The ConnectWise supply-chain attack on Microsoft 365 tenants has raised a question I keep hearing from MSPs: if an attacker’s app signed in to a tenant, how do you prove what it did, or didn’t, do?
The honest answer is that Microsoft doesn’t publish one definitive list of “Graph activity that isn’t in the UAL”. What it does document is which log records what. Put those side by side and the gaps become clear. I’ll cover what each log tells you, where the blind spots are, how to switch on Microsoft Graph activity logs, and how to scope the blast radius if you didn’t have them on.
What GCIT showed
Credit to Elliot and the team at GCIT, whose write-up of the ConnectWise Cloud Backup compromise is a model of how to be open about an incident. Their tenant had one successful service principal sign-in from the Cloud Backup app (15 Oct, 144.172.64.128, Python user agent). They proved nothing was done with that token by matching its identifier against 13,682 requests in their Microsoft Graph activity logs. The UAL on its own could never have proved that. They also note that Graph activity logs need Entra ID P1 and have to be switched on before the event.
The three logs and what each one tells you
Sign-in logs (service principal and managed identity sign-ins are kept separately from interactive sign-ins) tell you that a token was issued, and from where. They don’t tell you what was done with it. One sign-in can mean hundreds of API calls, or none at all, as GCIT found. Retention is 7 days on Entra ID Free and 30 days on P1/P2, so export them. https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention
The unified audit log records audited actions in each workload. It isn’t a record of every API request. A good example is mail: MailItemsAccessed covers all protocols, including REST/Graph and EWS, but it’s only on by default for E3/E5 users. Check your mailbox audit configuration everywhere else. Bind accesses are also aggregated and de-duplicated. https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts
Microsoft Graph activity logs (MicrosoftGraphActivityLogs) record every HTTP request Graph processes for your tenant: app ID, service principal, IP, request URI, method, response size, and the token and sign-in identifiers. That’s what lets you join requests to sign-ins. They need Entra ID P1 or P2 and a diagnostic setting that sends them to Log Analytics, Storage or Event Hub. They aren’t retroactive, and delivery usually takes up to 30 minutes, occasionally 2 hours. https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview
So where are the blind spots?
Anything read through Graph that the workload doesn’t audit as an action, such as directory and user reads, will only show up in Graph activity logs. And full_access_as_app over EWS isn’t Graph at all, so it won’t appear in Graph activity logs. It would only appear in mailbox auditing. If you don’t have Graph activity logs turned on, “sign-in but no UAL entries” doesn’t prove nothing happened. It means you can’t tell.
What an attacker could do without Graph activity logs
The short answer is anything the app’s granted permissions allow. Without Graph activity logs, most read-only activity leaves no trace at all.
Likely to leave no trace (reads)
Directory reconnaissance: listing users, groups, admin role holders, devices, apps, Conditional Access policies and licences (Directory.Read.All, Policy.Read.All). Reads like these aren’t recorded in the UAL, which makes them perfect for mapping a tenant before a bigger attack.
Org intel: org charts, managers, phone numbers and email addresses, all useful for phishing and business email compromise.
Teams/chat and calendar reads, and some file reads, depending on permissions and audit coverage. SharePoint and OneDrive FileAccessed events usually do appear in the UAL, but bulk reads by an app can be patchy.
Probably visible, if auditing was on
Mail reads (Mail.Read): these show as MailItemsAccessed, but only if mailbox auditing records that action for the affected mailboxes. If it doesn’t, they’re invisible.
Writes and changes: sending mail, creating inbox rules, adding app credentials or owners, consenting to new apps, creating users or changing roles, and changing CA policies. These normally appear in the Entra audit log or the UAL, because they’re audited actions rather than reads.
What actually determines the blast radius
The app’s application permissions. Check Enterprise applications > the app > Permissions. Something like Mail.Read or Files.Read.All is tenant-wide.
The service principal sign-ins: times, IP addresses and how many tokens were issued.
The Entra audit log: look for any new credentials, owners or consents on that or other apps, which would show persistence.
The honest bottom line is that without Graph activity logs, a sign-in followed by no UAL entries means you can’t prove what was read. Treat anything that app could read as potentially exposed, rotate its secrets, and remove or scope down its permissions. Then turn on Graph activity logs so next time you can prove it either way.
How to turn on Microsoft Graph activity logs
It takes about 10 minutes per tenant.
Before you start
Licensing: Microsoft Entra ID P1 or P2 in the tenant (Business Premium includes P1).
Role: Security Administrator is the least privileged Entra role Microsoft supports for creating diagnostic settings. You also need Azure rights on the destination.
An Azure subscription with a destination that already exists: a Log Analytics workspace (best for querying), a storage account (cheap long-term archive) or an Event Hub (to stream to a third-party SIEM).
Cost: P1 doesn’t cover the Azure side, so you pay for what you ingest and store. Microsoft’s rough guide is about 15 GiB a month into Log Analytics per 1,000 users, but it varies a lot with the apps in the tenant. Check the Azure Monitor pricing page and consider a workspace transformation or the Basic table plan to cut costs.
The logs are NOT retroactive. You only see activity from the moment you switch them on, so do it before you need them.
Step 1: Create a Log Analytics workspace
In the Azure portal, go to Log Analytics workspaces > Create.
Pick the subscription, a resource group, a name and a region, then Review + Create.
Browse to Entra ID > Monitoring & health > Diagnostic settings.
Select Add diagnostic setting and give it a name.
Tick MicrosoftGraphActivityLogs. While you’re there, also tick ServicePrincipalSignInLogs, SignInLogs and AuditLogs, so you can correlate them.
Tick Send to Log Analytics workspace and choose your subscription and workspace.
Save.
Step 2 (alternative): PowerShell
There’s no dedicated Entra cmdlet for this. New-AzDiagnosticSetting targets Azure resources, not the tenant. Instead, you PUT to the Azure Resource Manager endpoint for microsoft.aadiam/diagnosticSettings with Invoke-AzRestMethod:
This is the shared responsibility point again. The vendor protects its credential, Microsoft provides the logs, and we as MSPs own the decision to let that app in, which means having the logging on before we need it. My cw-skykick-exposure-check.ps1 script will help you with the exposure side. Graph activity logs are what answer “what did it actually touch?”
I had a conversation with an MSP owner last week that has been rattling around in my head ever since. He was telling me, proudly, about how his team had just finished a big project hardening a client’s endpoint stack. Patching, EDR, conditional access, the lot. Then almost as an afterthought he mentioned the same client had quietly turned on Copilot for sixty users and was already building their first agent in Copilot Studio. He had no plan for any of it. No policy, no review process, no clear idea who in his team would actually own it. And here is the uncomfortable part. He is not unusual. He is the rule.
The growth in AI agents inside SMB environments is going to be the steepest curve we have seen in years, and most MSPs are walking into it carrying the wrong toolkit. The skills that built a successful managed services business over the last decade are not the skills that will keep customers safe and productive over the next one. That gap is widening every week, and very few MSP owners I speak to have noticed.
Agents are not endpoints
For twenty years MSPs have been organised around things. Devices, servers, mailboxes, firewalls. You patch them, monitor them, back them up, replace them. The whole MSP operating model — RMM, PSA, ticketing, SLAs — assumes a world of static assets that misbehave in fairly predictable ways.
An AI agent is none of those things. It is not an endpoint. It does not sit still. It reads documents in SharePoint, drafts replies in Outlook, pulls data from line-of-business systems, and acts on behalf of a user across surfaces the MSP has never had to think about as a single connected thing. When a Copilot agent fetches the wrong document and pastes confidential numbers into an external chat, no RMM alert is going to fire. The questions are different too. Not “is it patched?” but “what did it do today, and why?” That is a governance and behaviour problem, not an infrastructure one.
The new skill set is governance, data and prompts
Managing agents well leans on a set of muscles most MSPs have never had to build. Understanding identity scope in Entra so an agent cannot reach data it has no business touching. Configuring sensitivity labels and DLP in Purview so a chatty agent does not quietly become a leak. Reviewing prompt design and grounding sources in Copilot Studio before an agent is let near real users. Watching audit logs in the Microsoft 365 admin centre for patterns of agent behaviour that look off.
This is closer to the work of a data steward or a security analyst than a traditional systems engineer. It is slower, more interpretive, and more about judgement than ticket throughput. It rewards curiosity and writing skills as much as PowerShell. The MSP business model has not been built for that kind of work, and the hiring pipeline certainly has not.
The retraining window is now
Here is the bit that worries me. Customers are going to assume their MSP has this covered. They will turn on Copilot, build agents in Copilot Studio, plug them into their CRM, and look across the table expecting the same calm competence they get for backups. When something goes wrong — a leaked document, an agent that quietly emails the wrong list, a workflow that has drifted off purpose — they will ring their MSP. And most will not be able to help.
The MSPs that get ahead of this will start small and start now. Pick one client, one agent, and learn it end to end. Read the audit logs. Write the policy. Build the review cadence. The technical hardening skills will still matter. They are just no longer enough on their own.
Managed Service Providers (MSPs) serving small and medium-sized businesses (SMBs) must elevate their game in 2026 to meet rising expectations and rapid technology changes. Globally, the MSP market continues to expand (projected at $424–$511 billion by 2026), and SMBs are channeling unprecedented investments (over $90 billion in new managed IT spending through 2026). However, with this opportunity comes intense pressure: clients demand better cybersecurity, optimized cloud services, meaningful use of AI, improved service experiences, strict compliance, greater automation, and skilled support. Many MSPs today struggle with gaps in these areas – from reactive security postures to talent shortages – which must be addressed for sustained growth. [deskday.com]
The table below summarizes key operational areas, where MSPs often fall short at present, and the essential focus and actions needed in 2026 to improve:
Area
Current Gaps / Needs Improvement
2026 Focus & Actions
Cybersecurity
Reactive approach prevalent; advanced threat detection, incident response, and user security training are often insufficient[provaltech.com].
Focus often limited to migration; many lack expertise in multi-cloud management, cost optimization, and robust cloud security [deskday.com].
Provide end-to-end cloud support: manage hybrid/multi-cloud environments, practice FinOps for cost control, ensure cloud backup & DR, and leverage edge computing for low-latency needs [deskday.com], [deskday.com].
AI Integration
Slow adoption of AI – only ~30% of MSPs use AI to automate tasks, as others remain cautious or lack skills [kaseya.com] (smaller MSPs risk falling behind larger competitors [channele2e.com]).
Embed AI in operations: deploy AI-driven ticket triage/chatbots for Tier-1 support, use predictive analytics to prevent outages, and develop client-facing AI solutions (e.g. deploying productivity AI tools) [deskday.com], [channele2e.com].
Customer Experience
Often seen as mere IT vendors rather than strategic partners – value reporting and proactive guidance lag behind client expectations [channele2e.com].
Elevate client engagement: act as a vCIO with business-aligned IT roadmaps, conduct outcome-focused QBRs, provide transparent ROI dashboards (e.g. uptime improved, incidents prevented), and personalize support [channele2e.com], [provaltech.com].
Compliance & Governance
Proactive compliance management is not standard – many SMBs lack guidance on regulatory requirements and data governance [deskday.com].
Offer compliance-as-a-service: audit and ensure adherence to standards (GDPR, HIPAA, PCI), deliver automated compliance reports, and keep clients ahead of regulatory changes (adopt “compliance-first” service design) [deskday.com], [deskday.com].
Process Automation
Operations still too manual – MSPs waste 100+ hours/month on tasks (ticket entry, reporting) due to disjointed tools and <25% workflow automation [suppfusion.com], [suppfusion.com].
Maximize automation: integrate PSA/RMM and other tools to eliminate duplicate data entry [kaseya.com], use scripts/RPA for routine maintenance, auto-generate reports (e.g. for QBRs) to free time for strategic work [suppfusion.com], [suppfusion.com].
Workforce Development
Skill shortages and burnout persist – over 52% of MSPs cite hiring skilled staff as a top challenge[deskday.com], and overworked teams (59% working holidays) reflect understaffing [kaseya.com].
Bolster talent and capacity: invest in upskilling (certifications, training) [provaltech.com], improve work-life balance by offloading work (e.g. outsource NOC/SOC via white-label partners) [deskday.com], and create clear career paths to retain experts [provaltech.com].
Below, we dive into each of these focus areas, examining what MSPs are not doing well today and how they can improve in 2026, with examples and global trends in mind.
1. Strengthening Cybersecurity & Resilience
Cybersecurity is the number-one growth driver in managed services, yet many MSPs’ security offerings haven’t kept pace with evolving threats. What’s not done well: Too often, MSP security is reactive – providing basic antivirus, firewalls, and backups – but lacking in proactive threat hunting, continuous monitoring, and incident response planning. Many providers still treat security as an add-on, rather than baking it into every service. Crucially, clients now expect more: they want their MSP to be a comprehensive security partner, handling advanced threats and compliance needs, not just a help-desk for cyber issues. For example, SMBs are increasingly asking MSPs for help with compliance and cyber insurance requirements – areas in which some MSPs are underprepared. [deskday.com][provaltech.com]
Focus for 2026: MSPs must shift from reactive to proactive security. This means adopting 24×7 threat monitoring and rapid response capabilities. For instance, a provider might set up a managed detection and response (MDR) service or partner with a Security Operations Center (SOC) to monitor client networks around the clock for intrusions. MSPs should implement zero-trust security frameworks (verify every user/device), enforce multi-factor authentication (MFA) everywhere, and regularly test backup and disaster recovery plans. Security awareness training for client employees is also key – many breaches start with human error, so MSPs should run phishing simulations and training sessions to harden the human element.
Moreover, expanding compliance services is critical. Compliance has become “table stakes” for clients in regulated industries like healthcare, finance, and manufacturing. Yet not all MSPs offer systematic compliance support today. In 2026, leading MSPs will offer Compliance-as-a-Service – e.g. continuous monitoring of compliance (using tools aligned to standards like HIPAA, PCI DSS, GDPR), automated audit reporting, and guiding clients through regulatory changes. An MSP might, for example, maintain a compliance dashboard for each client that tracks data backup practices, access controls, software patch levels, and other policy requirements in real-time. By doing so, the MSP not only protects the client’s data but also helps them avoid fines or legal issues. [deskday.com]
Example Action – Cybersecurity:One MSP serving many SMB law firms realized its basic security package was insufficient. In 2026, it invested in an AI-enhanced threat detection system and partnered with a specialized managed SIEM provider to filter and analyze logs across all client sites. It also began conducting quarterly security posture reviews for each client, showing how many attacks were blocked and recommending next steps (like encrypting all mobile devices). This proactive stance not only reduced incidents but also reassured clients with compliance concerns (e.g. demonstrating support for GDPR and emerging privacy laws). As a result, the MSP could “command premium pricing” for its security-centric services while building deeper trust with customers. [deskday.com]
In summary, cybersecurity in 2026 should permeate every aspect of an MSP’s offerings. The MSPs that succeed will be those who anticipate threats (using advanced tools and intelligence), respond swiftly to incidents, and ensure clients meet security compliance mandates. Given that cybersecurity services are growing ~18% annually (faster than the overall MSP market), investing in these capabilities is both a defensive move and a major growth opportunity. [deskday.com]
2. Optimizing Cloud Services & Infrastructure
Cloud services have become a core component of SMB IT strategies worldwide, but MSPs often struggle to move beyond basic cloud enablement. Current weaknesses: Many MSPs excel at initial cloud migrations (moving an SMB’s servers or applications to AWS/Azure or a private cloud), but fall short in ongoing optimization and multi-cloud expertise. As more businesses adopt complex architectures – e.g. hybrid clouds (mix of on-prem and cloud) and multi-cloud deployments – MSPs need deeper skill in managing and optimizing these environments. In practice, some providers still treat cloud management as a set-and-forget hosting task, missing opportunities to fine-tune performance, optimize costs, or update security configurations continuously. SMB clients, however, increasingly expect their MSP to be the cloud expert who can navigate these complexities: nearly 48% of SMBs now rely on MSPs for public cloud management (a figure climbing each year). [deskday.com]
Focus for 2026:End-to-end cloud lifecycle management should be a priority. MSPs must go beyond provisioning to deliver ongoing optimization, cost management, and integration across cloud platforms. One key area is cost optimization (FinOps) – cloud costs can spiral out of control for SMBs who lack the expertise to right-size resources. An MSP in 2026 should regularly analyze clients’ cloud usage, eliminate waste (e.g. unused VMs or over-provisioned storage), and advise on reserved instances or savings plans. This proactive cost management demonstrates tangible value. In fact, experts note that MSPs should invest in cloud optimization capabilities to meet evolving demand. [channele2e.com]
MSPs also need to handle multi-cloud and hybrid environments confidently. With 73% of organizations using hybrid cloud and multi-cloud adoption doubling in recent years, a provider might, for example, manage an SMB’s Azure infrastructure alongside a Salesforce SaaS and an on-prem file server – ensuring they all work together. Skills in cloud orchestration and monitoring tools (that work across AWS/Azure/GCP) are essential. Security in the cloud is another improvement area: MSPs should implement cloud security best practices like regular cloud vulnerability scans, proper identity & access management, encryption of data at rest and in transit, and configuration audits (using benchmarks such as CIS benchmarks for cloud). [deskday.com]
Emerging technologies present both a challenge and opportunity. Edge computing and IoT integration are on the rise, especially for industries needing real-time data processing (manufacturing, retail, smart devices). In response, MSPs should be prepared to manage distributed edge infrastructure – for example, deploying and monitoring mini-servers or appliances at client sites or in the field that sync with central cloud systems. By developing solutions for edge computing (like local data processing coupled with cloud analytics), an MSP can differentiate itself for clients who require low-latency performance. [deskday.com]
Example Action – Cloud:An MSP with several SMB clients in e-commerce noticed their cloud bills were climbing while performance issues lingered. In 2026, the MSP introduced a Cloud Cost & Performance Audit service. Using cloud management tools, it analyzed each client’s resource utilization and identified overspending (e.g. servers running at 5% utilization). It then implemented auto-scaling and schedule-based resources (shutting down non-critical systems after hours) for those clients, cutting cloud costs by 20%. They also added a multi-cloud backup solution – replicating critical data from the primary AWS environment to an Azure data center – to bolster resilience. The clients not only saved money but also gained confidence that their cloud setup was optimized and fault-tolerant, something they wouldn’t have achieved on their own.
In short, MSPs in 2026 should provide holistic cloud stewardship: from architecture planning and migration through continuous optimization, security, and new tech integration. As SMBs continue to increase spending on cloud and related services, MSPs who deliver efficiency and reliability in the cloud will deepen customer loyalty and attract new business. [channele2e.com]
3. Embracing AI-Driven Solutions and Automation
AI integration is shifting from a buzzword to a competitive necessity for MSPs. By 2026, AI won’t be optional – it will be woven into service delivery for efficiency and smarter support. Where MSPs are lagging: A surprising number of MSPs have been slow to leverage AI in their operations. Surveys show roughly 30% of MSPs are already using AI to eliminate repetitive tasks, but the majority have not yet implemented such solutions, with some firms cautious about AI’s risks or lacking in-house expertise. This reluctance is problematic: AI is rapidly changing MSP economics by automating Tier-1 support tasks, and providers not leveraging AI will struggle to compete on cost and service quality. In essence, larger MSPs (often backed by investors) are racing ahead with AI, widening the efficiency gap over smaller players. [kaseya.com][channele2e.com]
Focus for 2026: MSPs should embed AI across their workflows to enhance both internal efficiency and customer value. A primary application is in the service desk: deploying AI-driven chatbots or virtual agents that can handle common support queries and basic troubleshooting. By 2026, an AI-powered system can automatically categorize and route tickets, suggest solutions, or even resolve issues (like password resets or simple network glitches) without human intervention. In fact, analysts predict widespread service desk automation could cut ticket volumes by 40–60% and drastically speed up resolution times. This frees up human technicians to focus on more complex issues, improving overall support quality. It’s telling that 87% of MSPs plan to increase AI investments by 2026 – the tools are becoming more accessible (built into RMM/PSA software, for instance) and MSPs recognize the ROI. [deskday.com]
Beyond support, predictive analytics is a game-changer. MSPs should use AI to analyze system logs and performance metrics to predict and prevent failures – for example, forecasting when a server might fail or when storage will run out, so they can fix it before it causes downtime. This predictive maintenance approach was once a luxury but is increasingly expected as part of proactive managed services.
MSPs can also extend AI to augment decision-making and reporting. Modern AI tools can comb through an SMB client’s data and provide insights, such as identifying security anomalies or highlighting usage trends. Some MSPs are starting to use generative AI to draft clearer client communications or create executive summaries of IT performance for quarterly reports. In 2026, we’ll see successful MSPs providing clients with AI-generated insights – for example, an automated monthly report that not only lists incidents resolved, but explains in plain language how those IT events affected the client’s business and recommends improvements (all generated with minimal human editing). [deskday.com]
Furthermore, MSPs should consider offering AI-related services to customers. SMBs often lack the knowledge to implement AI solutions themselves, so an MSP can step in as a guide. This could include setting up an AI-powered analytics platform for a client’s sales data, or integrating an AI chatbot on a client’s website for customer service. Since 55% of businesses expect their MSPs to adopt and deploy AI tech by 2026, showing expertise in practical AI applications can be a major selling point. [deskday.com]
Example Action – AI:A mid-sized MSP in 2025 handled thousands of tickets monthly and struggled with slow response times. In 2026, they integrated an AI service bot into their ticketing system. The bot uses natural language processing to understand incoming emails and chat requests from users – it automatically resolved simple issues (password resets, Wi-Fi setup instructions) and pulled up relevant knowledge base articles for technicians on more complex problems. The result was a 50% reduction in human-handled Level-1 tickets and much faster first responses. Additionally, the MSP began offering an “AI Advisory” service to clients: helping SMBs pilot tools like Microsoft’s AI Copilots or AI-based CRM add-ons to streamline their own business workflows. This not only generated a new revenue stream but also positioned the MSP as an innovation partner.
In sum, AI and automation are key to MSP efficiency and differentiation in 2026. MSPs should aim to automate away the grunt work – from repetitive troubleshooting to data reporting – so they can deliver faster service at scale. Those who fail to leverage AI will find themselves with higher costs and slower service, unable to match “AI-powered” competitors. Embracing AI is thus both a defensive strategy (to stay efficient) and an offensive one (to offer new intelligent services). [channele2e.com]
4. Enhancing Customer Experience and Strategic Value
As technology solutions commoditize, customer experience (CX) and the strategic value an MSP provides become critical differentiators. Today’s SMB clients don’t just want IT support; they want a partner who understands their business and helps it grow. Where MSPs fall short: Many MSPs still operate in a reactive, technical mindset – fixing what’s broken and maintaining systems – but not engaging at the business level or clearly demonstrating value. Clients are increasingly scrutinizing costs and asking, “What am I getting for this monthly fee?”. If the MSP only talks in technical terms (uptime, tickets closed) without linking to business outcomes, clients may feel the partnership is not delivering enough. In fact, MSP industry experts observe that successful MSPs now “sell outcomes, not just services,” using benchmarks and reviews to prove their worth. Many providers have been slow to adopt this outcomes-focused approach. [channele2e.com]
Another aspect of CX is responsiveness and personalization. SMB customers can feel neglected if their provider treats them like just another ticket number. Some MSPs could do better in maintaining regular communication, soliciting feedback, and tailoring their support to each client’s unique needs. It’s telling that clients are asking for more guidance – for example, they want help choosing which software matters, which investments to prioritize, and clarity on why MSP recommendations are made. If MSPs aren’t providing this guidance, clients may seek someone who will. [provaltech.com]
Focus for 2026: MSPs should strive to become trusted advisors to their SMB clients, not just IT fixers. This means deeply understanding each client’s industry, business goals, and challenges, and then aligning technology strategies accordingly. A concrete step is to institute regular strategic meetings – often Quarterly Business Reviews (QBRs) – but these must evolve from perfunctory report-outs to forward-looking planning sessions. Rather than just reciting metrics, the MSP should use QBRs to discuss “Here’s how your IT environment improved your business this quarter, and here’s what we recommend for the next quarter to support your goals.” For example, tie in how a new collaboration tool led to faster project completion for the client, or how the MSP’s quick incident response saved X hours of downtime, preserving the client’s revenue. Actionable outcomes should be the focus of these meetings. [provaltech.com]
To support these strategic discussions, MSPs need to provide clear, tangible reporting of value. Gone are the days of sending a generic monthly uptime report that clients might not even read. In 2026, MSPs should leverage dashboards and analytics to show key performance indicators (KPIs) that matter to the client’s leadership – whether it’s the number of cyber attacks blocked (indicating risk reduction), the time to resolve issues (operational efficiency), or improvements in system performance that enable employee productivity. As one channel expert noted, benchmarks, business reviews, and analytics dashboards have become must-haves for MSPs to prove their value. Clients also “expect more proof of value” – they want to know what was prevented, what improved, how security posture changed, and what’s coming next. Ensuring your data is clean and presented in an accessible way is vital – e.g. an MSP might implement a customer portal where the client can log in anytime to see ticket status, security alerts, and project updates in real time. [channele2e.com][provaltech.com]
Improving customer experience also involves being proactive and consultative. An MSP should bring new ideas to the client: for instance, recommending a workflow automation tool to an accounting firm client because the MSP knows reducing manual data entry could save them money. This kind of proactive solutioneering shows the MSP is thinking about the client’s business, not just waiting for instructions. Industry trends show that clients in mature markets now expect MSPs to help predict and prevent issues and to speak the language of business outcomes. Instead of waiting for clients to ask for a technology, the MSP should be saying “We’ve analyzed your operations and we think adopting XYZ software could improve your customer satisfaction by 10%, let us help you implement it.” [deskday.com]
Personalization and responsiveness remain key to CX. Simple gestures like having a dedicated account manager who really knows the client’s environment, or sending quick status updates during a major incident, go a long way in building trust. Also, timely support (meeting or exceeding SLAs) is part of the experience – even with automation, MSPs must ensure that when a human touch is needed, they are prompt and effective.
Example Action – Customer Experience:Consider an MSP serving a chain of retail stores. Historically, they just kept the POS systems running. In 2026, the MSP shifts approach: they schedule quarterly strategy sessions with the retailer’s management. In one QBR, they present a dashboard showing that over the holiday season, their support kept 99.9% uptime, preventing an estimated 5 hours of downtime (which, for the retailer, translates to an estimated $50k of sales not lost). They also highlight that by upgrading the store’s Wi-Fi and installing a new inventory management app (their suggestion last quarter), the client’s inventory turnover improved noticeably. Going forward, the MSP recommends a customer analytics tool to help the retailer personalize marketing – a bit outside pure IT infrastructure, but a tech solution aligned to growing the retailer’s business. The client, seeing the MSP’s advice consistently improve outcomes, now views the MSP as a strategic partner rather than just an IT supplier, leading to a long-term contract and openness to more services.[provaltech.com]
In essence, the MSPs that win in 2026 will pair excellent technical service with high-touch, value-driven customer engagement. They will measure their success in the client’s terms (productivity, risk reduction, growth support) and continuously communicate that value. This shift from “vendor” to “partner” status not only improves client satisfaction but provides MSPs with opportunities to broaden their services (since satisfied clients trust them with more tasks). As one MSP CEO put it, support is essential “but strategic guidance becomes the real differentiator”. [provaltech.com]
5. Navigating Compliance and Regulatory Demands
In a world of escalating data regulations and industry-specific rules, compliance has become a critical area where MSPs need to step up. SMBs often lack dedicated compliance officers or expertise, so they look to their MSPs for help in governing IT systems according to laws and standards. Current state: Not all MSPs currently include compliance management in their service portfolio. Many focus on technology uptime and security, assuming compliance (e.g., with data privacy laws or industry regulations) is the client’s responsibility. This gap means SMBs might be unaware of vulnerabilities or violations until an audit or breach occurs. Given the proliferation of regulations – from GDPR and CCPA (privacy) to PCI DSS (payment security), HIPAA (health data), or even sector-specific cybersecurity mandates – MSPs that ignore compliance are leaving clients exposed. In 2025, forward-looking MSPs identified compliance as a major opportunity, noting that continuous compliance monitoring and audit support could command premium services. Yet execution is lagging: compliance is often addressed in a piecemeal way (e.g., enabling encryption here or there) rather than through a structured program. [deskday.com]
Focus for 2026:Make compliance and governance a proactive service, not an afterthought. MSPs should familiarize themselves with the key regulations affecting their client base. For example, if you support medical clinics, HIPAA guidelines on data protection and breach notification should be second nature; if you serve European customers, GDPR’s requirements for data handling and breach reporting must be baked into your processes. In practical terms, MSPs need to audit their clients’ systems for compliance gaps regularly. This could entail running tools that check for data that’s stored without proper encryption, or ensuring that access rights are configured according to least privilege principles.
Offering Compliance-as-a-Service (CaaS) can differentiate an MSP. CaaS might include services such as: policy development (helping an SMB craft an IT usage policy or data retention policy), continuous monitoring (monitoring logins, file transfers, and configurations against compliance benchmarks), and automated compliance reporting. For instance, an MSP can use dashboard tools to map a client’s status against frameworks like NIST or ISO 27001, showing which controls are in place and which need attention. Prior to audits or assessments, the MSP can run an “audit readiness” exercise to fix issues. It’s also wise to educate clients – e.g., hold an annual workshop on new laws (such as updates to privacy regulations) that the client needs to know about. [deskday.com]
Compliance efforts go hand-in-hand with security improvements, but have a distinct business value: they reduce risk of legal penalties and build trust with the client’s customers. SMBs may not have realized their MSP could help here, so proactively offering this service in 2026 can meet an unmet need. Industry data suggests MSPs especially in mature markets (US, Canada, EU, ANZ) are starting to adopt a “compliance-first” service design approach, making compliance a core part of every solution due to strict regulations in these regions. This trend will likely spread worldwide as more countries introduce data protection laws. [deskday.com]
Example Action – Compliance:A small finance company (client of an MSP) faces strict regulations (PCI DSS for credit card data and new cybersecurity mandates from their government). The MSP decides in 2026 to create a Compliance Dashboard for this client. Each month, the dashboard scans the client’s systems: checking that all devices have the latest security patches, that antivirus is active, that only approved personnel accessed sensitive databases, and that backups were performed. The MSP shares this dashboard during monthly calls, so the client sees they are, say, 98% compliant with PCI requirements, with specific recommendations to get to 100%. When the client undergoes its annual audit, the MSP helps generate the required reports (e.g. user access logs, incident logs) at a click of a button. The audit passes without major findings – a stark improvement from previous years. The client’s executives now sleep better knowing compliance is continuously watched by their MSP.
In short, MSPs in 2026 should integrate compliance into their offerings to protect clients not just from hackers, but also from regulators. This involves staying current on relevant laws, leveraging tools to automate compliance checks, and guiding clients through the complex maze of requirements. By doing so, MSPs add a layer of strategic value (shielding clients from fines and reputational damage) and strengthen their role as a long-term partner. Given that regulatory scrutiny is only increasing globally, a proactive stance on compliance is both a defensive necessity and a chance to build trust (clients will know their MSP “has their back” on more than just tech). [deskday.com]
6. Driving Efficiency with Process Automation
Operational efficiency is the backbone of MSP profitability and service quality. Yet, many MSPs today are held back by inefficient, manual processes, which translates into slower service for clients and squeezed margins for the MSP. What’s not working: Despite great advancements in management tools, surveys reveal that MSP teams still spend excessive time on low-value, repetitive tasks. For example, one study found MSP staff spend over 100 hours per month on manual chores like re-entering ticket data between systems, preparing reports for QBRs, and reconciling billing—tasks that could be automated. In interviews, managers admitted that engineers spend “half their week” babysitting these processes instead of focusing on higher-level projects. There’s wide acknowledgment (95% of MSP leaders agree) that automation is required for growth, and that repetitive busywork is blocking strategic initiatives. However, most MSPs estimate they’ve automated fewer than 25% of their core workflows so far. The reasons cited include lack of time to set up automations, disparate tools that don’t talk to each other, and the complexity of custom scripting. This is a clear area where MSPs are not doing well enough currently – they know automation is key, but progress has been uneven and slow. [suppfusion.com]
Focus for 2026: The coming year should be when MSPs aggressively streamline and automate their operations. Efficiency isn’t just about saving money – it directly impacts customer satisfaction (faster, error-free service) and the MSP’s ability to scale without adding headcount. Here are key targets for automation:
Integrating Systems: A major source of inefficiency is when the PSA (professional services automation tool, for tickets/billing) doesn’t integrate with the RMM (remote monitoring and management) or other tools – technicians end up copying data from one system to another. In 2026, MSPs should ensure their core platforms are tightly integrated or consider moving to unified platforms. It’s telling that 95% of MSPs say integrating RMM, PSA, backup, and documentation tools is essential. For instance, if a monitoring alert can automatically generate a ticket in the PSA (with all relevant info attached), and that in turn updates documentation and billing records, it cuts out a lot of swivel-chair work. Many MSPs are pursuing tool consolidation – using fewer, more integrated tools – to achieve this. [kaseya.com][deskday.com]
Automating Routine Tasks: Every MSP has a set of mundane tasks that happen daily or weekly – applying patches, updating antivirus definitions, onboarding a new user account, checking backup status, etc. Scripting and RPA (Robotic Process Automation) can handle many of these. By 2026, MSPs should have automated patch management across client devices (with approvals for exceptions), scheduled scripts to resolve common alerts (e.g., auto-restart a service if it stops), and automatic user provisioning workflows (so when a client hires someone, the MSP’s system creates the necessary accounts and permissions through a predefined script). Many MSP tools come with automation capabilities that may be underutilized; now is the time to exploit them fully. As one industry CEO quipped, 2025 was the year of “we should automate that,” and 2026 is the year MSPs must do it – you can’t scale without automation. [provaltech.com]
Eliminating Duplicate Work in Client Reporting: As discussed in the CX section, account managers often spend hours collating data for client reports. Automating this reporting is a quick win. MSPs can set up their PSA or BI (business intelligence) tools to pull metrics (tickets resolved, SLA compliance, security events) and generate a polished report or dashboard with minimal human input. This might involve adopting a reporting tool or writing some integrations, but it pays off every quarter, and it allows account managers to spend time on analysis rather than assembly. Some MSPs are adopting client-facing dashboards that are always up-to-date, drastically reducing the need to manually build slide decks. [suppfusion.com]
Workflow Automation and AI Ops: Beyond individual tasks, MSPs should examine end-to-end workflows for automation opportunities. For instance, when a monitoring alert comes in (say CPU usage high on a server), a fully automated workflow might create a ticket, run a diagnostic script on the server, attach the results to the ticket, and if a simple threshold condition is met (like a runaway process), even attempt a remediation (kill or restart the process). If that fixes it, the system closes the ticket with notes; if not, it escalates to a human. Achieving such “self-healing” workflows is increasingly possible with AI Ops tools and advanced scripting. The concept of a “Zero-Touch MSP” – where AI handles 90% of tickets and routine changes – is on the horizon and some SMB-focused MSPs will start approaching that model by mastering their vendors’ automation features. [techaisle.com]
To get there, MSPs should overcome barriers by allocating time for automation projects (maybe dedicating a staff member a few hours a week to building automations) and leveraging community scripts and best practices. The new generation of MSP owners, often backed by private equity, are already pushing for this operational efficiency as a mandate. [suppfusion.com], [suppfusion.com]
Example Action – Automation:A 20-person MSP found its engineers were drowning in repetitive tasks and using 10+ different tools that didn’t sync well. In 2026, they embarked on an “Automation Sprint”: First, they consolidated from 3 separate monitoring and ticketing systems to a single unified platform to reduce context switching. Next, they identified the top 5 daily tasks that ate up engineer time – patching Windows, adding new Office365 accounts for clients, resetting passwords, updating tickets, and compiling monthly reports. They created scripts for each: patches now deploy automatically with reports of success/failure; a simple form was built for clients to request new accounts which triggers an automated user creation in all relevant systems; a self-service password reset tool was rolled out; ticket updates between their systems and a major client’s system were linked via API to stop double entry. They also set up a dashboard that pulls data from their PSA to auto-generate QBR slides. Over a few months, they measured a reduction of ~120 hours of busywork per month across the team. Technicians now spend those hours on project work and learning new skills, which benefits both the MSP and its clients through faster project delivery and more informed staff.[kaseya.com][suppfusion.com]
The lesson is clear: streamlining operations through automation is no longer optional. In 2026, the most successful MSPs will be those who have turned efficiency into a competitive advantage – enabling them to offer faster response times, more consistent service, and even innovative pricing models (because automation can reduce the cost to serve). Clients ultimately benefit from this through fewer errors and quicker service. As MSP commentary notes, the new wave of MSP leadership “expects operational efficiency and scalability” and will prioritize automation and data-driven processes to stay competitive. MSPs should do the same, treating automation not as a one-off project but as an ongoing discipline (continuously finding new ways to eliminate waste and streamline as tools evolve). [suppfusion.com]
7. Investing in Workforce Development and Talent
Behind every successful MSP is a skilled and motivated team. In 2026, human talent remains irreplaceable – even as AI and automation handle more tasks – because people drive the complex problem-solving, relationship management, and strategic planning that set top MSPs apart. The problem: The MSP industry is facing serious talent challenges. There’s a well-documented shortage of IT professionals, especially in high-demand areas like cybersecurity and cloud architecture. According to industry surveys, 52% of MSPs identify hiring and recruiting as their primary challenge, and 68% of IT leaders in MSPs struggle to find cloud and security expertise. The talent gap often forces MSPs to either overwork their existing staff or turn down business. Indeed, burnout is an issue: nearly 40% of MSP techs were working 50+ hour weeks in recent years and 59% had to work through holidays to keep up with workload. Such strain leads to high turnover, which creates a vicious cycle of understaffing. [deskday.com][kaseya.com]
Moreover, MSPs sometimes underinvest in training their staff. In the rush of daily operations, keeping engineers’ skillsets up-to-date (with new certifications or learning emerging technologies) can fall by the wayside. This leaves teams ill-prepared for new service offerings (like managing a new cloud platform or a new security tool) that clients might demand.
Focus for 2026: MSPs need a multi-pronged strategy to build and maintain a strong workforce, treating talent as a long-term investment:
Upskilling and Continuous Learning: Make 2026 the year your MSP implements a formal training program. This could include paying for certifications (e.g. Azure/AWS certifications, cybersecurity certs like CISSP, vendor-specific courses for popular tools). It might mean allocating each engineer a certain number of training hours per quarter that are sacrosanct. By upskilling existing employees, MSPs can fill skill gaps internally. For example, turning a good systems admin into a cloud architect through a structured learning path benefits the MSP far more than trying to hire a cloud architect in a tight market. As one MSP CEO advises, “the MSPs that grow will be the ones that develop the people they already have.”. Also, encourage knowledge sharing within the team (senior engineers mentoring juniors, internal workshops, etc.), which can accelerate learning and increase engagement. [provaltech.com]
Use External Support to Augment Staff: When hiring is tough, lean on creative solutions like outsourcing or partnerships. Many MSPs are turning to white-label service providers or contractors for certain functions – e.g. using an outsourced Network Operations Center (NOC) or Security Operations Center (SOC) service that operates under the MSP’s brand. This way, you can offer 24/7 coverage or specialized skills (like advanced cybersecurity analysis) without having to hire for every role. Notably, white-label partnerships have grown ~80% over three years in the MSP space. For an MSP, this could mean partnering with a third-party to handle after-hours support or level-1 tickets, relieving your core team at night. Or outsourcing complex tasks like mobile app support to a niche firm. The key is to convert fixed labor costs into flexible resources – scaling up when needed, scaling down when not, while your clients still experience a seamless service. In 2026, MSPs should evaluate which services are better done in-house versus through partners, and not be afraid to offload non-core or hard-to-hire areas. [deskday.com]
Improve Work-Life Balance and Retention: Recognize that burnout will cause you to lose the talent you have. MSP leadership should institute policies to protect their teams from perpetual overwork. This might involve hiring ahead of demand when possible, using automation (as above) to remove after-hours pager fatigue, and enforcing time-off so people can recharge. Flexible work arrangements (remote work options, which are common now) can help retain employees too. Additionally, create clear career paths within the MSP. One reason people leave is the feeling of stagnation; show your techs how they can progress to senior roles, lead specialist positions, or even vCIO-type consulting roles as they grow. Regular 1:1s discussing career goals and aligning training to those goals can improve morale and loyalty. [provaltech.com]
Leverage Vendor Training and Communities: Many tech vendors (Microsoft, Cisco, security vendors, etc.) offer extensive training resources for their partners. In the next year, make sure to tap into these vendor-backed training programs. For example, if a new security product is launched that you plan to offer, send engineers to the vendor’s certification course early. Encouraging staff to participate in MSP communities or events (like user groups, webinars, industry conferences) can also spark new ideas and professional growth, which they bring back to your business. The channel is expecting more vendor support in this area – so take advantage of it. [channele2e.com]
Example Action – Workforce:A growing MSP of 15 employees had trouble hiring senior cloud engineers in 2025. In 2026, they took a different approach: they identified two junior techs with interest in cloud and enrolled them in an accelerated Azure training program (funded by the MSP). Within months, those juniors earned certifications and started taking on cloud project work under supervision, filling much of the gap. To cover overnight shifts, the MSP contracted with a reputable NOC service that would handle alerts from midnight to 6 AM, so their on-call engineers could actually rest at night. They also instituted “Tech Fridays” – every second Friday afternoon, the company sets aside client work and all staff focus on learning: taking an online course, lab time, or sharing knowledge with peers. This became a valued perk and led to cross-training (e.g. the security specialist taught a class on advanced firewall management to others). By year-end, employee satisfaction (measured via survey) was up significantly, the MSP’s attrition dropped to near-zero, and their enhanced skills meant they could offer new services (like Azure database management) without external hires.
In summary, solving the talent puzzle is vital for 2026. MSPs should treat their employees as their greatest asset, because they are. A combination of developing internal talent, easing workloads through smart resourcing and automation, and fostering a positive work environment will pay dividends. Not only will this ensure you have the skills to deliver all the advanced services discussed (security, cloud, AI, etc.), but clients will notice stability and expertise in their interactions (frequent turnover or junior, untrained support is a red flag to many customers). Given the tight labor market, MSPs that invest in people will be the ones with the capacity to grow and innovate, whereas those that neglect it may find they can’t meet client needs or quality standards due to staffing shortfalls.
Conclusion: Succeeding in 2026 – From MSP to Business Partner
Entering 2026, MSPs globally – especially those catering to SMBs – must retool and refocus across these critical operational areas. The overarching theme is moving up the value chain: from putting out IT fires to delivering strategic prevention; from offering generic services to providing specialized, client-tailored solutions; from using people for every task to harnessing automation and AI for scalability. The challenges are real – cyber threats are more serious, technology is more complex, competition is fiercer, and clients are more demanding. But so are the opportunities: SMBs are investing heavily in technology and rely on MSPs more than ever for expertise. The MSPs that proactively improve in the areas discussed – security, cloud, AI, customer success, compliance, efficiency, and talent – will position themselves to capture this growth. [deskday.com]
It’s worth noting that in mature IT markets, clients now expect MSPs to behave almost like consulting partners with automation engines, blending advisory insight with flawless execution. This is a useful vision for 2026: an MSP that can talk business outcomes, ensure compliance and security, implement cutting-edge tech (cloud/AI) smoothly, and continually optimize its own operations behind the scenes. Achieving all of this at once is daunting, so MSPs should prioritize incrementally: for example, “secure first, automate second” – shoring up cybersecurity and compliance before layering fancy AI, since automation without security just accelerates risk. They should also pick a focus – mastering one vertical or technical specialty at a time – rather than try to do everything broadly. [deskday.com]
By addressing what is not being done well today and committing to these improvements, MSPs can transform their businesses in 2026. The payoff will be stronger customer relationships (and contract renewals), higher margins (through efficiency and premium services), and sustainable growth even in competitive markets. In contrast, MSPs that cling to the old break-fix, “one-size-fits-all” mindset will increasingly struggle – facing commoditization and client churn as they fail to meet rising standards. [deskday.com]
In conclusion, 2026 is set to be a pivotal year for the MSP industry. It will reward providers who are bold and strategic – those who invest in AI and automation, build deep security and compliance capabilities, tailor their services to client needs, and nurture talented teams. MSPs that embrace these changes will not just survive the evolving landscape, they will thrive as indispensable partners in their customers’ success. The blueprint is clear; now it’s about execution. As the industry saying goes, the MSPs who evolve will lead, and those who don’t will be left behind. By focusing on the areas outlined above, MSPs can ensure they are on the leading side of that equation in 2026.
In December 2025, Gartner issued an urgent advisory recommending that organizations “block all AI browsers for the foreseeable future” due to critical cybersecurity risks.AI browsers like Perplexity’s Comet and OpenAI’s ChatGPT Atlas introduce threats including irreversible data loss, prompt injection vulnerabilities, and unauthorized credential access.With 27.7% of organizations already having at least one user with an AI browser installed,the time to act is now. [computerworld.com]
This comprehensive guide provides step-by-step instructions for configuring Microsoft 365 Business Premium (M365 BP), specifically Microsoft Defender for Cloud Apps, to detect, monitor, and block AI-enabled browsers like Comet from accessing your enterprise resources.
Understanding the AI Browser Threat Landscape
Why AI Browsers Are Dangerous
According to Gartner analysts, “The real issue is that the loss of sensitive data to AI services can be irreversible and untraceable. Organizations may never recover lost data.” [computerworld.com]
Key Security Concerns:
Autonomous Actions Without Oversight – AI browsers can autonomously navigate websites, fill out forms, and complete transactions while authenticated, creating accountability concerns for erroneous or malicious actions [computerworld.com]
Traditional Controls Are Inadequate – “Traditional controls are inadequate for the new risks introduced by AI browsers, and solutions are only beginning to emerge,” according to Gartner’s senior director analyst Evgeny Mirolyubov [computerworld.com]
Multi-Modal Communication Gaps – A major gap exists in inspecting multi-modal communications with browsers, including voice commands to AI browsers [computerworld.com]
Immature Security Posture – Discovered vulnerabilities highlight broader concerns about the maturity of AI browser technology, with solutions likely taking “a matter of years rather than months” to mature [computerworld.com]
Navigate to Settings → Endpoints → Configuration Management
Go to Enforcement Scope → Network Protection
Verify status is set to “Block mode” (not just Audit mode)
Apply to All devices or specific device groups
Why This Matters: Network Protection ensures that blocks work across all browsers (Chrome, Firefox, etc.), not just Microsoft Edge. [wolkenman….dpress.com]
Phase 3: Unsanction and Block Comet Browser
Objective: Mark Comet and other AI browsers as unsanctioned to trigger automatic blocking.
Step 3.1: Search for Comet in Cloud App Catalog
Go to Cloud Apps → Cloud App Catalog
Use the search function to find “Comet” or “Perplexity”
Click on the application to review its risk assessment
Note: If Comet hasn’t been discovered yet in your environment, you can still add custom URLs for blocking (see Phase 6).
Step 3.2: Unsanction the Application
Click the three dots (⋮) at the end of the application row
Critical Note: Ensure the “Microsoft Defender for Cloud Apps – Session Controls” application is NOT blocked by other Conditional Access policies, or session controls will fail. [learn.microsoft.com]
Phase 5: Create Session Policies to Block AI Browser User Agents
Objective: Create real-time session policies that identify and block AI browsers based on user-agent strings and behavioral patterns.
Step 5.1: Create Access Policy for User-Agent Blocking
This is one of the most effective methods to block specific browsers like Comet. [securityhq.com]
Device type: (Optional) Apply to specific device types
Step 5.4: Create Custom User-Agent String Filters
While Defender for Cloud Apps doesn’t expose direct user-agent string matching in the UI by default, you can leverage activity filters: [securityhq.com]
Known AI Browser User-Agent Patterns to Block:
User-Agent patterns (Create separate policies or use contains logic):
- Contains "Comet"
- Contains "Perplexity"
- Contains "axios" (common in automated tools)
- Contains "ChatGPT" (for Atlas browser)
- Contains "AI-Browser"
- Contains "agentic"
Advanced Method – Using Session Policy with Inspection:
In Inspection method, configure content inspection rules
Step 5.5: Set Actions
Actions:
Select “Block”
Enable “Notify users” with custom message:
Access Denied: AI-Enabled Browser Detected
Your organization's security policy prohibits the use of AI-enabled browsers
(such as Comet, Atlas, or similar tools) to access corporate resources due to
data security and compliance requirements.
Please use Microsoft Edge, Chrome, or Firefox to access this resource.
If you believe this is an error, contact your IT helpdesk.
Step 5.6: Enable Governance Actions
Select “Send email to user”
Select “Alert severity” as High
Enable “Create an alert for each matching event”
Step 5.7: Activate the Policy
Review all settings
Click Create
Policy becomes active immediately
Monitor via Activity Log for matches
Phase 6: Block Comet Domains via Custom Indicators
Objective: Manually add Comet-related domains to Defender for Endpoint indicators for network-level blocking.
Step 6.1: Identify Comet-Related Domains
Based on Perplexity’s infrastructure, key domains include: [computerworld.com]
This site has been blocked by your organization
Microsoft Defender SmartScreen blocked this unsafe site
This web page was blocked by Microsoft Defender Application Control
perplexity.ai has been blocked by your IT administrator
Phase 7: Create Cloud Discovery Policies for Alerting
Objective: Set up automated alerts when AI browsers are detected in your environment.
Step 7.1: Create App Discovery Policy
Navigate to Cloud Apps → Policies → Policy Management
Users see warning message but can proceed (with logging)
Collect usage data for 2-4 weeks
Transition to Block mode after user education
Option 3: Scoped Blocking by Device Groups
Target specific departments first:
In Defender for Endpoint, create device groups:
Finance Team
Executive Leadership
High-Risk Departments
Apply indicators only to these groups initially
Expand gradually after validation
Option 4: DLP Integration for Data Leaving via AI Browsers
Even with blocks, ensure data leakage prevention:
Create Microsoft Purview DLP policies
Target “All locations” including endpoints
Configure rules to detect sensitive data:
Credit card numbers
Social Security numbers
Confidential project names
Block upload/sharing of sensitive content
Identifying Comet Browser Technical Indicators
User-Agent String Analysis
While official Comet user-agent strings aren’t publicly documented by Perplexity, AI browsers typically exhibit these patterns:
Common AI Browser User-Agent Characteristics:
Mozilla/5.0 (Platform) ... Comet/[version]
Mozilla/5.0 (Platform) ... Perplexity/[version]
Chromium-based with custom identifiers
May contain "AI", "Agent", "Agentic" in UA string
Detection Strategy:
Review Activity Log in Defender for Cloud Apps
Filter for unknown/suspicious user agents
Export activity data with user-agent strings
Analyze patterns using PowerShell or Excel
Update policies based on findings
Network Traffic Patterns
Comet communicates with Perplexity cloud infrastructure: [computerworld.com]
High-frequency API calls to api.perplexity.ai
WebSocket connections for real-time AI responses
Upload of page content and browsing context
Telemetry to Perplexity servers
Monitor via Defender for Cloud Apps:
Cloud Apps → Activity Log
Filter by IP address ranges (if known)
Look for unusual upload patterns
Troubleshooting Common Issues
Issue 1: Blocks Not Working in Chrome/Firefox
Symptom: Comet/Perplexity sites accessible in non-Edge browsers
Recommended Combination: Use Cloud Discovery + Unsanctioning AND Access Policies for comprehensive coverage.
Staying Current: Monitoring New AI Browsers
AI browsers are rapidly evolving. Stay ahead of threats:
Monthly Review Checklist
✅ Cloud App Catalog Updates
Review newly discovered apps in Generative AI category
Check for new AI Model Providers
Assess risk scores of emerging tools
✅ Threat Intelligence
Monitor Gartner reports on AI browser security [gartner.com]
Follow Microsoft Security Blog
Subscribe to CISA alerts
Track CVE databases for AI browser vulnerabilities
✅ Policy Effectiveness
Review blocked connection attempts
Analyze bypass attempts
Update user-agent filters
Refine domain lists
Emerging AI Browsers to Monitor
Beyond Comet and Atlas, watch for:
Brave Leo Browser (AI-enhanced features)
Opera One (integrated AI)
Arc Browser (with AI capabilities)
SigmaOS (AI-powered browsing)
Browser Company products
Compliance and Documentation
Required Documentation
Maintain these records for audit purposes:
Policy Documentation
Policy names, purposes, and justifications
Configuration settings and filters
Approval chains and stakeholder sign-offs
Change Log
Policy modifications
Domain additions/removals
Exception approvals
Incident Reports
Blocked access attempts
Policy violations
User complaints and resolutions
Risk Assessment
Why AI browsers are blocked
Business impact analysis
Alternative solutions provided to users
Regulatory Considerations
Consider these compliance frameworks:
Framework
Relevance
GDPR
Data processing outside organization control
HIPAA
Protected health information exfiltration risk
SOX
Financial data protection requirements
PCI DSS
Cardholder data security
NIST 800-53
Access control requirements
Conclusion: Taking Action Against AI Browser Risks
The threat posed by AI browsers like Perplexity’s Comet is real, immediate, and growing. With security experts uniformly recommending that organizations “block all AI browsers for the foreseeable future,”the time for action is now—not later. [pcmag.com], [gartner.com]
Key Takeaways:
Gartner’s Warning is Clear: AI browsers introduce “irreversible and untraceable” data loss risks that traditional controls cannot adequately mitigate [computerworld.com]
Multi-Layered Defense is Essential: Combining Cloud Discovery, Session Policies, Access Policies, and Network Protection provides comprehensive coverage
Microsoft 365 Business Premium Provides the Tools: With Defender for Cloud Apps and Defender for Endpoint, you have enterprise-grade capabilities to detect and block AI browsers
User Education is Critical: Technical controls must be paired with clear communication about why AI browsers pose risks and what alternatives are approved
Continuous Vigilance Required: The AI browser landscape evolves rapidly; monthly reviews of your defenses are essential [computerworld.com]
Immediate Action Steps
This Week:
✅ Enable Cloud Discovery and filter for Generative AI apps
✅ Review current AI browser usage in your organization
✅ Enable “Enforce App Access” in Defender for Cloud Apps
✅ Verify Network Protection is enabled in Defender for Endpoint
Next Week:
✅ Create Conditional Access policy routing traffic to MDCA
✅ Unsanction Comet and other AI browsers
✅ Create custom domain indicators for Perplexity infrastructure
✅ Deploy in Report-only mode for pilot group
Within 30 Days:
✅ Create Access Policies with user-agent filtering
Conditional Access is Microsoft’s Zero Trust policy engine that evaluates signals from users, devices, and locations to make automated access decisions and enforce organizational policies. Think of it as intelligent “if-then” statements: If a user wants to access a resource, then they must complete an action (like multifactor authentication).
For SMBs using Microsoft 365 Business Premium, Conditional Access provides enterprise-grade security without requiring complex infrastructure, protecting your organization from 99.9% of identity-based attacks.
Prerequisites
License Requirements: Microsoft 365 Business Premium (includes Entra ID P1) or Microsoft 365 E3/E5
Admin Role: Conditional Access Administrator or Global Administrator privileges
Preparation: Ensure all users have registered for MFA before implementing policies
Emergency Access Account: Create at least one break-glass account excluded from all policies
Phase 1: Initial Setup and Planning (Week 1)
Step 1: Turn Off Security Defaults
Navigate to Microsoft Entra admin center (entra.microsoft.com)
Go to Entra ID → Properties
Select Manage security defaults
Toggle Security defaults to Disabled
Select My organization is using Conditional Access as the reason
Click Save
Important: Only disable security defaults after you’re ready to create Conditional Access policies immediately.
Step 2: Create Emergency Access Accounts
Create two cloud-only accounts with complex passwords
Assign Global Administrator role to both accounts
Store credentials securely (separate locations)
Document these accounts for emergency use only
Exclude these accounts from ALL Conditional Access policies
Step 3: Access the Conditional Access Portal
Sign in to entra.microsoft.com
Navigate to Entra ID → Conditional Access
Select Policies to view the main dashboard
Phase 2: Create Baseline Policies (Week 1-2)
Policy 1: Require MFA for All Users
Click New policy from templates
Select Require multifactor authentication for all users template
Name your policy: “Baseline: MFA for All Users”
Under Assignments:
Users: All users
Exclude: Select your emergency access accounts
Under Target resources:
Select All resources (formerly ‘All cloud apps’)
Under Access controls → Grant:
Select Require multifactor authentication
Set Enable policy to Report-only
Click Create
Policy 2: Block Legacy Authentication
Click New policy from templates
Select Block legacy authentication template
Name your policy: “Security: Block Legacy Authentication”
Under Assignments:
Users: All users
Exclude: Emergency access accounts
Under Conditions → Client apps:
Configure: Yes
Select Exchange ActiveSync clients and Other clients
Under Access controls → Grant:
Select Block access
Set Enable policy to Report-only
Click Create
Policy 3: Require MFA for Administrators
Click New policy from templates
Select Require multifactor authentication for admins template
Name your policy: “Security: MFA for Admin Roles”
Under Assignments:
Users: Select users and groups
Select Directory roles
Choose all administrative roles
Exclude: Emergency access accounts
Under Access controls → Grant:
Select Require multifactor authentication
Set Enable policy to Report-only
Click Create
Phase 3: Testing and Validation (Week 2)
Step 1: Use the What If Tool
Navigate to Conditional Access → Policies → What If
Enter test scenarios:
Select a test user
Choose target applications
Set device platform and location
Click What If to see which policies would apply
Review both “Policies that will apply” and “Policies that will not apply”
Document results for each test scenario
Step 2: Monitor Report-Only Mode
Leave policies in Report-only mode for at least 7 days
Navigate to Entra ID → Sign-in logs
Filter by Conditional Access = Report-only
Review impacts:
Check for “Report-only: Success” entries
Investigate any “Report-only: Failure” entries
Look for “Report-only: User action required” entries
Address any issues before enforcement
Step 3: Pilot Testing
Create a pilot group with 5-10 users
Create a duplicate policy targeting only the pilot group
Set this pilot policy to On (enforced)
Monitor for 3-5 days
Gather feedback from pilot users
Address any issues identified
Phase 4: Production Deployment (Week 3)
Step 1: Enable Policies
After successful testing, return to each policy
Change Enable policy from Report-only to On
Start with one policy at a time
Wait 2-4 hours between enabling each policy
Monitor sign-in logs after each activation
Step 2: Communicate to Users
Send announcement email before enforcement
Include:
What’s changing and when
Why it’s important for security
What users need to do (register for MFA)
Support contact information
Provide MFA registration instructions
Schedule optional training sessions
Phase 5: Advanced Policies (Week 4+)
Optional: Require Compliant Devices
Only implement after basic policies are stable
Create new policy: “Security: Require Compliant Devices”
Small and medium businesses (SMBs) with remote employees have shifted from a single “office network” model to a Zero Trust model. Microsoft 365 Business Premium (BPP) already includes extensive security layers – identity protection, device management, email scanning, and endpoint defenselearn.microsoft.comlearn.microsoft.com. With those controls fully configured, the traditional on-premises network perimeter (and thus an expensive firewall appliance) becomes far less critical. In practice, a standard router/NAT firewall combined with Windows/macOS built‑in firewalls and M365’s cloud protections can cost‑effectively secure a remote SMB. We explain how M365 BPP’s features cover typical firewall functions, and when a dedicated firewall (beyond a basic one) may not be needed.
Built-In Security in Microsoft 365 Business Premium
Microsoft 365 Business Premium bundles multiple security layers: endpoint protection, identity/access controls, device management, and more. Key built‑in features include:
Endpoint Security – Microsoft Defender for Business (included) provides next‑gen antivirus, threat detection/response and a host firewall on each devicelearn.microsoft.comlearn.microsoft.com. Devices (Windows, macOS, iOS, Android) get managed protection against ransomware, malware and network attacks.
Email and App Protection – Defender for Office 365 Plan 1 (included) scans email attachments and links for malware and phishing. Safe Links/Safe Attachments help stop threats before they reach userslearn.microsoft.com.
Identity and Access (Zero Trust) – Azure AD Premium P1 (included) enables Conditional Access policies and mandatory multi-factor authenticationmicrosoft.comlearn.microsoft.com. Only compliant, enrolled devices can access company resources, and admins/devices are always re‑authenticated.
Device Management – Microsoft Intune can enforce security policies on all devices: requiring device encryption (BitLocker), patching, endpoint firewalls, and even configuring VPN or Wi‑Fi profileslearn.microsoft.comlearn.microsoft.com. In short, Intune ensures every device meets the company’s security baseline before it connects.
Secure Remote Access – Azure AD Application Proxy (via Azure AD P1) publishes any on‑premises app through Azure AD, so remote users can reach internal resources without opening inbound firewall portssherweb.com. This often replaces a VPN or on‑site reverse proxy, making remote access simpler and safer.
These built-in layers cover most attack vectors. For example, M365 BPP’s Defender for Business includes a managed host-based firewall and web filtering, so each laptop is protected on any networklearn.microsoft.com. And Conditional Access can block sign-ins from unsecured locations or unregistered devices, effectively extending the network perimeter to only trusted endpoints.
Zero Trust and Remote Work
In a modern SMB, employees “can work anywhere,” so the old model of trusting the office LAN no longer applies. As Microsoft describes, traditional protections rely on firewalls and VPNs at fixed locations, whereas Zero Trust assumes no network is inherently safelearn.microsoft.com. Every sign-in is verified (via Azure AD) and every device is checked (via Intune) no matter where the user is.
In this diagram, a corporate firewall on the left no longer suffices when employees roam (right side)learn.microsoft.com. With Business Premium, identity and device policies take over: multifactor authentication and Conditional Access ensure only known users on compliant devices connectlearn.microsoft.commicrosoft.com. In effect, the organization’s “perimeter” is the cloud. Remote workers authenticate directly to Azure/Office 365 and receive Microsoft’s protection (e.g. encrypted tunnels, safe browser checks), rather than passing first through an on‑site firewall.
Host-Based Firewalls and Device Security
Even without a hardware firewall, devices must protect themselves on untrusted networks. All common operating systems include a built‑in firewall. Enabling these host firewalls is free and highly effective – many MSP guides advise turning on Windows Defender Firewall (and macOS’s) on every device before even buying a hardware applianceguardianangelit.com. Microsoft Defender for Business not only installs antivirus but can manage each device’s firewall settings: for instance, Intune can push a profile that blocks all inbound traffic except essential serviceslearn.microsoft.com.
By treating each endpoint as its own secured “network edge,” an SMB covers the user’s connection in coffee shops or home Wi‑Fi. For example, if a user’s laptop is on public Wi‑Fi, the Windows firewall (enforced by Defender policies) stops inbound attacks, while Defender’s web protection filters malicious sites. This layered endpoint approach (antivirus+EDR + host firewall + encrypted disk) significantly shrinks the need for a central firewall inspecting all traffic.
Network Perimeter and When to Use Firewalls
If an SMB still maintains an office or data closet, some firewall or router will normally be used for basic perimeter functions (NAT, DHCP, segmentation of guest networks, etc.). However, the level of firewall needed is typically minimal. A basic managed router or inexpensive UTM is often enough to separate IoT/guest Wi-Fi from internal staff, and to enforce outbound rules. Beyond that, heavy enterprise firewalls yield little benefit in a predominantly cloud-centric setup.
For remote-heavy SMBs, many experts suggest zero-trust access (e.g. VPN, ZTNA) instead of relying on office hardware. ControlD’s SMB security checklist, for instance, recommends ensuring VPN or Zero-Trust Network Access for remote employees, rather than expecting them to route through the office firewallcontrold.com. In other words, with cloud apps and M365-managed devices, the on‑site firewall sees only its local subnet – almost all work and threats are already handled by Microsoft’s cloud services and endpoint defenses.
Configuring M365 Business Premium as Your “Firewall”
A Business Premium tenant can be tuned to cover typical firewall functions:
Enroll and Update All Devices: Use Intune (part of BPP) to enroll every company device (Windows, Mac, mobile) and onboard them to Defender for Businesslearn.microsoft.comlearn.microsoft.com. Ensure full disk encryption (BitLocker/FileVault), automatic OS updates, and Defender real‑time protection are all enabled.
Enforce Host Firewalls: Create an Intune endpoint security policy that turns on Windows Defender Firewall for all profiles (Domain/Private/Public) and disables unnecessary inbound rulesguardianangelit.comlearn.microsoft.com. Similarly, enable the macOS firewall via Intune configuration. This ensures devices block unwanted network traffic by default.
Enable Multi-Factor Authentication & Conditional Access: Turn on Azure AD security defaults or define Conditional Access policies so that every login requires MFA and checks device compliancelearn.microsoft.commicrosoft.com. You can restrict access by device state or location, preventing unknown devices from even reaching company apps.
Protect Email and Apps: Activate Defender for Office 365 (Plan 1) to scan all incoming email and Teams messages. Safe Links/Attachments in Office documents serve as an additional layer that no firewall can providelearn.microsoft.com.
Use Application Proxy for Internal Apps: If you have any on-premises servers, install the Azure AD Application Proxy connector. This publishes apps (e.g. intranet, CRM) through Azure without punching holes in your firewallsherweb.com. Remote users then access the app via Azure AD login, with no need to maintain a VPN or open router ports.
Monitor and Respond: Use Microsoft 365 Defender’s security portal (included) to monitor alerts. Its threat analytics will flag unusual traffic or sign-ins. Automated investigation and remediation in Defender for Business can contain a threat on a device before it spreads.
Network-Level Protections (Optional): For extra DNS- or web-filtering, an SMB might add services like Microsoft Defender SmartScreen (built into Edge/Windows) or a cloud DNS filter. These complement – but don’t replace – the firewall; they block malicious domains at the device level.
In this configuration, each device and identity becomes a control point. The M365 stack effectively sits in front of your data, rather than hardware at the network perimeter.
Cost vs. Benefit of Dedicated Firewalls
Without regulatory mandates, a high-end firewall appliance is often not cost-justified for an SMB fully on M365. The hardware itself and ongoing subscriptions (threat feeds, VPN licenses, maintenance) add significant cost. Given that M365 Business Premium already provides next-generation protection on endpoints and enforces secure access, the marginal security gain from a $2k+ firewall is small for remote-centric SMBs.
That said, a simple firewall/router is still recommended for the office LAN. It can provide:
Basic NAT/segmentation: Separating staff devices from guest or IoT VLANs.
VPN termination (if needed): A site‑to‑site VPN or point‑to‑site gateway for branch offices or legacy systems (though Azure VPN with Azure AD is an alternative).
On‑prem device connectivity: If on-premises servers exist, the firewall can regulate incoming traffic.
For example, installing Azure AD Application Proxy (no cost beyond BPP license) often removes the need to expose an on‑site port for remote accesssherweb.com. Similarly, if home users connect via secure VPN with M365 credentials, the corporate firewall is bypassed by design.
In contrast, host-based security and cloud controls cover most threats: phishing and remote intrusion are handled by Defender and MFA, malware is stopped at the device, and data exfiltration is controlled by identity and DLP settings. As one MSP guide notes, for small businesses the built-in OS firewalls should be used before investing in hardware firewallsguardianangelit.com. In practice, the total protective overlap from Intune+Defender+Conditional Access can eliminate many risks that a hardware firewall is meant to address.
Conclusion
For a typical SMB with Microsoft 365 Business Premium fully enabled, the need for an expensive dedicated firewall is greatly reduced. M365 BPP delivers comprehensive security – endpoint protection, email filters, and zero-trust access – that, when properly configured, cover most attack vectorslearn.microsoft.comlearn.microsoft.com. A basic network firewall (even the one built into a router) is useful for simple segmentation, but beyond that most protections are handled by Microsoft’s cloud services and host firewalls. In short, by leveraging Business Premium’s features (Defender, Intune, Azure AD P1, etc.), an SMB can safely rely on default and cloud-managed defenses rather than purchasing a high-end firewall applianceguardianangelit.comsherweb.com.
Microsoft Defender for Business is a security solution designed for small and medium businesses to protect against cyber threats. When issues arise, a systematic troubleshooting approach helps identify root causes and resolve problems efficiently. This guide provides a step-by-step process to troubleshoot common Defender for Business issues, highlights where to find relevant logs and alerts, and suggests advanced techniques for complex situations. All steps are factual and based on Microsoft’s latest guidance as of 2025.
These are some typical problems administrators encounter with Defender for Business:
Setup and Onboarding Failures: The initial setup or device onboarding process fails. An error like “Something went wrong, and we couldn’t complete your setup” may appear, indicating a configuration channel or integration issue (often with Intune)[1]. Devices that should be onboarded don’t show up in the portal.
Devices Showing As Unprotected: In the Microsoft Defender portal, you might see notifications that certain devices are not protected even though they were onboarded[1]. This often happens when real-time protection is turned off (for instance, if a non-Microsoft antivirus is running, it may disable Microsoft Defender’s real-time protection).
Mobile Device Onboarding Issues: Users cannot onboard their iOS or Android devices using the Microsoft Defender app. A symptom is that mobile enrollment doesn’t complete, possibly due to provisioning not finished on the backend[1]. For example, if the portal shows a message “Hang on! We’re preparing new spaces for your data…”, it means the Defender for Business service is still provisioning mobile support (which can take up to 24 hours) and devices cannot be added until provisioning is complete[1].
Defender App Errors on Mobile: The Microsoft Defender app on mobile devices may crash or show errors. Users report issues like app not updating threats or not connecting. (Microsoft provides separate troubleshooting guides for the mobile Defender for Endpoint app on Android/iOS in such cases[1].)
Policy Conflicts: If you have multiple security management tools, you might see conflicting policies. For instance, an admin who was managing devices via Intune and then enabled Defender for Business’s simplified configuration could encounter conflicts where settings in Intune and Defender for Business overlap or contradict[1]. This can result in devices flipping between policy states or compliance errors.
Intune Integration Errors: During the setup process, an error indicating an integration issue between Defender for Business and Microsoft Intune might occur[1]. This often requires enabling certain settings (detailed in Step 5 below) to establish a proper configuration channel.
Onboarding or Reporting Delays: A device appears to onboard successfully but doesn’t show up in the portal or is missing from the device list even after some time. This could indicate a communication issue where the device is not reporting in. It might be caused by connectivity problems or by an issue with the Microsoft Defender for Endpoint service (sensor) on the device.
Performance or Scan Issues: (Less common with Defender for Business, but possible) – Devices might experience high CPU or scans get stuck, which could indicate an issue with Defender Antivirus on the endpoint that needs further diagnosis (this overlaps with Defender for Endpoint troubleshooting).
Understanding which of these scenarios matches your situation will guide where to look first. Next, we’ll cover where to find the logs and alerts that contain clues for diagnosis.
Key Locations for Logs and Alerts
Effective troubleshooting relies on checking both cloud portal alerts and on-device logs. Microsoft Defender for Business provides information in multiple places:
Microsoft 365 Defender Portal (security.microsoft.com): This is the cloud portal where Defender for Business is managed. The Incidents & alerts section is especially important. Here you can monitor all security incidents and alerts in one place[2]. For each alert, you can click to see details in a flyout pane – including the alert title, severity, affected assets (devices or users), and timestamps[2]. The portal often provides recommended actions or one-click remediation for certain alerts[2]. It’s the first place to check if you suspect Defender is detecting threats or if something triggered an alert that correlates with the issue.
Device Logs via Windows Event Viewer: On each Windows device protected by Defender for Business, Windows keeps local event logs for Defender components. Access these by opening Event Viewer (Start > eventvwr.msc). Key logs include:
Microsoft-Windows-SENSE/Operational – This log records events from the Defender for Endpoint sensor (“SENSE” is the internal code name for the sensor)[3]. If a device isn’t showing up in the portal or has onboarding issues, this log is crucial. It contains events for service start/stop, onboarding success/failure, and connectivity to the cloud. For example, Event ID 6 means the service isn’t onboarded (no onboarding info found), which indicates the device failed to onboard and needs the onboarding script rerun[3]. Event ID 3 means the service failed to start entirely[3], and Event ID 5 means it couldn’t connect to the cloud (network issue)[3]. We will discuss how to interpret and act on these later.
Windows Defender/Operational – This is the standard Windows Defender Antivirus log under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational. It logs malware detections and actions taken on the device[4]. For troubleshooting, this log is helpful if you suspect Defender’s real-time protection or scans are causing an issue or to confirm if a threat was detected on a device. You might see events like “Malware detected” (Event ID 1116) or “Malware action taken” (Event ID 1117) which correspond to threats found and actions (like quarantine) taken[4]. This can explain, for instance, if a file was blocked and that’s impacting a user’s work.
Other system logs: Standard Windows logs (System, Application) might also record errors (for example, if a service fails or crashes, or if there are network connectivity issues that could affect Defender).
Alerts in Microsoft 365 Defender: Defender for Business surfaces alerts in the portal for various issues, not only malware. For example, if real-time protection is turned off on a device, the portal will flag that device as not fully protected[1]. If a device hasn’t reported in for a long time, it might show in the device inventory with a stale last-seen timestamp. Additionally, if an advanced attack is detected, multiple alerts will be correlated as an incident; an incident might be tagged with “Attack disruption” if Defender automatically contained devices to stop the spread[2] – such context can validate if an ongoing security issue is causing what you’re observing.
Intune or Endpoint Manager (if applicable): Since Defender for Business can integrate with Intune (Endpoint Manager) for device management and policy deployment, some issues (especially around onboarding and policy conflicts) may require checking Intune logs:
In Intune admin center, review the device’s Enrollment status and Device configuration profiles (for instance, if a security profile failed to apply, it could cause Defender settings to not take effect).
Intune’s Troubleshooting + support blade for a device can show error codes if a policy (like onboarding profile) failed.
If there’s a known integration issue (like the one mentioned earlier), ensure the Intune connection and settings are enabled as described in the next sections.
Advanced Hunting and Audit (for advanced users): If you have access to Microsoft 365 Defender’s advanced hunting (which might require an upgraded license beyond Defender for Business’s standard features), you could query logs (e.g., DeviceEvents, AlertEvents) for deeper investigation. Also, the Audit Logs in the Defender portal record configuration changes (useful to see if someone changed a policy right before issues started).
Now, with an understanding of where to get information, let’s proceed with a systematic troubleshooting process.
Step-by-Step Troubleshooting Process
The following steps outline a logical process to troubleshoot issues in Microsoft Defender for Business. Adjust the steps as needed based on the specific symptoms you are encountering.
Step 1: Identify the Issue and Gather Information
Before jumping into configuration changes, clearly define the problem. Understanding the nature of the issue will focus your investigation:
What are the symptoms? For example, “Device X is not appearing in the Defender portal”, “Users are getting no protection on their phones”, or “We see an alert that one device isn’t protected”, etc.
When did it start? Did it coincide with any changes (onboarding new devices, changing policies, installing another antivirus, etc.)?
Who or what is affected? A single device, multiple devices, all mobile devices, a specific user?
Any error messages? Note any message in the portal or on the device. For instance, an error code during setup, or the portal banner saying “some devices aren’t protected”[1]. These messages often hint at the cause.
Gathering this context will guide you on where to look first. For example, an issue with one device might mean checking that device’s status and logs, whereas a widespread issue might suggest a configuration problem affecting many devices.
Step 2: Check the Microsoft 365 Defender Portal for Alerts
Log in to the Microsoft 365 Defender portal (https://security.microsoft.com) with appropriate admin credentials. This centralized portal often surfaces the problem:
Go to Incidents & alerts: In the left navigation pane, click “Incidents & alerts”, then select “Alerts” (or “Incidents” for grouped alerts)[2]. Look for any recent alerts that correspond to your issue. For example, if a device isn’t protected or hasn’t reported, there may be an alert about that device.
Review alert details: If you see relevant alerts, click on one to open the details flyout. Check the alert title and description – these describe what triggered it (e.g. “Real-time protection disabled on Device123” or “Malware detected and quarantined”). Note the severity (Informational, Low, Medium, High) and the affected device or user[2]. The portal will list the device name and perhaps the user associated with it.
Take recommended actions: The alert flyout often includes recommended actions or a direct link to “Open incident page” or “Take action”. For instance, for a malware alert, it may suggest running a scan or isolating the device. For a configuration alert (like real-time protection off), it might recommend turning it back on. Make note of these suggestions as they directly address the issue described[2].
Check the device inventory: Still in the Defender portal, navigate to Devices (under Assets). Find the device in question. The device page can show its onboarding status, last seen time, OS, and any outstanding issues. If the device is missing entirely, that confirms an onboarding problem – skip to Step 4 to troubleshoot that.
**Inspect *Incidents***: If multiple alerts have been triggered around the same time or on the same device, the portal might have grouped them into an *Incident* (visible under the Incidents tab). Open the incident to see a timeline of what happened. This can give a broader context especially if a security threat is involved (e.g. an incident might show that a malware was detected and then real-time protection was turned off – indicating the malware might have attempted to disable Defender).
Example: Suppose the portal shows an alert “Real-time protection was turned off on DeviceXYZ”. This is a clear indicator – the device is onboarded but not actively protecting in real-time[1]. The recommended action would likely be to turn real-time protection back on. Alternatively, if an alert says “New malware found on DeviceXYZ”, you’d know the issue is a threat detection, and the portal might guide you to remediate or confirm that malware was handled. In both cases, you’ve gathered an essential clue before even touching the device.
If you do not see any alert or indicator in the portal related to your problem, the issue might not be something Defender is reporting on (for example, if the problem is an onboarding failure, there may not be an alert – the device just isn’t present at all). In such cases, proceed to the next steps.
Step 3: Verify Device Status and Protection Settings
Next, ensure that the devices in question are configured correctly and not in a state that would cause issues:
Confirm onboarding completion: If a device doesn’t appear in the portal’s device list, ensure that the onboarding process was done on that device. Re-run the onboarding script or package on the device if needed. (Defender for Business devices are typically onboarded via the local script, Intune, Group Policy, etc. If this step wasn’t done or failed, the device won’t show up in the portal.)
Check provisioning status for mobile: If the issue is with mobile devices (Android/iOS) not onboarding, verify that Defender for Business provisioning is complete. As mentioned, the portal (under Devices) might show a message “preparing new spaces for your data” if the service setup is still ongoing[1]. Provisioning can take up to 24 hours for a new tenant. If you see that message, the best course is to wait until it disappears (i.e., until provisioning finishes) before troubleshooting further. Once provisioning is done, the portal will prompt to onboard devices, and then users should be able to add their mobile devices normally[1].
Verify real-time protection setting: On any Windows device showing “not protected” in the portal, log onto that device and open Windows Security > Virus & threat protection. Check if Real-time protection is on. If it’s off and cannot be turned on, check if another antivirus is installed. By design, onboarding a device running a third-party AV can cause Defender’s real-time protection to be automatically disabled to avoid conflict[1]. In Defender for Business, Microsoft expects Defender Antivirus to be active alongside the service for best protection (“better together” scenario)[1]. If a third-party AV is present, decide if you will remove it or live with Defender in passive mode (which reduces protection and triggers those alerts). Ideally, ensure Microsoft Defender Antivirus is enabled.
Policy configuration review: If you suspect a policy conflict or misconfiguration, review the policies applied:
In the Microsoft 365 Defender portal, go to Endpoints > Settings > Rules & policies (or in Intune’s Endpoint security if that’s used). Ensure that you haven’t defined contradictory policies in multiple places. For example, if Intune had a policy disabling something but Defender for Business’s simplified setup has another setting, prefer one system. In a known scenario, an admin had Intune policies and then used the simplified Defender for Business policies concurrently, leading to conflicts[1]. The resolution was to delete or turn off the redundant policies in Intune and let Defender for Business policies take precedence (or vice versa) to eliminate conflicts[1].
Also verify tamper protection status – by default, tamper protection is on (preventing unauthorized changes to Defender settings). If someone turned it off for troubleshooting and forgot to re-enable, settings could be changed without notice.
Intune onboarding profile (if applicable): If devices were onboarded via Intune (which should be the case if you connected Defender for Business with Intune), check the Endpoint security > Microsoft Defender for Endpoint section in Intune. Ensure there’s an onboarding profile and that those devices show as onboarded. If a device is stuck in a pending state, you may need to re-enroll or manually onboard.
By verifying these settings, you either fix simple oversights (like turning real-time protection back on) or gather evidence of a deeper issue (for example, confirming a device is properly onboarded, yet still not visible, implying a reporting issue, or confirming there’s a policy conflict that needs resolution in the next step).
Step 4: Examine Device Logs (Event Viewer)
If the issue is not yet resolved by the above steps, or if you need more insight into why something is wrong, dive into the device’s event logs for Microsoft Defender. Perform these checks on an affected device (or a sample of affected devices if multiple):
Open Event Viewer (Local logs): On the Windows device, press Win + R, type eventvwr.msc and hit Enter. Navigate to Applications and Services Logs > Microsoft > Windows and scroll through the sub-folders.
Check “SENSE” Operational log: Locate Microsoft > Windows > SENSE > Operational and click it to open the Microsoft Defender for Endpoint service log[3]. Look for recent Error or Warning events in the list:
Event ID 3: “Microsoft Defender for Endpoint service failed to start.” This means the sensor service didn’t fully start on boot[3]. Check if the Sense service is running (in Services.msc). If not, an OS issue or missing prerequisites might be at fault.
Event ID 5: “Failed to connect to the server at \.” This indicates the endpoint could not reach the Defender cloud service URLs[3]. This can be a network or proxy issue – ensure the device has internet access and that security.microsoft.com and related endpoints are not blocked by firewall or proxy.
Event ID 6: “Service isn’t onboarded and no onboarding parameters were found.” This tells us the device never got the onboarding info – effectively it’s not onboarded in the service[3]. Possibly the onboarding script never ran successfully. Solution: rerun onboarding and ensure it completes (the event will change to ID 11 on success).
Event ID 7: “Service failed to read onboarding parameters”[3] – similar to ID 6, means something went wrong reading the config. Redeploy the onboarding package.
Other SENSE events might point to registry permission issues or feature missing (e.g., Event ID 15 could mean the SENSE service couldn’t start due to ELAM driver off or missing components – those cases are rare on modern systems, but the event description will usually suggest enabling a feature or a Windows update[5][5]).
Each event has a description. Compare the event’s description against Microsoft’s documentation for Defender for Endpoint event IDs to get specific guidance[3][3]. Many event descriptions (like examples above) already hint at the resolution (e.g., check connectivity, redeploy scripts, etc.).
Check “Windows Defender” Operational log: Next, open Microsoft > Windows > Windows Defender > Operational. Look for recent entries, especially around the time the issue occurred:
If the issue is related to threat detection or a failed update, you might see events in the 1000-2000 range (these correspond to malware detection events and update events).
For example, Event ID 1116 (MALWAREPROTECTION_STATE_MALWARE_DETECTED) means malware was detected, and ID 1117 means an action was taken on malware[4]. These confirm whether Defender actually caught something malicious, which might have triggered further issues.
You might also see events indicating if the user or admin turned settings off. Event ID 5001-5004 range often relates to settings changes (like if real-time protection was disabled, it might log an event).
The Windows Defender log is more about security events than errors; if your problem is purely a configuration or onboarding issue, this log might not show anything unusual. But it’s useful to confirm if, say, Defender is working up to the point of detecting threats or if it’s completely silent (which could mean it’s not running at all on that device).
Additional log locations: If troubleshooting a device connectivity or performance issue, also check the System log in Event Viewer for any relevant entries (e.g., Service Control Manager errors if the Defender service failed repeatedly). Also, the Security log might show Audit failures if, for example, Defender attempted an action.
Analyze patterns: If multiple devices have issues, compare logs. Are they all failing to contact the service (Event ID 5)? That could point to a common network issue. Are they all showing not onboarded (ID 6/7)? Maybe the onboarding instruction wasn’t applied to that group of devices or a script was misconfigured.
By scrutinizing Event Viewer, you gather concrete evidence of what’s happening at the device level. For instance, you might confirm “Device A isn’t in the portal because it has been failing to reach the Defender service due to proxy errors – as Event ID 5 shows.” Or “Device B had an event indicating onboarding never completed (Event 6), explaining why it’s missing from portal – need to re-onboard.” This will directly inform the fix.
Step 5: Resolve Configuration or Policy Issues
Armed with the information from the portal (Step 2), settings review (Step 3), and device logs (Step 4), you can now take targeted actions to fix the issue.
Depending on what you found, apply the relevant resolution below:
If Real-Time Protection Was Off: Re-enable it. In the Defender portal, ensure that your Next-generation protection policy has Real-time protection set to On. If a third-party antivirus is present and you want Defender active, consider uninstalling the third-party AV or check if it’s possible to run them side by side. Microsoft recommends using Defender AV alongside Defender for Business for optimal protection[1]. Once real-time protection is on, the portal should update and the “not protected” alert will clear.
If Devices Weren’t Onboarded Successfully: Re-initiate the onboarding:
For devices managed by Intune, you can trigger a re-enrollment or use the onboarding package again via a script/live response.
If using local scripts, run the onboarding script as Administrator on the PC. After running, check Event Viewer again for Event ID 11 (“Onboarding completed”)[3].
For any devices still not appearing, consider running the Microsoft Defender for Endpoint Client Analyzer on those machines – it’s a diagnostic tool that can identify issues (discussed in Advanced section).
If Event Logs Show Connectivity Errors (ID 5, 15): Ensure the device has internet access to Defender endpoints. Make sure no firewall is blocking:
URLs like *.security.microsoft.com, *windows.com related to Defender cloud. Proxy settings might need to allow the Defender service through. See Microsoft’s documentation on Defender for Endpoint network connections for required URLs.
After adjusting network settings, force the device to check in (you can reboot the device or restart the Sense service and watch Event Viewer to see if it connects successfully).
If Policy Conflicts are Detected: Decide on one policy source:
Option 1: Use Defender for Business’s simplified configuration exclusively. This means removing or disabling parallel Intune endpoint security policies that configure AV or Firewall or Device Security, to avoid overlap[1].
Option 2: Use Intune (Endpoint Manager) for all device security policies and avoid using the simplified settings in Defender for Business. In this case, go to the Defender portal settings and turn off the features you are managing elsewhere.
In practice, if you saw conflicts, a quick remedy is to delete duplicate policies. For example, if Intune had an Antivirus policy and Defender for Business also has one, pick one to keep. Microsoft’s guidance for a situation where an admin uses both was to delete existing Intune policies to resolve conflicts[1].
After aligning policies, give it some time for devices to update their policy and then check if the conflict alerts disappear.
If Integration with Intune Failed (Setup Error): Follow Microsoft’s recommended fix which involves three steps[1][1]:
In the Defender for Business portal, go to Settings > Endpoints > Advanced Features and ensure Microsoft Intune connection is toggled On[1].
Still under Settings > Endpoints, find Configuration management > Enforcement scope. Make sure Windows devices are selected to be managed by Defender for Endpoint (Defender for Business)[1]. This allows Defender to actually enforce policies on Windows clients.
In the Intune (Microsoft Endpoint Manager) portal, navigate to Endpoint security > Microsoft Defender for Endpoint. Enable the setting “Allow Microsoft Defender for Endpoint to enforce Endpoint Security Configurations” (set to On)[1]. This allows Intune to hand off certain security configuration enforcement to Defender for Business’s authority. These steps establish the necessary channels so that Defender for Business and Intune work in harmony. After doing this, retry the setup or onboarding that failed. The previous error message about the configuration channel should not recur.
If Onboarding Still Fails or Device Shows Errors: If after trying to onboard, the device still logs errors like Event 7 or 15 indicating issues, consider these:
Run the onboarding with local admin rights (ensure no permission issues).
Update the device’s Windows to latest patches (sometimes older Windows builds have known issues resolved in updates).
As a last resort, you can try an alternate onboarding method (e.g., if script fails, try via Group Policy or vice versa).
Microsoft also suggests if Security Management (the feature that allows Defender for Business to manage devices without full Intune enrollment) is causing trouble, you can temporarily manually onboard the device to the full Defender for Endpoint service using a local script as a workaround[1]. Then offboard and try again once conditions are corrected.
If a Threat Was Detected (Malware Incident): Ensure it’s fully remediated:
In the portal, check the Action Center (there is an Action center in Defender portal under “Actions & submissions”) to see if there are pending remediation actions (like undo quarantine, etc.).
Run a full scan on the device through the portal or locally.
Once threats are removed, verify if any residual impact remains (e.g., sometimes malware can turn off services – ensure the Windows Security app shows all green).
Perform the relevant fixes and monitor the outcome. Many changes (policy changes, enabling features) may take effect within minutes, but some might take an hour or more to propagate to all devices. You can speed up policy application by instructing devices to sync with Intune (if managed) or simply rebooting them.
Step 6: Verify Issue Resolution
After applying fixes, confirm that the issue is resolved:
Check the portal again: Go back to the Microsoft 365 Defender portal’s Incidents & alerts and Devices pages.
If there was an alert (e.g., device not protected), it should now clear or show as Resolved. Many alerts auto-resolve once the condition is fixed (for instance, turning real-time protection on will clear that alert after the next device check-in).
If you removed conflicts or fixed onboarding, any incident or alert about those should disappear. The device should now appear in the Devices list if it was missing, and its status should be healthy (no warnings).
If a malware incident was being shown, ensure it’s marked Remediated or Mitigated. You might need to mark it as resolved if it doesn’t automatically.
Confirm on the device: For device-specific issues, physically check the device:
Open Windows Security and verify no warning icons are present.
In Event Viewer, see if new events are positive. For example, Event ID 11 in SENSE log (“Onboarding completed”) confirms success[3]. Or Event ID 1122 in Windows Defender log might show a threat was removed.
If you restarted services or the system, ensure they stay running (the Sense service should be running and set to automatic).
Test functionality: Perform a quick test relevant to the issue:
If mobile devices couldn’t onboard, try onboarding one now that provisioning is fixed.
If real-time protection was off, intentionally place a test EICAR anti-malware file on the machine to see if Defender catches it (it should, if real-time protection is truly working).
If devices were not reporting, force a machine to check in (by running MpCmdRun -SignatureUpdate to also check connectivity).
These tests confirm that not only is the specific symptom gone, but the underlying protection is functioning as expected.
If everything looks good, congratulations – the immediate issue is resolved. Make sure to document what the cause was and how it was fixed, for future reference.
Step 7: Escalate to Advanced Troubleshooting if Needed
If the problem persists despite the above steps, or if logs are pointing to something unclear, it may require advanced troubleshooting:
Multiple attempts failed? For example, if a device still won’t onboard after trying everything, or an alert keeps returning with no obvious cause, then it’s time to dig deeper.
Use the Microsoft Defender Client Analyzer: Microsoft provides a Client Analyzer tool for Defender for Endpoint that collects extensive logs and configurations. In a Defender for Business context, you can run this tool via a Live Response session. Live Response is a feature that lets you run commands on a remote device from the Defender portal (available if the device is onboarded). You can upload the Client Analyzer scripts and execute them to gather a diagnostic package[6][6]. This package can highlight misconfigurations or environmental issues. For Windows, the script MDELiveAnalyzer.ps1 (and related modules like MDELiveAnalyzerAV.ps1 for AV-specific logs) will produce a zip file with results[6][6]. Review its findings for any errors (or provide it to Microsoft support).
Enable Troubleshooting Mode (if performance issue): If the issue is performance-related (e.g., you suspect Defender’s antivirus is causing an application to crash or high CPU), Microsoft Defender for Endpoint has a Troubleshooting mode that can temporarily relax certain protections for testing. This is more applicable to Defender for Endpoint P2, but if accessible, enabling troubleshooting mode on a device allows you to see if the problem still occurs without certain protections, thereby identifying if Defender was the culprit. Remember to turn it off afterwards.
Consult Microsoft Documentation: Sometimes a specific error or event ID might be documented in Microsoft’s knowledge base. For instance, Microsoft has a page listing Defender Antivirus event IDs and common error codes – check those if you have a particular code.
Community and Support Forums: It can be useful to see if others have hit the same issue. The Microsoft Tech Community forums or sites like Reddit (e.g., r/DefenderATP) might have threads. (For example, missing incidents/alerts were discussed on forums and might simply be a UI issue or permission issue in some cases.)
Open a Support Case: When all else fails, engage Microsoft Support. Defender for Business is a paid service; you can open a ticket through your Microsoft 365 admin portal. Provide them with:
A description of the issue and steps you’ve taken.
Logs (Event Viewer exports, the Client Analyzer output).
Tenant ID and device details, if requested. Microsoft’s support can analyze backend data and guide further. They may identify if it’s a known bug or something environment-specific.
Escalating ensures that more complex or rare issues (like a service bug, or a weird compatibility issue) are handled by those with deeper insight or patching ability.
Advanced Troubleshooting Techniques
For administrators comfortable with deeper analysis, here are a few advanced techniques and tools to troubleshoot Defender for Business issues:
Advanced Hunting: This is a query-based hunting tool available in Microsoft 365 Defender. If your tenant has it, you can run Kusto-style queries to search for events. For example, to find all devices that had real-time protection off, you could query the DeviceHealthStatus table for that signal. Or search DeviceTimeline for specific event IDs across machines. It’s powerful for finding hidden patterns (like if a certain update caused multiple devices to onboard late or if a specific error code appears on many machines).
Audit Logs: Especially useful if the issue might be due to an admin change. The audit log will show events like policy changes, onboarding package generated, settings toggled, who did it and when. It helps answer “did anything change right before this issue?” For instance, if an admin offboarded devices by mistake, the audit log would show that.
Integrations and Log Forwarding: Many enterprises use a SIEM for unified logging. While Defender for Business is a more streamlined product, its data can be integrated into solutions like Sentinel (with some licensing caveats)[7]. Even without Sentinel, you could use Windows Event Forwarding to send important Defender events to a central server. That way, you can spot if all devices are throwing error X in their logs. This is beyond immediate troubleshooting, but helps in ongoing monitoring and advanced analysis.
Deep Configuration Checks: Sometimes group policies or registry values can interfere. Ensure no Group Policy is disabling Windows Defender (check Turn off Windows Defender Antivirus policy). Verify that the device’s time and region settings are correct (an odd one, but significant time skew can cause cloud communication issues).
Use Troubleshooting Mode: Microsoft introduced a troubleshooting mode for Defender which, when enabled on a device, disables certain protections for a short window so you can, for example, install software that was being blocked or see if performance improves. After testing, it auto-resets. This is advanced and should be used carefully, but it’s another tool in the toolbox.
Using these advanced techniques can provide deeper insights or confirm whether the issue lies within Defender for Business or outside of it (for example, a network device blocking traffic). Always ensure that after advanced troubleshooting, you return the system to a fully secured state (re-enable anything you turned off, etc.).
Best Practices to Prevent Future Issues
Prevention and proper management can reduce the likelihood of Defender for Business issues:
Keep Defender Components Updated: Microsoft Defender AV updates its engine and intelligence regularly (multiple times a day for threat definitions). Ensure your devices are getting these updates automatically (they usually do via Windows Update or Microsoft Update service). Also, keep the OS patched so that the Defender for Endpoint agent (built into Windows 10/11) is up-to-date. New updates often fix known bugs or improve stability.
Use a Single Source for Policy: Avoid mixing multiple security management platforms for the same settings. If you’re using Defender for Business’s built-in policies, try not to also set those via Intune or Group Policy. Conversely, if you require the advanced control of Intune, consider using Microsoft Defender for Endpoint Plan 1 or 2 with Intune instead of Defender for Business’s simplified model. Consistency prevents conflicts.
Monitor the Portal Regularly: Make it a routine to check the Defender portal’s dashboard or set up email notifications for high-severity alerts. Early detection of an issue (like devices being marked unhealthy or a series of failed updates) can let you address it before it becomes a larger problem.
Educate Users on Defender Apps: If your users install the Defender app on mobile, ensure they know how to keep it updated and what it should do. Sometimes user confusion (like ignoring the onboarding prompt or not granting the app permissions) can look like a “technical issue”. Provide a simple guide for them if needed.
Test Changes in a Pilot: If you plan to change configurations (e.g., enable a new attack surface reduction rule, or integrate with a new management tool), test with a small set of devices/users first. Make sure those pilot devices don’t report new issues before rolling out more broadly.
Use “Better Together” Features: Microsoft often touts “better together” benefits – for example, using Defender Antivirus with Defender for Business for coordinated protection[1]. Embrace these recommendations. Features like Automatic Attack Disruption will contain devices during a detected attack[2], but only if all parts of the stack are active. Understand what features are available in your SKU and use them; missing out on a feature could mean missing a warning sign that something’s wrong.
Maintain Proper Licensing: Defender for Business is targeted for up to 300 users. If your org grows or needs more advanced features, consider upgrading to Microsoft Defender for Endpoint plans. This ensures you’re not hitting any platform limits and you get features like advanced hunting, threat analytics, etc., which can actually make troubleshooting easier by providing more data.
Document and Share Knowledge: Keep an internal wiki or document for your IT team about past issues and fixes. For example, note down “In Aug 2025, devices had conflict because both Intune and Defender portal policies were applied – resolved by turning off Intune policy X.” This way, if something similar recurs or a new team member encounters it, the solution is readily available.
By following best practices, you reduce misconfigurations and are quicker to catch problems, making the overall experience with Microsoft Defender for Business smoother and more reliable.
Additional Resources and Support
For further information and help on Microsoft Defender for Business:
Official Microsoft Learn Documentation: Microsoft’s docs are very useful. The page “Microsoft Defender for Business troubleshooting” on Microsoft Learn covers many of the issues we discussed (setup failures, device protection, mobile onboarding, policy conflicts) with step-by-step guidance[1][1]. The “View and manage incidents in Defender for Business” page explains how to use the portal to handle alerts and incidents[2]. These should be your first reference for any new or unclear issues.
Microsoft Tech Community & Forums: The Defender for Business community forum is a great place to see if others have similar questions. Microsoft MVPs and engineers often post walkthroughs and answer questions. For example, blogs like Jeffrey Appel’s have detailed guides on Defender for Endpoint/Business features and troubleshooting (common deployment mistakes, troubleshooting modes, etc.)[8].
Support Tickets: As mentioned, don’t hesitate to use your support contract. Through the Microsoft 365 admin center, you can start a service request. Provide detailed info and severity (e.g., if a security feature is non-functional, treat it with high importance).
Training and Workshops: Microsoft occasionally offers workshops or webinars on their security products. These can provide deeper insight into using the product effectively (e.g., a session on “Managing alerts and incidents” or “Endpoint protection best practices”). Keep an eye on the Microsoft Security community for such opportunities.
Up-to-date Security Blog: Microsoft’s Security blog and announcements (for example, on the TechCommunity) can have news of new features or known issues. A recent blog might announce a new logging improvement or a known issue being fixed in the next update – which could be directly relevant to troubleshooting.
In summary, Microsoft Defender for Business is a powerful solution, and with the step-by-step approach above, you can systematically troubleshoot issues that come up. Starting from the portal’s alerts, verifying configurations, checking device logs, and then applying fixes will resolve most common problems. And for more complex cases, Microsoft’s support and documentation ecosystem is there to assist. By understanding where to find information (both in the product and in documentation), you’ll be well-equipped to keep your business devices secure and healthy.
