fires to delivering strategic prevention; from offering generic services to providing specialized, client-tailored solutions; from using people for every task to harnessing automation and AI for scalability. The challenges are real – cyber threats are more serious, technology is more complex, competition is fiercer, and clients are more demanding. But so are the opportunities: SMBs are investing heavily in technology and rely on MSPs more than ever for expertise. The MSPs that proactively improve in the areas discussed – security, cloud, AI, customer success, compliance, efficiency, and talent – will position themselves to capture this growth. [deskday.com]

It’s worth noting that in mature IT markets, clients now expect MSPs to behave almost like consulting partners with automation engines, blending advisory insight with flawless execution. This is a useful vision for 2026: an MSP that can talk business outcomes, ensure compliance and security, implement cutting-edge tech (cloud/AI) smoothly, and continually optimize its own operations behind the scenes. Achieving all of this at once is daunting, so MSPs should prioritize incrementally: for example, “secure first, automate second” – shoring up cybersecurity and compliance before layering fancy AI, since automation without security just accelerates risk. They should also pick a focus – mastering one vertical or technical specialty at a time – rather than try to do everything broadly. [deskday.com]

By addressing what is not being done well today and committing to these improvements, MSPs can transform their businesses in 2026. The payoff will be stronger customer relationships (and contract renewals), higher margins (through efficiency and premium services), and sustainable growth even in competitive markets. In contrast, MSPs that cling to the old break-fix, “one-size-fits-all” mindset will increasingly struggle – facing commoditization and client churn as they fail to meet rising standards. [deskday.com]

In conclusion, 2026 is set to be a pivotal year for the MSP industry. It will reward providers who are bold and strategic – those who invest in AI and automation, build deep security and compliance capabilities, tailor their services to client needs, and nurture talented teams. MSPs that embrace these changes will not just survive the evolving landscape, they will thrive as indispensable partners in their customers’ success. The blueprint is clear; now it’s about execution. As the industry saying goes, the MSPs who evolve will lead, and those who don’t will be left behind. By focusing on the areas outlined above, MSPs can ensure they are on the leading side of that equation in 2026.

How to Configure Microsoft 365 Business Premium to Block AI Browsers: A Complete Guide to Stopping Comet and Other Agentic Browsers

Executive Summary

In December 2025, Gartner issued an urgent advisory recommending that organizations “block all AI browsers for the foreseeable future” due to critical cybersecurity risks.AI browsers like Perplexity’s Comet and OpenAI’s ChatGPT Atlas introduce threats including irreversible data loss, prompt injection vulnerabilities, and unauthorized credential access.With 27.7% of organizations already having at least one user with an AI browser installed,the time to act is now. [computerworld.com]

This comprehensive guide provides step-by-step instructions for configuring Microsoft 365 Business Premium (M365 BP), specifically Microsoft Defender for Cloud Apps, to detect, monitor, and block AI-enabled browsers like Comet from accessing your enterprise resources.

Understanding the AI Browser Threat Landscape

Why AI Browsers Are Dangerous

According to Gartner analysts, “The real issue is that the loss of sensitive data to AI services can be irreversible and untraceable. Organizations may never recover lost data.” [computerworld.com]

Key Security Concerns:

Autonomous Actions Without Oversight – AI browsers can autonomously navigate websites, fill out forms, and complete transactions while authenticated, creating accountability concerns for erroneous or malicious actions [computerworld.com]
Traditional Controls Are Inadequate – “Traditional controls are inadequate for the new risks introduced by AI browsers, and solutions are only beginning to emerge,” according to Gartner’s senior director analyst Evgeny Mirolyubov [computerworld.com]
Multi-Modal Communication Gaps – A major gap exists in inspecting multi-modal communications with browsers, including voice commands to AI browsers [computerworld.com]
Immature Security Posture – Discovered vulnerabilities highlight broader concerns about the maturity of AI browser technology, with solutions likely taking “a matter of years rather than months” to mature [computerworld.com]

Prerequisites and Licensing Requirements

Required Licenses

To implement comprehensive AI browser blocking, you need: [wolkenman….dpress.com]

License Option	What’s Included
Microsoft 365 Business Premium + E5 Security Add-on	Defender for Cloud Apps + Defender for Endpoint
Microsoft 365 E5 / A5 / G5	Full suite including Conditional Access App Control
Enterprise Mobility + Security E5	Defender for Cloud Apps + Defender for Endpoint
Microsoft 365 F5 Security & Compliance	All required components
Microsoft 365 Business Premium + Defender for Cloud Apps Add-on	Minimum required configuration

Technical Prerequisites

Before implementing blocking policies, ensure: [learn.microsoft.com], [learn.microsoft.com]

✅ Microsoft Defender for Cloud Apps license (standalone or bundled)
✅ Microsoft Entra ID P1 license (standalone or bundled)
✅ Microsoft Defender for Endpoint deployed and configured
✅ Cloud Protection enabled in Defender for Endpoint [learn.microsoft.com]
✅ Network Protection enabled in Defender for Endpoint [learn.microsoft.com]
✅ Admin permissions – Global Administrator or Security Administrator role
✅ Microsoft Defender Browser Protection extension installed on non-Edge browsers [learn.microsoft.com]

Multi-Layered Defense Strategy

Blocking AI browsers requires a comprehensive, defense-in-depth approach using multiple Microsoft 365 security layers:

Configuration Guide: Step-by-Step Implementation

Phase 1: Enable Cloud Discovery for AI Applications

Objective: Gain visibility into which AI browsers and applications are being used in your organization.

Step 1.1: Access Cloud Discovery Dashboard

Navigate to Microsoft Defender Portal (https://security.microsoft.com)
Go to Cloud Apps → Cloud Discovery → Dashboard
Set the time range to Last 90 days for comprehensive analysis [wolkenman….dpress.com]

Step 1.2: Filter for Generative AI Applications

In the Cloud Discovery dashboard, click Category filter
Select “Generative AI” from the category list [wolkenman….dpress.com]
Review discovered AI applications with their risk scores
Note applications with High Risk status (red indicators) [wolkenman….dpress.com]

Step 1.3: Identify AI Model Providers and MCP Servers

Beyond browsers, also identify: [wolkenman….dpress.com]

AI – Model Providers (Azure OpenAI API, Google Gemini API, Anthropic Claude API)
AI – MCP Servers (Model Context Protocol servers)

Navigate to: Cloud Apps → Cloud App Catalog → Filter by “AI – Model Providers” and “AI – MCP Servers”

Phase 2: Configure Defender for Endpoint Integration

Objective: Enable automatic blocking of unsanctioned apps through network-level enforcement.

Step 2.1: Enable Enforce App Access

In Microsoft Defender Portal, navigate to:
- Settings → Cloud Apps → Cloud Discovery → Enforce App Access [wolkenman….dpress.com]
Toggle “Automatically block unsanctioned apps” to ON
This creates automatic indicators in Defender for Endpoint when apps are marked as unsanctioned [wolkenman….dpress.com]

Step 2.2: Verify Network Protection Status

Ensure Network Protection is enabled for all browsers: [wolkenman….dpress.com]

Navigate to Settings → Endpoints → Configuration Management
Go to Enforcement Scope → Network Protection
Verify status is set to “Block mode” (not just Audit mode)
Apply to All devices or specific device groups

Why This Matters: Network Protection ensures that blocks work across all browsers (Chrome, Firefox, etc.), not just Microsoft Edge. [wolkenman….dpress.com]

Phase 3: Unsanction and Block Comet Browser

Objective: Mark Comet and other AI browsers as unsanctioned to trigger automatic blocking.

Step 3.1: Search for Comet in Cloud App Catalog

Go to Cloud Apps → Cloud App Catalog
Use the search function to find “Comet” or “Perplexity”
Click on the application to review its risk assessment

Note: If Comet hasn’t been discovered yet in your environment, you can still add custom URLs for blocking (see Phase 6).

Step 3.2: Unsanction the Application

Click the three dots (⋮) at the end of the application row
Select “Unsanctioned” [learn.microsoft.com]
A confirmation dialog will appear indicating the app will be blocked by Defender for Endpoint [wolkenman….dpress.com]
Click Confirm

Step 3.3: Verify Indicator Creation

Navigate to Settings → Endpoints → Indicators → URLs/Domains [wolkenman….dpress.com]
Confirm that domains associated with Comet appear with action “Block execution”
Processing may take 5-15 minutes

Example domains that may be blocked:

*.perplexity.ai
comet.perplexity.ai
Related CDN and API endpoints

Phase 4: Create Conditional Access Policies

Objective: Route traffic through Defender for Cloud Apps proxy for deep inspection and control.

Step 4.1: Create Base Conditional Access Policy

Sign in to Microsoft Entra Admin Center (https://entra.microsoft.com)
Navigate to Protection → Conditional Access → Policies
Click + New policy [learn.microsoft.com]

Step 4.2: Configure Policy Settings

Policy Name: Block AI Browsers via Session Control

Assignments: [learn.microsoft.com]

Setting	Configuration
Users	Select All users (exclude break-glass accounts)
Target Resources	Select Office 365, SharePoint Online, Exchange Online
Conditions	Optional: Add device platform, location filters

Access Controls: [learn.microsoft.com]

Under Session → Select “Use Conditional Access App Control”
Choose “Use custom policy”
Click Select

Enable Policy: Set to Report-only initially for testing [learn.microsoft.com]

Step 4.3: Save and Validate

Click Create
Wait 5-10 minutes for policy propagation
Test with a pilot user account

Critical Note: Ensure the “Microsoft Defender for Cloud Apps – Session Controls” application is NOT blocked by other Conditional Access policies, or session controls will fail. [learn.microsoft.com]

Phase 5: Create Session Policies to Block AI Browser User Agents

Objective: Create real-time session policies that identify and block AI browsers based on user-agent strings and behavioral patterns.

Step 5.1: Create Access Policy for User-Agent Blocking

This is one of the most effective methods to block specific browsers like Comet. [securityhq.com]

In Microsoft Defender Portal, navigate to:
- Cloud Apps → Policies → Policy Management → Conditional Access tab [learn.microsoft.com]
Click Create policy → Access policy [learn.microsoft.com]

Step 5.2: Configure Access Policy Details

Basic Information: [learn.microsoft.com]

Field	Value
Policy Name	`Block AI Browsers - Comet and Similar Agents`
Policy Severity	High
Category	Access control
Description	Blocks access attempts from AI-enabled browsers including Comet, Atlas, and other agentic browsers based on user-agent detection

Step 5.3: Set Activity Filters

Activities matching all of the following: [learn.microsoft.com]

App: Select applications to protect
- Office 365
- Exchange Online
- SharePoint Online
- Microsoft Teams
- OneDrive for Business
Client app: Select Browser [learn.microsoft.com]
User agent tag:
- Contains “Comet”
- Or create custom user-agent filter (see Step 5.4)
Device type: (Optional) Apply to specific device types

Step 5.4: Create Custom User-Agent String Filters

While Defender for Cloud Apps doesn’t expose direct user-agent string matching in the UI by default, you can leverage activity filters: [securityhq.com]

Known AI Browser User-Agent Patterns to Block:

User-Agent patterns (Create separate policies or use contains logic):
- Contains "Comet"
- Contains "Perplexity"
- Contains "axios" (common in automated tools)
- Contains "ChatGPT" (for Atlas browser)
- Contains "AI-Browser"
- Contains "agentic"

Advanced Method – Using Session Policy with Inspection:

Create a Session Policy instead of Access Policy
Set Session control type: to “Block activities” [learn.microsoft.com]
Under Activity type, select relevant activities
In Inspection method, configure content inspection rules

Step 5.5: Set Actions

Actions:

Select “Block”
Enable “Notify users” with custom message:

Access Denied: AI-Enabled Browser Detected

Your organization's security policy prohibits the use of AI-enabled browsers 
(such as Comet, Atlas, or similar tools) to access corporate resources due to 
data security and compliance requirements.

Please use Microsoft Edge, Chrome, or Firefox to access this resource.

If you believe this is an error, contact your IT helpdesk.

Step 5.6: Enable Governance Actions

Select “Send email to user”
Select “Alert severity” as High
Enable “Create an alert for each matching event”

Step 5.7: Activate the Policy

Review all settings
Click Create
Policy becomes active immediately
Monitor via Activity Log for matches

Phase 6: Block Comet Domains via Custom Indicators

Objective: Manually add Comet-related domains to Defender for Endpoint indicators for network-level blocking.

Step 6.1: Identify Comet-Related Domains

Based on Perplexity’s infrastructure, key domains include: [computerworld.com]

Primary Domains:
- perplexity.ai
- www.perplexity.ai
- comet.perplexity.ai
- api.perplexity.ai

CDN and Supporting Infrastructure:
- *.perplexity.ai (wildcard)
- assets.perplexity.ai
- cdn.perplexity.ai

Step 6.2: Create URL/Domain Indicators

Navigate to Settings → Endpoints → Indicators → URLs/Domains
Click + Add item

For each domain, configure:

Field	Value
Indicator	perplexity.ai
Action	Block
Scope	All device groups (or specific groups)
Title	Block Perplexity Comet Browser
Description	Blocks access to Perplexity Comet AI browser per organizational security policy
Severity	High
Generate alert	Yes

Click Save
Repeat for all identified domains

Step 6.3: Test Domain Blocking

From a test device with Defender for Endpoint installed
Navigate to https://www.perplexity.ai in any browser
You should see: [wolkenman….dpress.com]

This site has been blocked by your organization
Microsoft Defender SmartScreen blocked this unsafe site

This web page was blocked by Microsoft Defender Application Control
perplexity.ai has been blocked by your IT administrator

Phase 7: Create Cloud Discovery Policies for Alerting

Objective: Set up automated alerts when AI browsers are detected in your environment.

Step 7.1: Create App Discovery Policy

Navigate to Cloud Apps → Policies → Policy Management
Click Create policy → App discovery policy [learn.microsoft.com]

Step 7.2: Configure Discovery Policy

Policy Template: Use “New risky app” template or create custom [learn.microsoft.com]

Field	Configuration
Policy Name	`Alert on New AI Browser Detection`
Category	Cloud discovery
Risk score	High and Medium
App category	Select “Generative AI”
Traffic volume	Greater than 10 MB (adjust as needed)

Filters:

App category equals Generative AI
Risk score less than or equal to 6 (out of 10)
App tag equals Unsanctioned

Governance Actions:

Send email to security team
Create alert with High severity

Testing and Validation

Validation Checklist

Monitoring and Reporting

Activity Log Monitoring:

Cloud Apps → Activity Log
Filter by:
- Policy: Select your AI browser blocking policies
- Action taken: Block
- Date range: Last 7 days

Defender for Endpoint Alerts:

Incidents & Alerts → Alerts
Filter by:
- Category: Custom indicator block
- Title: Contains “Perplexity” or “Comet”

Advanced Configuration Options

Option 1: Device Compliance Requirements

Combine AI browser blocking with device compliance:

In Conditional Access policy, add Conditions → Device platforms
Require devices to be Compliant or Hybrid Azure AD Joined
Use Intune compliance policies to check for:
- Comet browser installation (custom script detection)
- Other AI browser installations

Option 2: Warn and Educate Mode

Before full blocking, consider “Warn and Educate” mode: [learn.microsoft.com]

Set indicators to “Warn” instead of “Block”
Users see warning message but can proceed (with logging)
Collect usage data for 2-4 weeks
Transition to Block mode after user education

Option 3: Scoped Blocking by Device Groups

Target specific departments first:

In Defender for Endpoint, create device groups:
- Finance Team
- Executive Leadership
- High-Risk Departments
Apply indicators only to these groups initially
Expand gradually after validation

Option 4: DLP Integration for Data Leaving via AI Browsers

Even with blocks, ensure data leakage prevention:

Create Microsoft Purview DLP policies
Target “All locations” including endpoints
Configure rules to detect sensitive data:
- Credit card numbers
- Social Security numbers
- Confidential project names
Block upload/sharing of sensitive content

Identifying Comet Browser Technical Indicators

User-Agent String Analysis

While official Comet user-agent strings aren’t publicly documented by Perplexity, AI browsers typically exhibit these patterns:

Common AI Browser User-Agent Characteristics:

Mozilla/5.0 (Platform) ... Comet/[version]
Mozilla/5.0 (Platform) ... Perplexity/[version]
Chromium-based with custom identifiers
May contain "AI", "Agent", "Agentic" in UA string

Detection Strategy:

Review Activity Log in Defender for Cloud Apps
Filter for unknown/suspicious user agents
Export activity data with user-agent strings
Analyze patterns using PowerShell or Excel
Update policies based on findings

Network Traffic Patterns

Comet communicates with Perplexity cloud infrastructure: [computerworld.com]

High-frequency API calls to api.perplexity.ai
WebSocket connections for real-time AI responses
Upload of page content and browsing context
Telemetry to Perplexity servers

Monitor via Defender for Cloud Apps:

Cloud Apps → Activity Log
Filter by IP address ranges (if known)
Look for unusual upload patterns

Troubleshooting Common Issues

Issue 1: Blocks Not Working in Chrome/Firefox

Symptom: Comet/Perplexity sites accessible in non-Edge browsers

Solution: [wolkenman….dpress.com]

Verify Network Protection is enabled in Defender for Endpoint
Check Settings → Endpoints → Configuration Management
Ensure status is “Block” not “Audit”
Restart browser and test again

Issue 2: Conditional Access Policy Not Triggering

Symptom: Users can access M365 apps without session controls

Solution:

Verify Conditional Access policy is in “On” mode (not Report-only) [learn.microsoft.com]
Check that “Microsoft Defender for Cloud Apps – Session Controls” app is not blocked
Ensure apps are listed as “Monitored” in Conditional Access App Control [securityhq.com]
Clear browser cache and test in incognito mode

Issue 3: Legitimate Traffic Being Blocked

Symptom: False positives blocking valid user activity

Solution:

Review Activity Log for specific blocked events
Refine user-agent filters to be more specific
Create exception policies for legitimate tools
Use “Exclude” filters in policies for specific users/groups

Issue 4: Indicators Not Appearing in Defender for Endpoint

Symptom: Unsanctioned apps don’t create indicators

Solution:

Verify “Enforce App Access” is enabled [wolkenman….dpress.com]
Check that Defender for Endpoint integration is active
Wait 15-30 minutes for synchronization
Manually create indicators if automatic creation fails

Best Practices and Recommendations

Strategic Recommendations

Phased Rollout Approach
- Week 1-2: Report-only mode, gather usage data
- Week 3-4: Warn mode for user education
- Week 5+: Full block mode enforcement
User Communication Strategy[computerworld.com]
- Send organization-wide email explaining policy
- Provide approved alternatives
- Create FAQ document
- Offer training on secure browsing practices
Continuous Monitoring
- Review Cloud Discovery weekly for new AI apps
- Monitor activity logs daily for policy violations
- Track emerging AI browser releases
- Update indicators quarterly
Exception Process
- Create formal request process for exceptions
- Require executive approval for high-risk apps
- Document business justification
- Apply additional controls for approved exceptions (DLP, session monitoring)
Defense in Depth[wolkenman….dpress.com]
- Don’t rely solely on browser blocking
- Implement data loss prevention (DLP)
- Use endpoint detection and response (EDR)
- Enable Microsoft Purview for data governance
- Deploy insider risk management

Policy Comparison Table

Method	Scope	Effectiveness	User Experience	Management Overhead
Cloud Discovery + Unsanctioning	Network-wide	⭐⭐⭐⭐⭐	Transparent (blocked before access)	Low (automated)
Session Policies	M365 Apps only	⭐⭐⭐⭐	May show warning messages	Medium (requires tuning)
Access Policies	M365 Apps only	⭐⭐⭐⭐⭐	Blocks before session starts	Medium
Manual Indicators	All network traffic	⭐⭐⭐⭐	Transparent	High (manual updates)
Conditional Access	Cloud apps only	⭐⭐⭐⭐	May require re-authentication	Low

Recommended Combination: Use Cloud Discovery + Unsanctioning AND Access Policies for comprehensive coverage.

Staying Current: Monitoring New AI Browsers

AI browsers are rapidly evolving. Stay ahead of threats:

Monthly Review Checklist

✅ Cloud App Catalog Updates

Review newly discovered apps in Generative AI category
Check for new AI Model Providers
Assess risk scores of emerging tools

✅ Threat Intelligence

Monitor Gartner reports on AI browser security [gartner.com]
Follow Microsoft Security Blog
Subscribe to CISA alerts
Track CVE databases for AI browser vulnerabilities

✅ Policy Effectiveness

Review blocked connection attempts
Analyze bypass attempts
Update user-agent filters
Refine domain lists

Emerging AI Browsers to Monitor

Beyond Comet and Atlas, watch for:

Brave Leo Browser (AI-enhanced features)
Opera One (integrated AI)
Arc Browser (with AI capabilities)
SigmaOS (AI-powered browsing)
Browser Company products

Compliance and Documentation

Required Documentation

Maintain these records for audit purposes:

Policy Documentation
- Policy names, purposes, and justifications
- Configuration settings and filters
- Approval chains and stakeholder sign-offs
Change Log
- Policy modifications
- Domain additions/removals
- Exception approvals
Incident Reports
- Blocked access attempts
- Policy violations
- User complaints and resolutions
Risk Assessment
- Why AI browsers are blocked
- Business impact analysis
- Alternative solutions provided to users

Regulatory Considerations

Consider these compliance frameworks:

Framework	Relevance
GDPR	Data processing outside organization control
HIPAA	Protected health information exfiltration risk
SOX	Financial data protection requirements
PCI DSS	Cardholder data security
NIST 800-53	Access control requirements

Conclusion: Taking Action Against AI Browser Risks

The threat posed by AI browsers like Perplexity’s Comet is real, immediate, and growing. With security experts uniformly recommending that organizations “block all AI browsers for the foreseeable future,”the time for action is now—not later. [pcmag.com], [gartner.com]

Key Takeaways:

Gartner’s Warning is Clear: AI browsers introduce “irreversible and untraceable” data loss risks that traditional controls cannot adequately mitigate [computerworld.com]
Multi-Layered Defense is Essential: Combining Cloud Discovery, Session Policies, Access Policies, and Network Protection provides comprehensive coverage
Microsoft 365 Business Premium Provides the Tools: With Defender for Cloud Apps and Defender for Endpoint, you have enterprise-grade capabilities to detect and block AI browsers
User Education is Critical: Technical controls must be paired with clear communication about why AI browsers pose risks and what alternatives are approved
Continuous Vigilance Required: The AI browser landscape evolves rapidly; monthly reviews of your defenses are essential [computerworld.com]

Immediate Action Steps

This Week:

✅ Enable Cloud Discovery and filter for Generative AI apps
✅ Review current AI browser usage in your organization
✅ Enable “Enforce App Access” in Defender for Cloud Apps
✅ Verify Network Protection is enabled in Defender for Endpoint

Next Week:

✅ Create Conditional Access policy routing traffic to MDCA
✅ Unsanction Comet and other AI browsers
✅ Create custom domain indicators for Perplexity infrastructure
✅ Deploy in Report-only mode for pilot group

Within 30 Days:

✅ Create Access Policies with user-agent filtering
✅ Enable full blocking mode organization-wide
✅ Communicate policy to all users
✅ Establish ongoing monitoring processes

Additional Resources

Microsoft Documentation:

Security Research:

Community Resources:

Microsoft 365 Business Premium vs. Hardware Firewalls for SMBs

Small and medium businesses (SMBs) with remote employees have shifted from a single “office network” model to a Zero Trust model. Microsoft 365 Business Premium (BPP) already includes extensive security layers – identity protection, device management, email scanning, and endpoint defenselearn.microsoft.com learn.microsoft.com. With those controls fully configured, the traditional on-premises network perimeter (and thus an expensive firewall appliance) becomes far less critical. In practice, a standard router/NAT firewall combined with Windows/macOS built‑in firewalls and M365’s cloud protections can cost‑effectively secure a remote SMB. We explain how M365 BPP’s features cover typical firewall functions, and when a dedicated firewall (beyond a basic one) may not be needed.

Built-In Security in Microsoft 365 Business Premium

Microsoft 365 Business Premium bundles multiple security layers: endpoint protection, identity/access controls, device management, and more. Key built‑in features include:

Endpoint Security – Microsoft Defender for Business (included) provides next‑gen antivirus, threat detection/response and a host firewall on each devicelearn.microsoft.com learn.microsoft.com. Devices (Windows, macOS, iOS, Android) get managed protection against ransomware, malware and network attacks.
Email and App Protection – Defender for Office 365 Plan 1 (included) scans email attachments and links for malware and phishing. Safe Links/Safe Attachments help stop threats before they reach userslearn.microsoft.com.
Identity and Access (Zero Trust) – Azure AD Premium P1 (included) enables Conditional Access policies and mandatory multi-factor authenticationmicrosoft.com learn.microsoft.com. Only compliant, enrolled devices can access company resources, and admins/devices are always re‑authenticated.
Device Management – Microsoft Intune can enforce security policies on all devices: requiring device encryption (BitLocker), patching, endpoint firewalls, and even configuring VPN or Wi‑Fi profileslearn.microsoft.com learn.microsoft.com. In short, Intune ensures every device meets the company’s security baseline before it connects.
Secure Remote Access – Azure AD Application Proxy (via Azure AD P1) publishes any on‑premises app through Azure AD, so remote users can reach internal resources without opening inbound firewall portssherweb.com. This often replaces a VPN or on‑site reverse proxy, making remote access simpler and safer.

These built-in layers cover most attack vectors. For example, M365 BPP’s Defender for Business includes a managed host-based firewall and web filtering, so each laptop is protected on any networklearn.microsoft.com. And Conditional Access can block sign-ins from unsecured locations or unregistered devices, effectively extending the network perimeter to only trusted endpoints.

Zero Trust and Remote Work

In a modern SMB, employees “can work anywhere,” so the old model of trusting the office LAN no longer applies. As Microsoft describes, traditional protections rely on firewalls and VPNs at fixed locations, whereas Zero Trust assumes no network is inherently safelearn.microsoft.com. Every sign-in is verified (via Azure AD) and every device is checked (via Intune) no matter where the user is.

In this diagram, a corporate firewall on the left no longer suffices when employees roam (right side)learn.microsoft.com. With Business Premium, identity and device policies take over: multifactor authentication and Conditional Access ensure only known users on compliant devices connectlearn.microsoft.com microsoft.com. In effect, the organization’s “perimeter” is the cloud. Remote workers authenticate directly to Azure/Office 365 and receive Microsoft’s protection (e.g. encrypted tunnels, safe browser checks), rather than passing first through an on‑site firewall.

Host-Based Firewalls and Device Security

Even without a hardware firewall, devices must protect themselves on untrusted networks. All common operating systems include a built‑in firewall. Enabling these host firewalls is free and highly effective – many MSP guides advise turning on Windows Defender Firewall (and macOS’s) on every device before even buying a hardware applianceguardianangelit.com. Microsoft Defender for Business not only installs antivirus but can manage each device’s firewall settings: for instance, Intune can push a profile that blocks all inbound traffic except essential serviceslearn.microsoft.com.

By treating each endpoint as its own secured “network edge,” an SMB covers the user’s connection in coffee shops or home Wi‑Fi. For example, if a user’s laptop is on public Wi‑Fi, the Windows firewall (enforced by Defender policies) stops inbound attacks, while Defender’s web protection filters malicious sites. This layered endpoint approach (antivirus+EDR + host firewall + encrypted disk) significantly shrinks the need for a central firewall inspecting all traffic.

Network Perimeter and When to Use Firewalls

If an SMB still maintains an office or data closet, some firewall or router will normally be used for basic perimeter functions (NAT, DHCP, segmentation of guest networks, etc.). However, the level of firewall needed is typically minimal. A basic managed router or inexpensive UTM is often enough to separate IoT/guest Wi-Fi from internal staff, and to enforce outbound rules. Beyond that, heavy enterprise firewalls yield little benefit in a predominantly cloud-centric setup.

For remote-heavy SMBs, many experts suggest zero-trust access (e.g. VPN, ZTNA) instead of relying on office hardware. ControlD’s SMB security checklist, for instance, recommends ensuring VPN or Zero-Trust Network Access for remote employees, rather than expecting them to route through the office firewallcontrold.com. In other words, with cloud apps and M365-managed devices, the on‑site firewall sees only its local subnet – almost all work and threats are already handled by Microsoft’s cloud services and endpoint defenses.

Configuring M365 Business Premium as Your “Firewall”

A Business Premium tenant can be tuned to cover typical firewall functions:

Enroll and Update All Devices: Use Intune (part of BPP) to enroll every company device (Windows, Mac, mobile) and onboard them to Defender for Businesslearn.microsoft.com learn.microsoft.com. Ensure full disk encryption (BitLocker/FileVault), automatic OS updates, and Defender real‑time protection are all enabled.
Enforce Host Firewalls: Create an Intune endpoint security policy that turns on Windows Defender Firewall for all profiles (Domain/Private/Public) and disables unnecessary inbound rulesguardianangelit.com learn.microsoft.com. Similarly, enable the macOS firewall via Intune configuration. This ensures devices block unwanted network traffic by default.
Enable Multi-Factor Authentication & Conditional Access: Turn on Azure AD security defaults or define Conditional Access policies so that every login requires MFA and checks device compliancelearn.microsoft.com microsoft.com. You can restrict access by device state or location, preventing unknown devices from even reaching company apps.
Protect Email and Apps: Activate Defender for Office 365 (Plan 1) to scan all incoming email and Teams messages. Safe Links/Attachments in Office documents serve as an additional layer that no firewall can providelearn.microsoft.com.
Use Application Proxy for Internal Apps: If you have any on-premises servers, install the Azure AD Application Proxy connector. This publishes apps (e.g. intranet, CRM) through Azure without punching holes in your firewallsherweb.com. Remote users then access the app via Azure AD login, with no need to maintain a VPN or open router ports.
Monitor and Respond: Use Microsoft 365 Defender’s security portal (included) to monitor alerts. Its threat analytics will flag unusual traffic or sign-ins. Automated investigation and remediation in Defender for Business can contain a threat on a device before it spreads.
Network-Level Protections (Optional): For extra DNS- or web-filtering, an SMB might add services like Microsoft Defender SmartScreen (built into Edge/Windows) or a cloud DNS filter. These complement – but don’t replace – the firewall; they block malicious domains at the device level.

In this configuration, each device and identity becomes a control point. The M365 stack effectively sits in front of your data, rather than hardware at the network perimeter.

Cost vs. Benefit of Dedicated Firewalls

Without regulatory mandates, a high-end firewall appliance is often not cost-justified for an SMB fully on M365. The hardware itself and ongoing subscriptions (threat feeds, VPN licenses, maintenance) add significant cost. Given that M365 Business Premium already provides next-generation protection on endpoints and enforces secure access, the marginal security gain from a $2k+ firewall is small for remote-centric SMBs.

That said, a simple firewall/router is still recommended for the office LAN. It can provide:

Basic NAT/segmentation: Separating staff devices from guest or IoT VLANs.
VPN termination (if needed): A site‑to‑site VPN or point‑to‑site gateway for branch offices or legacy systems (though Azure VPN with Azure AD is an alternative).
On‑prem device connectivity: If on-premises servers exist, the firewall can regulate incoming traffic.

For example, installing Azure AD Application Proxy (no cost beyond BPP license) often removes the need to expose an on‑site port for remote accesssherweb.com. Similarly, if home users connect via secure VPN with M365 credentials, the corporate firewall is bypassed by design.

In contrast, host-based security and cloud controls cover most threats: phishing and remote intrusion are handled by Defender and MFA, malware is stopped at the device, and data exfiltration is controlled by identity and DLP settings. As one MSP guide notes, for small businesses the built-in OS firewalls should be used before investing in hardware firewallsguardianangelit.com. In practice, the total protective overlap from Intune+Defender+Conditional Access can eliminate many risks that a hardware firewall is meant to address.

Conclusion

For a typical SMB with Microsoft 365 Business Premium fully enabled, the need for an expensive dedicated firewall is greatly reduced. M365 BPP delivers comprehensive security – endpoint protection, email filters, and zero-trust access – that, when properly configured, cover most attack vectorslearn.microsoft.com learn.microsoft.com. A basic network firewall (even the one built into a router) is useful for simple segmentation, but beyond that most protections are handled by Microsoft’s cloud services and host firewalls. In short, by leveraging Business Premium’s features (Defender, Intune, Azure AD P1, etc.), an SMB can safely rely on default and cloud-managed defenses rather than purchasing a high-end firewall applianceguardianangelit.com sherweb.com.

Sources: Microsoft documentation and SMB security guides detailing Microsoft 365 Business Premium’s included protectionslearn.microsoft.com learn.microsoft.com controld.com guardianangelit.com sherweb.com, and industry best practices for SMB security in a remote-work, zero-trust modellearn.microsoft.com controld.com.

Creating a Microsoft Copilot Chat Agent for M365 Security (ASD Secure Cloud Blueprint)

Overview

ASD’s Blueprint for Secure Cloud is a comprehensive set of security guidelines published by the Australian Signals Directorate. It details how to configure cloud services (including Microsoft 365) to meet high security standards, incorporating strategies like the Essential Eight. For Microsoft 365, the Blueprint covers everything from enforcing multi-factor authentication and blocking legacy authentication, to hardening Office 365 services (Exchange, SharePoint, Teams) and securing Windows devices via Intune policies[1][2]. By creating a dedicated Copilot Chat agent based on this Blueprint, you give your organisation an easy way to access all that expertise. The agent will act as a virtual security advisor: available through Microsoft Teams (Copilot Chat) to answer questions, provide configuration guidance, and even supply automation scripts – all for free using your existing M365 subscription.

Below is a step-by-step guide to build the agent within the Copilot Chat interface, followed by examples of how it can improve your Microsoft 365 security management.

Step-by-Step: Creating the Copilot Agent in Teams Copilot Chat

You can create the agent entirely within the Microsoft 365 Copilot Chat interface (such as in Teams), using the built-in Agent Builder. There’s no need to use separate tools or write code. Here’s how to set it up quickly:

Note: The above assumes that the Copilot Agents feature is enabled in your tenant. Microsoft made Copilot Chat available to all users by 2025, but an admin might need to turn on custom agent creation if it’s in preview. Check your M365 admin settings for “Copilot” or “Agents” if you don’t see the option to create an agent. Once enabled, any user can build or use agents in Copilot Chat[3].

How the Agent Improves M365 Security

With your M365 Security Copilot agent up and running, your IT team (and potentially all employees) can leverage it in several ways to strengthen security. Here are some examples of what it can do:

1. Instant Q&A on Security Best Practices

The agent can answer questions about Microsoft 365 security configurations, drawing directly from the ASD Blueprint’s guidance and related Microsoft documentation. This is like having a security policy expert available 24/7.

Example: “What does the ASD Blueprint say about email protection?” – The agent might respond: “It recommends enabling Microsoft Defender for Office 365 features like Safe Links and Safe Attachments for all users[2]. Safe Links will check URLs in emails and documents for malicious content and redirect users if the link is unsafe. Safe Attachments will open email attachments in a sandbox to detect malware before delivering them to the recipient[2].” It would likely go on to mention anti-phishing policies as well. This guidance helps you know which settings to configure (e.g. turn on Safe Links and Safe Attachments in your Exchange Online security policies).
Example: “Do we allow legacy email protocols?” – Legacy protocols like IMAP/POP3 (which use Basic Auth) are a known security risk. The agent knows the Blueprint stance is to disable them in favour of Modern Authentication. It might answer: “No. According to ASD’s guidelines, legacy authentication protocols such as POP3 and IMAP should be disabled[4]. This prevents attackers from bypassing MFA. You should ensure only Modern Auth is allowed for Exchange Online.” The agent could even cite Microsoft’s policy that basic auth is deprecated. This reminds your team to verify those settings (or use the script the agent provides, which we’ll see below).
Example: “What are the password requirements for Windows 10 devices?” – The agent can pull from the Intune compliance policy Blueprint. It could respond: “The Blueprint’s baseline for Windows 10 requires a complex password of at least 15 characters[1]. Simple passwords are blocked, and the device must be encrypted with BitLocker[1]. It also enforces screen lock after 15 minutes of inactivity.” This gives a clear answer that aligns with your organisation’s policy (assuming you adopt the Blueprint settings).
Why this helps: It eliminates guesswork. Admins and helpdesk staff don’t have to search through lengthy documents or remember every detail. They can just ask the agent and get an authoritative answer with the reasoning included. This ensures consistent application of security best practices.

2. Guidance for Implementation and Automation

The agent doesn’t just cite policy – it can help you implement it. Through step-by-step guidance or actual code snippets, it translates the recommendations into action:

Step-by-Step Instructions: For instance, if you ask “How do I enforce MFA for all users?”, the agent will explain the methods. It might say: “To enforce MFA, you have options: (1) Enable Security Defaults in Azure AD, which require MFA for all users by default; or (2) create a Conditional Access policy that requires MFA for all sign-ins[2]. In Azure AD portal, go to Conditional Access -> New policy, assign to all users, cloud apps All, then under Access Controls, require MFA.” It will outline these steps clearly. If the Blueprint or Microsoft docs have a sequence, it will present it in order. This is like having a tutor walk you through the Azure AD configuration.
PowerShell Script Generation: Perhaps the biggest time-saver. The agent can generate scripts to configure settings across your tenant:
- If you say, “Give me a PowerShell script to disable POP and IMAP for all mailboxes,” the agent can produce something like:
  
  Connect-ExchangeOnline -Credential (Get-Credential)
  Get-Mailbox -ResultSize Unlimited | Set-CASMailbox -PopEnabled $false -ImapEnabled $false
  
  It knows from context that disabling these protocols is recommended, and the commands to do so. In fact, this script (getting all mailboxes and piping to Set-CASMailbox to turn off POP/IMAP) is a common solution[4]. The agent might add, “This script connects to Exchange Online and then disables POP and IMAP on every user’s mailbox.” With this, an admin can copy-paste and execute it in PowerShell to enforce the policy in seconds.
- Another example: “Generate a script to require MFA for all users.” The agent could output a script using Azure AD PowerShell to set MFA on each account. For instance, it might use the MSOnline module:
  
  Connect-MsolService
  $users = Get-MsolUser -All foreach ($u in $users) { Set-MsolUser -UserPrincipalName $u.UserPrincipalName -StrongAuthenticationRequirements @( New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement -Property @{ RelyingParty = "*"; State = "Enabled" } ) }
  
  And it would explain that this iterates through all users and enforces MFA. This aligns with the Blueprint’s mandate for MFA everywhere. The agent is effectively writing the code so you don’t have to. (As always, you should test such scripts in a safe environment, but it provides a solid starting point.) Not here that the MSOL module has been deprecated by Microsoft and you really should use the latest option. Always check your results from AI!
- The agent can assist with device policies too. If you ask, “How can I deploy the Windows 10 baseline settings?”, apart from describing the steps in Intune, it might mention scriptable options (like exporting the Blueprint’s Intune configuration as JSON and using Graph API or PowerShell to import it). It will guide you to the appropriate tooling.
Why this helps: It automates tedious work and ensures it’s done right. Many IT admins know what they need to do conceptually, but writing a script or clicking through dozens of settings can be error-prone. The agent provides ready-made, Blueprint-aligned solutions. This speeds up implementation of secure configurations. Your team can focus on higher-level oversight rather than nitty-gritty syntax.

3. Organisation-Wide Security Awareness

By sharing the agent with the whole organisation, you extend its benefits beyond the IT/security team (if desired):

Empowering Helpdesk and Junior Staff: Frontline IT support can use the agent to answer user questions or to verify they’re giving correct advice. For example, if a user asks “Why can’t I use my old Outlook 2010 with company email?”, a helpdesk tech could consult the agent, which might answer: “Outlook 2010 uses legacy authentication which is not allowed because it doesn’t support modern security features. We require newer Outlook versions or clients that support Modern Auth to protect your account.” This backs up the helpdesk with authoritative reasoning.
Training New Team Members: New hires in the IT department can learn your security policies by interacting with the agent. They can ask it various “why do we do X” questions and get consistent answers. It’s like an interactive policy manual. Over time, this improves everyone’s understanding of security in the company.
Consistent Messaging: The agent will always refer to the Blueprint’s guidance. This means the language and recommendations are consistent. If two different people ask about, say, OneDrive sharing settings, they’ll get the same answer from the agent. Consistency is key in security – you don’t want conflicting info. The agent ensures one voice (that of the ASD Blueprint) is answering.

4. Keeping the Agent (and Advice) Up-to-Date

As threats evolve and the ASD Blueprint (or Microsoft’s recommendations) update, you can refresh the agent easily:

Periodically check the Blueprint site for updates. If new sections or changes appear (e.g., a new recommendation to use a particular security feature), you can update the agent’s knowledge. In Copilot’s agent settings, you can re-index the website or add new URLs if needed. For example, if a new “Design Decision” is added on the blueprint site about a feature, include it.
You might also feed the agent additional sources. Suppose Microsoft releases a detailed blog on a new M365 security feature not covered by the current Blueprint. You can add that blog URL to the agent’s sources. Now the agent can incorporate that into its answers as well.
Because you can edit the agent’s instructions at any time, you can also adjust its behavior. If your organisation decides on a custom policy that slightly deviates from the Blueprint, you can instruct the agent about that. For instance, “our company chooses to disable feature X due to internal reasons – reflect that in answers.”

All of this ensures the agent remains a living tool that adapts to the latest best practices and your organisation’s needs.

Example Questions & Agent Responses

To illustrate, here are some example questions you could ask your new security Copilot agent, and the kind of answers you can expect:

Question	Agent’s Response (Summary)
“How do I enforce MFA for all users?”	“Multi-Factor Authentication is mandatory for all users. The ASD Blueprint advises enabling it tenant-wide. You can do this by turning on Azure AD Security Defaults or creating a Conditional Access policy requiring MFA for all accounts. This ensures every login uses a second factor, which makes accounts 99.9% less likely to be compromised[5].” The agent would then guide through setting up the policy (as described in step-by-step above).
“Give me a script to disable legacy email auth.”	“To block legacy authentication (like basic auth for POP/IMAP) on Exchange Online, run the following PowerShell commands: `Connect-ExchangeOnline -Credential (Get-Credential)` `Get-Mailbox -ResultSize Unlimited \| Set-CASMailbox -PopEnabled $false -ImapEnabled $false` This disables POP and IMAP for all mailboxes[4], forcing the use of Modern Authentication (which supports MFA).”
“What are the device security requirements?”	“For Windows 10/11 devices, the Blueprint baseline requires: BitLocker disk encryption enabled, a password of at least 15 characters with complexity, screen lock after 15 minutes, and up-to-date antivirus/antispyware protection[1]. Jailbroken or rooted mobile devices are not compliant. These ensure devices meet a strong security standard.”
“How can we protect email from phishing?”	“Use Microsoft Defender for Office 365. The Blueprint recommends Safe Links and Safe Attachments for all users[2]. Safe Links will scan and rewrite URLs in incoming emails to shield users from malicious sites. Safe Attachments will open email attachments in a virtual machine to detect malware. Enable these in your Office 365 security center under Threat Management > Policy.” The agent might also mention anti-phishing policies and user training reminders.
“Why do we insist on MFA for login?”	“Because it dramatically improves security. As Microsoft reports, an account is over 99.9% less likely to be hacked if MFA is enabled[5]. The ASD Blueprint therefore mandates MFA for all users. Even if a password is stolen, the attacker cannot get in without the second factor.” This kind of answer provides the rationale you can pass on to users or execs who ask the same question.

These examples show how the agent can be used in practice. It provides precise, actionable answers with evidence (often even citing the official guidance). By interacting with the agent, your IT staff can save time and ensure they’re following the correct procedures, and your end-users get consistent answers on why security measures are in place.

In summary, a dedicated Copilot Chat agent based on the ASD Secure Cloud Blueprint can greatly streamline your Microsoft 365 security operations. It’s free to set up (since Copilot Chat agents are available to all M365 users[3]), quick to distribute via Teams, and immediately useful for both answering questions and executing security tasks. Your organisation gets the benefit of an always-available expert that reflects approved best practices, helping you raise the security baseline across the board.

References

[1] Windows 10/11 Compliance Policy | ASD’s Blueprint for Secure Cloud

[2] Microsoft Defender for Office 365 | ASD’s Blueprint for Secure Cloud

[3] Safe Attachments | ASD’s Blueprint for Secure Cloud

[4] BRK3083 – Secure Office 365 like a cybersecurity pro—assessing risk and implementing controls

[5] Microsoft: Using multi-factor authentication blocks 99.9% of … – ZDNET

Impact of AI on SMB MSP Help Desks and the Role of Microsoft 365 Copilot

Introduction and Background

Managed Service Providers (MSPs) serving small-to-medium businesses (SMBs) typically operate help desks that handle IT support requests, from password resets to system troubleshooting. Traditionally, these support desks rely on human technicians available only during business hours, which can mean delays and higher costs. Today, artificial intelligence (AI) is revolutionising this model by introducing intelligent automation and chat-based agents that can work tirelessly around the clock[1][1]. AI-driven service desks leverage machine learning and natural language processing to handle routine tasks (like password resets or basic user queries) with minimal human intervention[1]. This transformation is happening rapidly: as of mid-2020s, an estimated 72% of organisations are regularly utilising AI technologies in their operations[2]. The surge of generative AI (exemplified by OpenAI’s ChatGPT and Microsoft’s Copilot) has shown how AI can converse with users, analyse large data context, and generate content, making it extremely relevant to customer support scenarios.

Microsoft 365 Copilot is one high-profile example of this AI wave. Introduced in early 2023 as an AI assistant across Microsoft’s productivity apps[3], Copilot combines large language models with an organisation’s own data through Microsoft Graph. For MSPs, tools like Copilot represent an opportunity to augment their help desk teams with AI capabilities within the familiar Microsoft 365 environment, ensuring data remains secure and context-specific[4]. In the following sections, we examine the positive and negative impacts of AI on SMB-focused MSP help desks, explore how MSPs can utilise Microsoft 365 Copilot to enhance service delivery, and project the long-term changes AI may bring to MSP support operations.

Positive Impacts of AI on MSP Help Desks

AI is bringing a multitude of benefits to help desk operations for MSPs, especially those serving SMB clients. Below are some of the most significant advantages, with examples:

24/7 Availability and Faster Response: AI-powered virtual agents (chatbots or voice assistants) can handle inquiries at any time, providing immediate responses even outside normal working hours. This round-the-clock coverage ensures no customer request has to wait until the next business day, significantly reducing response times[1]. For example, an AI service desk chatbot can instantly address a password reset request at midnight, whereas a human technician might not see it until morning. The result is improved customer satisfaction due to swift, always-on support[1][1].
Automation of Routine Tasks: AI excels at handling repetitive, well-defined tasks, which frees up human technicians for more complex issues. Tasks like password resets, account unlocks, software installations, and ticket categorisation can be largely automated. An AI service desk can use chatbots with natural language understanding to guide users through common troubleshooting steps and resolve simple requests without human intervention[1][1]. One industry report notes that AI-driven chatbots are now capable of resolving many Level-1 support issues (e.g. password resets or printer glitches) on their own[5]. This automation not only reduces the workload on human staff but also lowers operational costs (since fewer manual labour hours are spent on low-value tasks)[1].
Improved Efficiency and Cost Reduction: By automating the mundane tasks and expediting issue resolution, AI can dramatically increase the efficiency of help desk operations. Routine incidents get resolved faster, and more tickets can be handled concurrently. This efficiency translates to cost savings – MSPs can support more customers without a linear increase in headcount. A 2025 analysis of IT service management tools indicates that incorporating AI (for example, using machine learning to categorise tickets or recommend solutions) can save hundreds of man-hours each month for an MSP’s service team[6][6]. These savings come from faster ticket handling and fewer repetitive manual interventions. In fact, AI’s contribution to productivity is so significant that an Accenture study projected AI technologies could boost profitability in the IT sector by up to 38% by 2035[6], reflecting efficiency gains.
Scalability of Support Operations: AI allows MSP help desks to scale up support capacity quickly without a proportional increase in staff. Because AI agents can handle multiple queries simultaneously and don’t tire, MSPs can on-board new clients or handle surge periods (such as a major incident affecting many users at once) more easily[1]. For instance, if dozens of customers report an email outage at the same time, an AI system could handle all incoming queries in parallel – something a limited human team would struggle with. This scalability ensures service quality remains high even as the customer base grows or during peak demand.
Consistency and Knowledge Retention: AI tools provide consistent answers based on the knowledge they’ve been trained on. They don’t forget procedures or skip troubleshooting steps, which means more uniform service quality. If an AI is integrated with a knowledge base, it will tap the same repository of solutions every time, leading to standardized resolutions. Moreover, modern AI agents can maintain context across a conversation and even across sessions. By 2025, advanced AI service desk agents were capable of keeping track of past interactions with a client, so the customer doesn’t have to repeat information if they come back with a related issue[7]. This contextual continuity makes support interactions smoother and more personalized, even when handled by AI.
Proactive Issue Resolution: AI’s predictive analytics capabilities enable proactive support rather than just reactive. Machine learning models can analyze patterns in system logs and past tickets to predict incidents before they occur. For example, AI can flag that a server’s behavior is trending towards failure or that a certain user’s laptop hard drive shows signs of impending crash, prompting preemptive maintenance. MSPs are leveraging AI to perform predictive health checks – e.g. automatically identifying anomaly patterns that precede network outages or using predictive models to schedule patches at optimal times before any disruption[6][7]. This results in fewer incidents for the help desk to deal with and reduced downtime for customers. AI can also intelligently prioritize tickets that are at risk of violating SLA (service level agreement) times by learning from historical data[6], ensuring critical issues get speedy attention.
Enhanced Customer Experience and Personalisation: Counterintuitively, AI can help deliver a more personalized support experience for clients. By analysing customer data and past interactions, AI systems can tailor responses or suggest solutions that are particularly relevant to that client’s history and environment[7]. For example, an AI might recognize that a certain client frequently has issues with their email system and proactively suggest steps or upgrades to preempt those issues. AI chatbots can also dynamically adjust their language tone and complexity to match the user’s skill level or emotional state. Some advanced service desk AI can detect sentiment – if a user sounds frustrated, the system can route the conversation to a human or respond in a more empathetic tone automatically[1][1]. Multilingual support is another boon: AI agents can fluently support multiple languages, enabling an MSP to serve diverse or global customers without needing native speakers of every language on staff[7]. All these features drive up customer satisfaction, as clients feel their needs are anticipated and understood. Surveys have shown faster service and 24/7 availability via AI lead to higher customer happiness ratings on support interactions[1].
Allowing Human Focus on Complex Tasks: Perhaps the most important benefit is that by offloading simple queries to AI, human support engineers have more bandwidth for complex problem-solving and value-added work. Rather than spending all day on password resets and setting up new accounts, the human team members can focus on high-priority incidents, strategic planning for clients, or learning new technologies. MSP technicians can devote attention to issues that truly require human creativity and expertise (like diagnosing novel problems or providing consulting advice to improve a client’s infrastructure) while the AI handles the “busy work.” This not only improves morale and utilisation of skilled engineers, but it also delivers better outcomes for customers when serious issues arise, because the team isn’t bogged down with minor tasks. As one service desk expert put it, with **AI handling Level-1 tickets, MSPs can redeploy their technicians to activities that more directly **“impact the business”, such as planning IT strategy or digital transformation initiatives for clients[6]. In other words, AI raises the ceiling of what the support team can achieve.

In summary, AI empowers SMB-focused MSPs to provide faster, more efficient, and more consistent support services to their customers. It reduces wait times, solves many problems instantly, and lets the human team shine where they are needed most. Many MSPs report that incorporating AI service desk tools has led to higher customer satisfaction and improved service quality due to these factors[1].

Challenges and Risks of AI in Help Desk Operations

Despite the clear advantages, the integration of AI into help desk operations is not without challenges. It’s important to acknowledge the potential drawbacks, risks, and limitations that come with relying on AI for customer support:

Lack of Empathy and Human Touch: One of the most cited limitations of AI-based support is the absence of genuine empathy. AI lacks emotional intelligence – it cannot truly understand or share human feelings. While AI can be programmed to recognise certain keywords or even tone of voice indicating frustration, its responses may still feel canned or unempathetic. Customers dealing with stressful IT outages or complex problems often value a human who can listen and show understanding. An AI, no matter how advanced, may respond to an angry or anxious customer with overly formal or generic language, missing the mark in addressing the customer’s emotional state[7]. Over-reliance on AI chatbots can lead to customers feeling that the service is impersonal. For example, if a client is upset about recurring issues, an AI might continue to give factual solutions without acknowledging the client’s frustration, potentially aggravating the situation[7][7]. **In short, AI’s inability to *“read between the lines”* or pick up subtle cues can result in a poor customer experience in sensitive scenarios**[7].
Handling of Complex or Novel Issues: AI systems are typically trained on existing data and known problem scenarios. They can struggle when faced with a completely new, unfamiliar problem, or one that requires creative thinking and multidisciplinary knowledge. A human technician might be able to use intuition or past analogies to tackle an odd issue, whereas an AI could be stumped if the problem doesn’t match its training data. Additionally, many complex support issues involve nuanced judgement calls – understanding business impact, making decisions with incomplete information, or balancing multiple factors. AI’s problem-solving is limited to patterns it has seen; it might give incorrect answers (or no answer) if confronted with ambiguity or a need for outside-the-box troubleshooting. This is related to the phenomenon of AI “hallucinations” in generative models, where an AI might produce a confident-sounding but completely incorrect solution if it doesn’t actually know the answer. Without human oversight, such errors could mislead customers. Thus, MSPs must be cautious: AI is a great first-line tool, but complex cases still demand human expertise and critical thinking[1].
Impersonal Interaction & Client Relationship Concerns: While AI can simulate conversation, many clients can tell when they’re dealing with a bot versus a human. For longer-term client relationships (which are crucial in the MSP industry), solely interacting through AI might not build the personal rapport that comes from human interaction. Clients often appreciate knowing there’s a real person who understands their business on the other end. If an MSP over-automates the help desk, some clients might feel alienated or think the MSP is “just treating them like a ticket number.” As noted earlier, AI responses can be correct but impersonal, lacking the warmth or context a human would provide[7]. Over time, this could impact customer loyalty. MSPs thus need to strike a balance – using AI for efficiency while maintaining human touchpoints to nurture client relationships[7].
Potential for Errors and Misinformation: AI systems are not infallible. They might misunderstand a user’s question (especially if phrased unconventionally), or access outdated/incomplete data, leading to wrong answers. If an AI-driven support agent gives an incorrect troubleshooting step, it could potentially make a problem worse (imagine an AI telling a user to run a wrong command that causes data loss). Without a human double-check, these errors could slip through. Moreover, advanced generative AI might sometimes fabricate plausible-sounding answers (hallucinations) that are entirely wrong. Ensuring the AI is thoroughly tested and paired with validation steps (or easy escalation to humans) is critical. Essentially, relying solely on AI without human oversight introduces a risk of incorrect solutions, which could harm customer trust or even violate compliance if the AI gives advice that doesn’t meet regulatory standards.
Data Security and Privacy Risks: AI helpdesk implementations often require feeding customer data, system logs, and issue details into AI models. If not managed carefully, this raises privacy and security concerns. For example, sending sensitive information to an external AI service (like a cloud-based chatbot) could inadvertently expose that data. There have been cautionary tales – such as incidents where employees used public AI tools (e.g., ChatGPT) with confidential data and caused breaches of privacy[4][4]. MSPs must ensure that any AI they use is compliant with data protection regulations and that clients’ data is handled safely (encrypted in transit and at rest, access-controlled, and not retained or used for AI training without consent)[8][8]. Another aspect is ensuring the AI only has access to information it should. In Microsoft 365 Copilot’s case, it respects the organisation’s permission structure[4], but if an MSP used a more generic AI, they must guard against information bleed between clients. AI systems also need constant monitoring for unusual activities or potential vulnerabilities, as malicious actors might attempt to manipulate AI or exploit it to gain information[8][8]. In summary, introducing AI means MSPs have to double-down on cybersecurity and privacy audits around their support tools.
Integration and Technical Compatibility Issues: Deploying AI into an existing MSP environment is not simply “plug-and-play.” Many MSPs manage a heterogeneous mix of client systems, some legacy and some modern. AI tools may struggle to integrate with older software or disparate platforms[7]. For instance, an AI that works great with cloud-based ticket data may not access information from a client’s on-premises legacy database without custom integration. Data might exist in silos (separate systems for ticketing, monitoring, knowledge base, etc.), and connecting all these for the AI to have a full picture can be challenging[7]. MSPs might need to invest significant effort to unify data sources or update infrastructure to be AI-ready. During integration, there could be temporary disruptions or a need to reconfigure workflows, which in the short term can hamper productivity or confuse support staff[7][7]. For smaller MSPs, lacking in-house AI/ML expertise, integrating and maintaining an AI solution can be a notable hurdle, potentially requiring new hires or partnerships.
Over-reliance and Skill Erosion: There is a softer risk as well: if an organisation leans too heavily on AI, their human team might lose opportunities to practice and sharpen their own skills on simpler issues. New support technicians often “learn the ropes” by handling common Level-1 problems and gradually taking on more complex ones. If AI takes all the easy tickets, junior staff might not develop a breadth of experience, which could slow their growth. Additionally, there’s the strategic risk of over-relying on AI for decision-making. AI can provide data-driven recommendations, but it doesn’t understand business strategy or ethics at a high level[7][7]. MSP managers must be careful not to substitute AI outputs for their own judgement, especially in decisions about how to service clients or allocate resources. Important decisions still require human insight – AI might suggest a purely cost-efficient solution, but a human leader will consider client relationships, long-term implications, and ethical aspects that AI would miss[7][7].
Customer Pushback and Change Management: Finally, some end-users simply prefer human interaction. If an MSP suddenly routes all calls to a bot, some customers might react negatively, perceiving it as a downgrade in service quality. There can be a transition period where customers need to be educated on how to use the new AI chatbot or voice menu. Ensuring a smooth handoff to a human agent on request is vital to avoid frustration. MSPs have to manage this change carefully, communicating the benefits of the new system (such as faster answers) while assuring clients that humans are still in the loop and reachable when needed.

In essence, while AI brings remarkable capabilities to help desks, it is not a panacea. The human element remains crucial: to provide empathy, handle exceptions, verify AI outputs, and maintain strategic oversight[7][7]. Many experts stress that the optimal model is a hybrid approach – AI and humans working together, where AI handles the heavy lifting but humans guide the overall service and step in for the nuanced parts[7][7]. MSPs venturing into AI-powered support must invest in training their staff to work alongside AI, update processes for quality control, and maintain open channels for customers to reach real people when necessary. Striking the right balance will mitigate the risks and ensure AI augments rather than alienates.

To summarise the trade-offs, the table below contrasts AI service desks with traditional human support on key factors:

Aspect	AI Service Desk	Human Helpdesk Agent
Response Time	Instant responses to queries[1]	Varies based on availability (can be minutes to hours)[1]
Availability	24/7 continuous operation[1]	Limited to business/support hours[1]
Consistency/Accuracy	High on well-known issues (follows predefined solutions exactly)[1]	Strong on complex troubleshooting; can adapt when a known solution fails[1]
Personalisation & Empathy	Limited emotional understanding; responses feel robotic if issue is nuanced[1]	Natural empathy and personal touch; can adjust tone and approach to the individual[1]
Scalability	Easily handles many simultaneous requests (no queue for simple issues)[1]	Scalability limited by team size; multiple requests can strain capacity
Cost	Lower marginal cost per ticket (after implementation)[1]	Higher ongoing cost (salaries, training for staff)[1]

Table: AI vs Human Support – Both have strengths; best results often come from combining them.

Using Microsoft 365 Copilot in an SMB MSP Environment

Microsoft 365 Copilot is a cutting-edge AI assistant that MSPs can leverage internally to enhance help desk and support operations. Copilot integrates with tools like Teams, Outlook, Word, PowerPoint, and more – common applications that MSP staff use daily – and supercharges them with AI capabilities. Here are several ways an SMB-focused MSP can use M365 Copilot to take advantage of AI and provide better customer service:

Real-time assistance during support calls (Teams Copilot): Copilot in Microsoft Teams can act as a real-time aide for support engineers. For example, during a live call or chat with a customer, a support agent can ask Copilot in Teams contextual questions to get information or troubleshooting steps without leaving the conversation. One MSP Head-of-Support shared that “Copilot in Teams can answer specific questions about a call with a user… providing relevant information and suggestions during or after the call”, saving the team time they’d otherwise spend searching manuals or past tickets[9]. The agent can even ask Copilot to summarize what was discussed in a meeting or call, and it will pull the key details for reference. This means the technician stays focused on the customer instead of frantically flipping through knowledge base articles. The information Copilot provides can be directly added to ticket notes, making documentation faster and more accurate[9]. Ultimately, this leads to quicker resolutions and more thorough records of what was done to fix an issue.
Faster documentation and knowledge base creation (Word Copilot): Documentation is a big part of MSP support – writing up how-to guides, knowledge base articles, and incident reports. Copilot in Word helps by drafting and editing documentation alongside the engineer. Support staff can simply prompt Copilot, e.g., “Draft a knowledge base article on how to connect to the new VPN,” and Copilot will generate a first draft by pulling relevant info from existing SharePoint files or previous emails[3][3]. In one use case, an MSP team uses Copilot to create and update technical docs like user guides and policy documents; it “helps us write faster, better, and more consistently, by suggesting improvements and corrections”[9]. Copilot ensures the writing is clear and grammatically sound, and it can even check for company-specific terminology consistency. It also speeds up reviews by highlighting errors or inconsistencies and proposing fixes[9]. The result is up-to-date documentation produced in a fraction of the time it used to take, which means customers and junior staff have access to current, high-quality guidance sooner.
Streamlining employee training and support tutorials (PowerPoint Copilot): Training new support staff or educating end-users often involves creating presentations or guides. Copilot in PowerPoint can transform written instructions or outlines into slide decks complete with suggested images and formatting. An MSP support team described using Copilot in PowerPoint to auto-generate training slides for common troubleshooting procedures[9]. They would input the steps or a rough outline of resolving a certain issue, and Copilot would produce a coherent slide deck with graphics, which they could then fine-tune. Copilot even fetches appropriate stock images based on content to make slides more engaging[9], eliminating the need to manually search for visuals. This capability lets the MSP rapidly produce professional training materials or client-facing “how-to” guides. For example, after deploying a new software for a client, the MSP could quickly whip up an end-user training presentation with Copilot’s help, ensuring the client’s staff can get up to speed faster.
Accelerating research and problem-solving (Edge Copilot): Often, support engineers need to research unfamiliar problems or learn about a new technology. Copilot in Microsoft Edge (the browser) can serve as a research assistant by providing contextual web answers and learning resources. Instead of doing a generic web search and sifting through results, a tech can ask Copilot in Edge something like, “How do I resolve error code X in Windows 11?” and get a distilled answer or relevant documentation links right away[9]. Copilot in Edge was noted to “provide the most relevant and reliable information from trusted sources…almost replacing Google search” for one MSP’s technical team[9]. It can also suggest useful tutorials or forums to visit for deeper learning. This reduces the time spent hunting for solutions online and helps the support team solve issues faster. It’s especially useful for SMB MSPs who cover a broad range of technologies with lean teams – Copilot extends their knowledge by quickly tapping into the vast information on the web.
Enhancing customer communications (Outlook Copilot & Teams Chat): Communications with customers – whether updates on an issue, reports, or even drafting an outage notification – can be improved with Copilot. In Outlook, Copilot can summarize long email threads and draft responses. Imagine an MSP engineer inherits a complex email chain about a persistent problem; Copilot can summarize what has been discussed, highlight the different viewpoints or concerns from each person, and even point out unanswered questions[3]. This allows the engineer to grasp the situation quickly without reading every email in detail. Then, the engineer can ask Copilot to draft a reply email that addresses those points – for instance, “write a response thanking the client for their patience and summarizing the next steps we will take to fix the issue.” Copilot will generate a polished, professional email in seconds, which the engineer can review and send[3]. This is a huge time-saver and ensures communication is clear and well-formulated. In Microsoft Teams chats, Business Chat (Copilot Chat) can pull together data from multiple sources to answer a question or produce an update. An MSP manager could ask, “Copilot, generate a brief status update for Client X’s network outage yesterday,” and it could gather info from the technician’s notes, the outage Teams thread, and the incident ticket to produce a cohesive update message for the client. By using Copilot for these tasks, MSPs can respond to clients more quickly and with well-structured communications, improving professionalism and client confidence in the support they receive[3][3].
Knowledge integration and context: Because Microsoft 365 Copilot works within the MSP’s tenant and on top of its data (documents, emails, calendars, tickets, etc.), it can connect dots that might be missed otherwise. For example, if a customer asks, “Have we dealt with this printer issue before?”, an engineer could query Business Chat, which might pull evidence from a past meeting note, a SharePoint document with troubleshooting steps, and a previous ticket log, all summarized in one answer[3][3]. This kind of integrated insight is incredibly valuable for institutional knowledge – the MSP effectively gains an AI that knows all the past projects and can surface the right info on demand. It means faster resolution and demonstrating to customers that “institutional memory” (even as staff come and go) is retained.

Overall, Microsoft 365 Copilot acts as a force-multiplier for MSP support teams. It doesn’t replace the engineers, but rather augments their abilities – handling the grunt work of drafting, searching, and summarising so that the human experts can focus on decision-making and problem-solving. By using Copilot internally, an MSP can deliver answers and solutions to customers more quickly, with communications that are well-crafted and documentation that is up-to-date. It also helps train and onboard new team members, as Copilot can quickly bring them up to speed on procedures and past knowledge.

From the customer’s perspective, the use of Copilot by their MSP translates to better service: faster turnaround on tickets, more thorough documentation provided for solutions, and generally a more proactive support approach. For example, customers might start receiving helpful self-service guides or troubleshooting steps that the MSP created in half the time using Copilot – so issues get resolved with fewer back-and-forth interactions.

It’s important to note that Copilot operates within the Microsoft 365 security and compliance framework, meaning data stays within the tenant’s boundaries. This addresses some of the privacy concerns of using AI in support. Unlike generic AI tools, Copilot will only show content that the MSP and its users have permission to access[4]. This feature is crucial when dealing with multiple client data sets and sensitive information; it ensures that leveraging AI does not inadvertently leak information between contexts.

In conclusion, adopting Microsoft 365 Copilot allows an SMB MSP to ride the AI wave in a controlled, enterprise-friendly manner. It directly boosts the productivity of the support team and helps standardise best practices across the organisation. As AI becomes a bigger part of daily work, tools like Copilot give MSPs a head start in using these capabilities to benefit their customers, without having to build an AI from scratch.

Long-Term Outlook: The Future of MSP Support in the AI Era

Looking ahead, the influence of AI on MSP-provided support is only expected to grow. Industry observers predict significant changes in how MSPs operate over the next 5–10 years as AI technologies mature. Here are some key projections for the longer-term impact of AI on MSPs and their help desks:

Commoditisation of Basic Services: Over the long term, many basic IT support services are likely to become commoditised or bundled into software. For instance, routine monitoring, patch management, and straightforward troubleshooting might be almost entirely automated by AI systems. Microsoft and other vendors are increasingly building AI “co-pilots” directly into their products (as indicated by features rolling out in tools by 2025), allowing end-users to self-serve solutions that once required an MSP’s intervention[5][5]. As a result, MSPs may find that the traditional revenue from things like alert monitoring or simple ticket resolution diminishes. In fact, experts predict that by 2030, about a quarter of the current low-complexity ticket volume will vanish – either resolved automatically by AI or handled by intuitive user-facing AI assistants[5]. This means MSPs must prepare for possible pressure on the classic “all-you-can-eat” support contracts, as clients question paying for tasks that AI can do cheaply[5]. We may see pricing models shift from per-seat or per-ticket to outcome-based agreements where the focus is on uptime and results (with AI silently doing much of the work in the background)[5].
New High-Value Services and Roles: On the flip side, AI will open entirely new service opportunities for MSPs who adapt. Just as some revenue streams shrink, others will grow or emerge. Key areas poised for expansion include:
- AI Oversight and Management: Businesses will need help deploying, tuning, and governing AI systems. MSPs can provide services like training AI on custom data, monitoring AI performance, and ensuring compliance (preventing biased outcomes or data leakage). One new role mentioned is managing “prompt engineering” and data quality to avoid AI errors like hallucinations[5]. MSPs could bundle services to regularly check AI outputs, update the knowledge base the AI draws from, and keep the AI models secure and up-to-date.
- AI-Enhanced Security Services: The cybersecurity landscape is escalating as both attackers and defenders leverage AI. MSPs can develop AI-driven security operation center (SOC) services, using advanced AI to detect anomalies and respond to threats faster than any human could[5]. Conversely, they must counter AI-empowered cyber attacks. This arms race creates demand for MSP-led managed security services (like “MDR 2.0” – Managed Detection & Response with AI) that incorporate AI tools to protect clients[5]. Many MSPs are already exploring such offerings as a higher-margin, value-add service.
- Strategic AI Consulting: As AI pervades business processes, clients (especially SMBs) will turn to their MSPs for guidance on how to integrate AI into their operations. MSPs can evolve into consultants for AI adoption, advising on the right AI tools, data strategies, and process changes for each client. They might conduct AI readiness assessments and help implement AI in areas beyond IT support – such as in analytics or workflow automation – effectively becoming a “virtual CIO for AI” for small businesses[5][5].
- Data Engineering and Integration: With AI’s hunger for data, MSPs might offer services to clean, organise, and integrate client data so that AI systems perform well. For instance, consolidating a client’s disparate databases and migrating data to cloud platforms where AI can access it. This ensures the client’s AI (or Copilot-like systems) have high-quality data to work with, improving outcomes[2]. It’s a natural extension of the MSP’s role in managing infrastructure and could become a significant service line (data pipelines, data lakes, etc., managed for SMBs).
- Industry-specific AI Solutions: MSPs might develop expertise in specific verticals (e.g., healthcare, legal, manufacturing) and provide custom AI solutions tuned to those domains[5]. For example, an MSP could offer an AI toolset for medical offices that assists with compliance (HIPAA) and automates patient IT support with knowledge of healthcare workflows. These niche AI services could command premium prices and differentiate MSPs in the market.
Evolution of MSP Workforce Skills: The skill profile of MSP staff will evolve. The level-1 help desk role may largely transform into an AI-supported custodian role, where instead of manually doing the work, the technician monitors AI outputs and handles exceptions. There will be greater demand for skills in AI and data analytics. We’ll see MSPs investing in training their people on AI administration, scripting/automation, and interpreting AI-driven insights. Some positions might shift from pure technical troubleshooting to roles like “Automation Specialist” or “AI Systems Analyst.” At the same time, soft skills (like client relationship management) become even more important for humans since they’ll often be stepping in primarily for the complex or sensitive interactions. MSPs that encourage their staff to upskill in AI will stay ahead. As one playbook suggests, MSPs should “upskill NOC engineers in Python, MLOps, and prompt-engineering” to thrive in the coming years[5].
Business Model and Competitive Landscape Changes: AI may lower the barrier for some IT services, meaning MSPs face new competition (for example, a product vendor might bundle AI support directly, or a client might rely on a generic AI service instead of calling the MSP for minor issues). To stay competitive, MSPs will likely transition from being pure “IT fixers” to become more like a partner in continuous improvement for clients’ technology. Contracts might include AI as part of the service – for example, MSPs offering a proprietary AI helpdesk portal to clients as a selling point. The overall managed services market might actually expand as even very small businesses can afford AI-augmented support (increasing the TAM – total addressable market)[5]. Rather than needing a large IT team, a five-person company could engage an MSP that uses AI to give them enterprise-grade support experience. So there’s a scenario where AI helps MSPs scale down-market to micro businesses and also up-market by handling more endpoints per engineer than before. Analysts foresee that MSPs could morph into “Managed Digital Enablement Providers”, focusing not just on keeping the lights on, but on actively enabling new tech capabilities (like AI) for clients[5]. The MSPs who embrace this and market themselves as such will stand out.
MSPs remain indispensable (if they adapt): A looming question is whether AI will eventually make MSPs obsolete, as some pessimists suggest. However, the consensus in the industry is that MSPs will continue to play a critical role, but it will be a changed role. AI is a tool – a powerful one – but it still requires configuration, oversight, and alignment with business goals. MSPs are perfectly positioned to fill that need for their clients. The human element – strategic planning, empathy, complex integration, and handling novel challenges – will keep MSPs relevant. In fact, AI could make MSPs more valuable by enabling them to deliver higher-level outcomes. Those MSPs that fail to incorporate AI may find themselves undercut on price and losing clients to more efficient competitors, akin to “the taxi fleet in the age of Uber” – still around but losing ground[5]. On the other hand, those that invest in AI capabilities can differentiate and potentially command higher margins (e.g., an MSP known for its advanced AI-based services can justify premium pricing and will be attractive to investors as well)[5]. Already, by 2025, MSP industry experts note that buyers looking to acquire or partner with MSPs ask about their AI adoption plan – no strategy often leads to a devaluation, whereas a clear AI roadmap is seen as a sign of an innovative, future-proof MSP[5][5].

In summary, the long-term impact of AI on MSP support is a shift in the MSP value proposition rather than a demise. Routine support chores will increasingly be handled by AI, which is “the new normal” of service delivery. Simultaneously, MSPs will gravitate towards roles of AI enablers, advisors, and security guardians for their clients. By embracing this evolution, MSPs can actually improve their service quality and deepen client relationships – using AI not as a competitor, but as a powerful ally. The MSP of the future might spend less time resetting passwords and more time advising a client’s executive team on technology strategy with AI-generated insights. Those who adapt early will likely lead the market, while those slow to change may struggle.

Ultimately, AI is a force-multiplier, not a wholesale replacement for managed services[5]. The most successful MSPs will be the ones that figure out how to blend AI with human expertise, providing a seamless, efficient service that still feels personal and trustworthy. As we move toward 2030 and beyond, an MSP’s ability to harness AI – for their own operations and for their clients’ benefit – will be a key determinant of their success in the industry.

References

[1] AI Service Desk: Advantages, Risks and Creative Usages

[2] How MSPs Can Help Organizations Adopt M365 Copilot & AI

[3] Introducing Copilot for Microsoft 365 | Microsoft 365 Blog

[4] The Practical MSP Guide to Microsoft 365 Copilot

[5] AI & Agentic AI in Managed Services: Threat or Catalyst?

[6] How AI help MSPs increase their bottom line in 2025 – ManageEngine

[7] What AI Gets Right (and Wrong) About Running an MSP in 2025 and Beyond

[8] Exploring the Risks of Generative AI in IT Helpdesks: Mitigating Risks

[9] How Copilot for Microsoft 365 Enhances Service Desk Efficiency: Alex’s …

Building a Collaborative Microsoft 365 Copilot Agent: A Step-by-Step Guide

Creating a Microsoft 365 Copilot agent (a custom AI assistant within Microsoft 365 Copilot) can dramatically streamline workflows. These agents are essentially customised versions of Copilot that combine specific instructions, knowledge, and skills to perform defined tasks or scenarios[1]. The goal here is to build an agent that multiple team members can collaboratively develop and easily maintain – even if the original creator leaves the business. This report provides:

Step-by-step guidelines to create a Copilot agent (using no-code/low-code tools).
Best practices for multi-user collaboration, including managing edit permissions.
Documentation and version control strategies for long-term maintainability.
Additional tips to ensure the agent remains robust and easy to update.

Step-by-Step Guide: Creating a Microsoft 365 Copilot Agent

To build your Copilot agent without code, you will use Microsoft 365 Copilot Studio’s Agent Builder. This tool provides a guided interface to define the agent’s behavior, knowledge, and appearance. Follow these steps to create your agent:

As a result of the steps above, you have a working Copilot agent with its name, description, instructions, and any connected data sources or capabilities configured. You built this agent in plain language and refined it with no code required, thanks to Copilot Studio’s declarative authoring interface[2].

Before rolling it out broadly, double-check the agent’s responses for accuracy and tone, especially if it’s using internal knowledge. Also verify that the knowledge sources cover the expected questions. (If the agent couldn’t answer a question in testing, you might need to add a missing document or adjust instructions.)

Note: Microsoft also provides pre-built templates in Copilot Studio that you can use as a starting point (for example, templates for an IT help desk bot, a sales assistant, etc.)[2]. Using a template can jump-start your project with common instructions and sample prompts already filled in, which you can then modify to suit your needs.

Collaborative Development and Access Management

One key to long-term maintainability is ensuring multiple people can access and work on the agent. You don’t want the agent tied solely to its creator. Microsoft 365 Copilot supports this through agent sharing and permission controls. Here’s how to enable collaboration and manage who can use or edit the agent:

Share the Agent for Co-Authoring: After creating the agent, the original author can invite colleagues as co-authors (editors). In Copilot Studio, use the Share menu on the agent and add specific users by name or email for “collaborative authoring” access[3]. (You can only add individuals for edit access, not groups, and those users must be within your organisation.) Once shared, these teammates are granted the necessary roles (Environment Maker/Bot Contributor in the underlying Power Platform environment) automatically so they can modify the agent[3]. Within a few minutes, the agent will appear in their Copilot Studio interface as well. Now your agent effectively has multiple owners — if one person leaves, others still have full editing rights.
Ensure Proper Permissions: When sharing for co-authoring, make sure the colleagues have appropriate permissions in the environment. Copilot Studio will handle most of this via the roles mentioned, but it’s good for an admin to know who has edit access. By design, editors can do everything the owner can: edit content, configure settings, and share the agent further. Viewers (users who are granted use but not edit rights) cannot make changes[4]. Use Editor roles for co-authors and Viewer roles for end users as needed to control access[4]. For example, you may grant your whole team viewer access to use the agent, but only a smaller group of power users get editor access to change it. (The platform currently only allows assigning Editor permission to individuals, not to a security group, for safety[4].)
Collaborative Editing in Real-Time: Once multiple people have edit access, Copilot Studio supports concurrent editing of the agent’s topics (the conversational flows or content nodes). The interface will show an “Editing” indicator with the co-authors’ avatars next to any topic being worked on[3]. This helps avoid stepping on each other’s toes. If two people do happen to edit the same piece at once, Copilot Studio prevents accidental overwrites by detecting the conflict and offering choices: you can discard your changes or save a copy of the topic[3]. For instance, if you and a colleague unknowingly both edited the FAQ topic, and they saved first, when you go to save, the system might tell you a newer version exists. You could then choose to keep your version as a separate copy, review differences, and merge as appropriate. This built-in change management ensures that multi-author collaboration is safe and manageable.
Sharing the Agent for Use: In addition to co-authors, you likely want to share the finished agent with other employees so they can use it in Copilot. You can share the agent via a link or through your tenant’s app catalog. In Copilot Studio’s share settings, choose who can chat with (use) the agent. Options include “Anyone in your organization” or specific security groups[5]. For example, you might initially share it with just the IT department group for a pilot, or with everyone if it’s broadly useful. When a user adds the shared agent, it will show up in their Microsoft 365 Copilot interface for them to interact with. Note that sharing for use does not grant edit rights – it only allows using the agent[5]. Keep the sharing scope to “Only me” if it’s a draft not ready for others, but otherwise switch it to an appropriate audience so the agent isn’t locked to one person’s account[5].
Manage Underlying Resources: If your agent uses additional resources like Power Automate flows (actions) or certain connectors that require separate permissions, remember to share those as well. Sharing an agent itself does not automatically share any connected flow or data source with co-authors[3]. For example, if the agent triggers a Power Automate flow to update a SharePoint list, you must go into that flow and add your colleagues as co-owners there too[3]. Otherwise, they might be able to edit the agent’s conversation, but not open or modify the flow. Similarly, ensure any SharePoint sites or files used as knowledge sources have the right sharing settings for your team. A good practice is to use common team-owned resources (not one person’s private OneDrive file) for any knowledge source, so access can be managed by the team or admins.
Administrative Oversight: Because these agents become part of your organisation’s tools, administrators have oversight of shared agents. In the Microsoft 365 admin center (under Integrated Apps > Shared Agents), admins can see a list of all agents that have been shared, along with their creators, status, and who they’re shared with[1]. This means if the original creator does leave the company, an admin can identify any orphaned agents and reassign ownership or manage them as needed. Admins can also block or disable an agent if it’s deemed insecure or no longer appropriate[1]. This governance is useful for ensuring continuity and compliance – your agent isn’t tied entirely to one user’s account. From a planning perspective, it’s wise to have at least two people with full access to every mission-critical agent (one primary and one backup person), plus ensure your IT admin team is aware of the agent’s existence.

By following these practices, you create a safety net around your Copilot agent. Multiple team members can improve or update it, and no single individual is irreplaceable for its maintenance. Should someone exit the team, the remaining editors (or an admin) can continue where they left off.

Documentation and Version Control Practices

Even with a collaborative platform, it’s important to document the agent’s design and maintain version control as if it were any other important piece of software. This ensures that knowledge about how the agent works is not lost and changes can be tracked over time. Here are key practices:

Create a Design & Usage Document: Begin a living document (e.g. in OneNote or a SharePoint wiki) that describes the agent in detail. This should include the agent’s purpose, the problems it solves, and its scope (what it will and won’t do). Document the instructions or logic you gave it – you might even copy the core parts of the agent’s instruction text into this document for reference. Also list the knowledge sources connected (e.g. “SharePoint site X – HR Policies”) and any capabilities/flows added. This way, if a new colleague takes over the agent, they can quickly understand its configuration and dependencies. Include screenshots of the agent’s setup from Copilot Studio if helpful. If the agent goes through iterations, note what changed in each version (“Changelog: e.g. Added new Q\&A section on 2025-08-16 to cover Covid policies”). This documentation will be invaluable if the original creator is not available to explain the agent’s behavior down the line.
Use Source Control for Agent Configuration (ALM): Treat the agent as a configurable solution that can be exported and versioned. Microsoft 365 Copilot agents built in Copilot Studio actually reside in the Power Platform environment, which means you can leverage Power Platform’s Application Lifecycle Management (ALM) features. Specifically, you can export the agent as a solution package and store that file for version control[6]. Using Copilot Studio, create a solution in the environment, add the agent to it, and export it as an unzip-able file. This exported solution contains the agent’s definition (topics, flows, etc.). You can keep these solution files in a source repository (like a GitHub or Azure DevOps repo) to track changes over time, similar to how you’d version code. Whenever you make significant updates to the agent, export an updated solution file (with a version number or date in the filename) and commit it to the repository. This provides a backup and a history. In case of any issue or if you need to restore or compare a previous version, you can import an older solution file into a sandbox environment[6]. Microsoft’s guidance explicitly supports moving agents between environments using this export/import method, which can double as a backup mechanism[6].
Implement CI/CD for Complex Projects (Optional): If your organisation has the capacity, you can integrate the agent development into a Continuous Integration/Continuous Deployment process. Using tools like Azure DevOps or GitHub Actions, you can automate the export/import of agent solutions between Dev, Test, and Prod environments. This kind of pipeline ensures that all changes are logged and pass through proper testing stages. Microsoft recommends maintaining healthy ALM processes with versioning and deployment automation for Copilot agents, just as you would for other software[7]. For example, you might do initial editing in a development environment, export the solution, have it reviewed in code review (even though it’s mostly configuration, you can still check the diff on the solution components), then import into a production environment for the live agent. This way, any change is traceable. While not every team will need full DevOps for a simple Copilot agent, this approach becomes crucial if your agent grows in complexity or business importance.
**Consider the Microsoft 365 *Agents SDK* for Code-Based Projects:** Another approach to maintainability is building the agent via code. Microsoft offers an Agents SDK that allows developers to create Copilot agents using languages like C#, JavaScript, or Python, and integrate custom AI logic (with frameworks like Semantic Kernel or LangChain)[8]. This is a more advanced route, but it has the advantage that your agent’s logic lives in code files that can be fully managed in source control. If your team has software engineers, they could use the SDK to implement the agent with standard dev practices (unit testing, code reviews, git version control, etc.). This isn’t a no-code solution, but it’s worth mentioning for completeness: a coded agent can be as collaborative and maintainable as any other software project. The SDK supports quick scaffolding of projects and deployment to Copilot, so you could even migrate a no-code agent to a coded one later if needed[8]. Only pursue this if you need functionality beyond what Copilot Studio offers or want deeper integration/testing – for most cases, the no-code approach is sufficient.
Keep the Documentation Updated: Whichever development path you choose, continuously update your documentation when changes occur. If a new knowledge source is added or a new capability toggled on, note it in the doc. Also record any design rationale (“We disabled the image generator on 2025-09-01 due to misuse”) so future maintainers understand past decisions. Good documentation ensures that even if original creators or key contributors leave, anyone new can come up to speed quickly by reading the material.

By maintaining both a digital paper trail (documents) and technical version control (solution exports or code repositories), you safeguard the project’s knowledge. This prevents the “single point of failure” scenario where only one person knows how the agent really works. It also makes onboarding new team members to work on the agent much easier.

Additional Tips for a Robust, Maintainable Agent

Finally, here are additional recommendations to ensure your Copilot agent remains reliable and easy to manage in the long run:

Define a Clear Scope and Boundaries: A common pitfall is trying to make one agent do too much. It’s often better to have a focused agent that excels at a specific set of tasks than a catch-all that becomes hard to maintain. Clearly state what user needs the agent addresses. If later you find the scope creeping beyond original intentions (for example, your HR bot is suddenly expected to handle IT helpdesk questions), consider creating a separate agent for the new domain or using multi-agent orchestration, rather than overloading one agent. This keeps each agent simpler to troubleshoot and update. Also use the agent’s instructions to explicitly guard against out-of-scope requests (e.g., instruct it to politely decline questions unrelated to its domain) so that maintenance remains focused.
Follow Best Practices in Instruction Design: Well-structured instructions not only help the AI give correct answers, but also make the agent’s logic easier for humans to understand later. Use clear and action-oriented language in your instructions and avoid unnecessary complexity[9]. For example, instead of a vague instruction like “help with leaves,” write a specific rule: “If user asks about leave status, retrieve their leave request record from SharePoint and display the status.” Break down the agent’s workflow into ordered steps where necessary (using bullet or numbered lists in the instructions)[9]. This modular approach (goal → action → outcome for each step) acts like commenting your code – it will be much easier for someone else to modify the behavior if they can follow a logical sequence. Additionally, include a couple of example user queries and desired responses in the instructions (few-shot examples) for clarity, especially if the agent’s task is complex. This reduces ambiguity for both the AI and future editors.
Test Thoroughly and Collect Feedback: Continuous testing is key to robustness. Even after deployment, encourage users (or the team internally) to provide feedback if the agent gives an incorrect or confusing response. Periodically review the agent’s performance: pose new questions to it or check logs (if available) to see how it’s handling real queries. Microsoft 365 Copilot doesn’t yet provide full conversation logs to admins, but you can glean some insight via any integrated telemetry. If you have access to Azure Application Insights or the Power Platform CoE kit, use them – Microsoft suggests integrating these to monitor usage, performance, and errors for Copilot agents[7]. For example, Application Insights can track how often certain flows are called or if errors occur, and the Power Platform Center of Excellence toolkit can inventory your agent and its usage metrics[7]. Monitoring tools help you catch issues early (like an action failing because of a permissions error) and measure the agent’s value (how often it’s used, peak times, etc.). Use this data to guide maintenance priorities.
Implement Governance and Compliance Checks: Since Copilot agents can access organisational data, ensure that all security and compliance requirements are met. From a maintainability perspective, this means the agent should be built in accordance with IT policies (e.g., respecting Data Loss Prevention rules, not exposing sensitive info). Work with your admin to double-check that the agent’s knowledge sources and actions comply with company policy. Also, have a plan for regular review of content – for instance, if one of the knowledge base documents the agent relies on is updated or replaced, update the agent’s knowledge source to point to the new info. Remove any knowledge source that is outdated or no longer approved. Keeping the agent’s inputs current and compliant will prevent headaches (or forced takedowns) later on.
Plan for Handover: Since the question specifically addresses if the original creator leaves, plan for a smooth handover. This includes everything we’ve discussed (multiple editors, documentation, version history). Additionally, consider a short training session or demo for the team members who will inherit the agent. Walk them through the agent’s flows in Copilot Studio, show how to edit a topic, how to republish updates, etc. This will give them confidence to manage it. Also, make sure the agent’s ownership is updated if needed. Currently, the original creator remains the “Owner” in the system. If that person’s account is to be deactivated, it may be wise to have an admin transfer any relevant assets or at least note that co-owners are in place. Since admins can see the creator’s name on the agent, proactively communicate to IT that the agent has co-owners who will take over maintenance. This can avoid a scenario where an admin might accidentally disable an agent assuming no one can maintain it.
Regular Maintenance Schedule: Treat the agent as a product that needs occasional maintenance. Every few months (or whatever cadence fits your business), review if the agent’s knowledge or instructions need updates. For example, if processes changed or new common questions have emerged, update the agent to cover them. Also verify that all co-authors still have access and that their permissions are up to date (especially if your company uses role-based access that might change with team reorgs). A little proactive upkeep will keep the agent effective and prevent it from becoming obsolete or broken without anyone noticing.

By following the above tips, your Microsoft 365 Copilot agent will be well-positioned to serve users over the long term, regardless of team changes. You’ve built it with a collaborative mindset, documented its inner workings, and set up processes to manage changes responsibly. This not only makes the agent easy to edit and enhance by multiple people, but also ensures it continues to deliver value even as your organisation evolves.

Conclusion: Building a Copilot agent that stands the test of time requires forethought in both technology and teamwork. Using Microsoft’s no-code Copilot Studio, you can quickly create a powerful assistant tailored to your needs. Equally important is opening up the project to your colleagues, setting the right permissions so it’s a shared effort. Invest in documentation and consider leveraging export/import or even coding options to keep control of the agent’s “source.” And always design with clarity and governance in mind. By doing so, you create not just a bot, but a maintainable asset for your organisation – one that any qualified team member can pick up and continue improving, long after the original creator’s tenure. With these steps and best practices, your Copilot agent will remain helpful, accurate, and up-to-date, no matter who comes or goes on the team.

References

[1] Manage shared agents for Microsoft 365 Copilot – Microsoft 365 admin

[2] Use the Copilot Studio Agent Builder to Build Agents

[3] Share agents with other users – Microsoft Copilot Studio

[4] Control how agents are shared – Microsoft Copilot Studio

[5] Publish and Manage Copilot Studio Agent Builder Agents

[6] Export and import agents using solutions – Microsoft Copilot Studio

[7] Phase 4: Testing, deployment, and launch – learn.microsoft.com

[8] Create and deploy an agent with Microsoft 365 Agents SDK

[9] Write effective instructions for declarative agents

Need to Know podcast–Episode 349

Explore the future of AI integration, Microsoft Cloud updates, and security innovations tailored for the SMB market. In this episode, we dive into the transformative role of AI MCP servers, the latest Microsoft 365 and Teams updates, and practical security and compliance strategies. Whether you’re an IT pro, business leader, or tech enthusiast, this episode delivers actionable insights and resources to stay ahead in the Microsoft ecosystem.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-349-mcp-is-for-me/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show.

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

Join my Teams shared channel – Join my Teams Shared Channel – CIAOPS