Managed Services Opportunities within Microsoft 365

I still regularly receive questions from independent IT consultants as well as Managed Services Providers about Microsoft 365 in relation to “regular maintenance” tasks and the like, which can be translated into Managed Services opportunity. Everyone intuitively understands that something like this is possible, but they do not know where to start, and how to connect the dots. Let’s see if we can remedy that here today.

Security is a major opportunity area

The largest opportunity, or one of the largest anyway, is around security. Contrary to popular belief, the cloud is not “Secure by Default.” It is as secure or unsecure as you are willing to make it (like any technology platform). Risk is something that can be accepted or reduced, as the customer sees fit (but most of them are woefully ignorant on this subject matter). To name just a few ways that you can offer valuable consulting and on-going services to customers:

Enable the Unified Audit Log and configure Alert policies to send notifications into your helpdesk or SOC when certain activities take place in the tenant; follow up with any (especially privileged actions) that appear suspicious or that you did not initiate or talk about with the customer in advance. Regularly validate that the unified audit log is still enabled and working (if I compromised an admin account in your tenant, disabling the unified audit log would be my very first move). Supported in all plans.

Take this even further with Microsoft Cloud App Security, which grants much more granular searching and policy building capabilities. Bonus: it can do the same for many third-party cloud products, too! This is an add-on for most plans but is included with E5 (and I recommend it highly).

Application Consent requests allow you to disable an end-user’s ability to freely approve their own software integrations and permissions with Microsoft 365. But when a request is made, you can get a notification and review their request in the admin portal–choosing to approve or deny the request based on your review and a policy or process that is determined in advance with the customer. Requires Azure AD Premium P1 (which is included with Microsoft 365 Business Premium)!

Regularly review security reports such as the reports in Office 365 ATP. As well, look at some of the Exchange Online auditing reports such as the non-owner mailbox access report and the administrator audit log, or review user submissions (if you have deployed the Report Message add-in). All plans, additional ATP reports with Office 365 ATP P1 / P2.

Use Secure Score (or an independent framework) to manage continuous improvement of the tenant posture, regularly bringing the next few recommended items to the customer: “What do you want to accomplish this quarter? Which risk should we work to reduce next?” All plans support this (but chasing the score will lead you to upgrade or add-on most likely).

Device management via Intune including inventory and control of hardware and software on Windows, Mac, Android and iOS devices. Regularly prune stale devices in Azure AD. Enable Conditional Access and review, on a regular basis, the devices with access to sensitive corporate data. You should aim for a plan that includes Intune such as Microsoft 365 Business Premium or higher.

Using Microsoft Threat Protection, including Microsoft Defender ATP, you can gain much better visibility as well as detection and response capabilities on the endpoints (which are often ground zero for cybersecurity incidents). This includes the ability to take responses such as isolate at-risk machines, proactively manage threats and vulnerabilities, perform threat hunting, and more. You may even consider shipping all the security data from Microsoft Threat Protection out to Azure Sentinel, a cloud-native SIEM, and fully managing Incident Response for customers (I wrote a whole book about this opportunity–check it out). MDATP is also an E5 feature, but is available as a standalone now as well, for use with any other subscription.

Compliance

There is probably even more room to explore here than I am presently aware of, but that is good news. More and more as we move into the future, National or State-enforced compliance requirements such as GDPR, CCPA, HIPAA and more will come to bear on businesses. Make no mistake–these laws are a burden most organizations would rather not have to deal with.

That’s where you come in! Help your customers simplify their compliance journey with tools in Microsoft 365, such as Compliance Score and Compliance Manager. Be the leader, and actively inform them about their risks in relation to their digital real estate in Microsoft’s cloud. Bonus: as with Secure Score, these continuous assessment tools will uncover more professional and managed services opportunities for you as you work with the customer to improve their position. This should be accessible to all plans, however as you start to address the score you will be pushed to upgrade or add-on.

Build your customers a whole new information system with rich Data Governance features such as Data Classification (Sensitivity labels), Retention labels and policies, as well as Data Loss Prevention, built-in eDiscovery tools (as well as Advanced eDiscovery) and more. Microsoft 365 Business Premium and E3 have “Core” eDiscovery and manual labeling–for “Advanced” eDiscovery and auto-labeling you must move up to E5.

With qualifying Enterprise plans you can go further to help customers structure information barriers within their organization, or to monitor against insider threats, or to perform regular supervision (communication compliance). Take a look also at access reviews! All E5 features.

Adoption and Change management

Microsoft 365 is an ever-evolving platform of inter-connected tools and services. No one person can track all of this information anymore, and it takes some effort to stay current and know which tools to use when, and what options are going to be best for a given situation. Plus, people are hungry for training, and it can be hard to find good resources. In my opinion, nothing beats live instruction with instructor Q&A time. So consider that!

But even something as simple as staying up-to-date with the Message Center, and distilling the most important upcoming changes that can impact the businesses you serve–this would be a very valuable service to many.

Available in all subscriptions, this is also another prime area for you to uncover opportunities to apply new technology to solve real business problems for your customers.

Consider taking work content out of people’s day, too! Leverage tools like PowerAutomate (Flow) and PowerApps to make certain repeatable tasks easier, and even (potentially) accessible from a mobile device. Many customers are just not going to dive into these things on their own, but they may gladly outsource the work to get the benefit!

Conclusion: What IS Microsoft 365, Anyway?

None of these things just “happen” in Microsoft 365. And even though this is so painfully obvious and true once you start looking into it, most people still do not understand what Microsoft 365 is–in an essential sense. They still expect it to behave like static software, back when software still came on a CD or set of floppy disks.

In it’s essence, Microsoft 365 is really more like a blank canvas than a completed painting. Or better yet, it’s almost like a set of art supplies rather than a piece of completed art that you buy at an art gallery. You have to be the artist, paint the picture, carve the statue, that you want it to be.

Of course, Microsoft, being a company full of developers, almost seem to expect that the world will also want to develop. But in reality many customers have no interest in becoming the developer or the maker–they just aren’t artists themselves. But they may gladly commission a piece of custom art to accomplish something in the way that they want it done. And that’s where you come in, my friend. Some of the engagement may be in professional services, but much of it also falls under ongoing maintenance and support–a.k.a. managed services (that’s recurring revenue).

And the list above is by no means exhaustive–it’s just a short list of ideas I threw up one afternoon. I hope it gets your gears turning. Feel free to reach out to me with your thoughts on this topic. Leave a comment, drop me an email via my contact page, or reach out on Twitter or LinkedIn!