Augmentt Blogs

Compliance used to be something MSPs worried about only when a healthcare or financial services client asked for it. That’s no longer the case. Cyber insurance carriers are demanding proof of security controls before they’ll issue or renew a policy. State privacy laws are spreading well beyond California. And clients in construction, manufacturing, and professional services are increasingly asking their MSP the same question: “Can you show me we’re secure?”

For MSPs, compliance frameworks aren’t just a checkbox for regulated clients anymore but are becoming the common language for proving security value across your entire book of business. The challenge is that there are a lot of frameworks, they overlap in confusing ways, and most MSPs don’t have a compliance officer on staff to sort it all out.

This post breaks down the compliance frameworks that matter most for MSPs and their clients, explains how they relate to one another, and shows where Augmentt fits into the picture, especially through its Microsoft 365 security posture and CIS benchmark reporting.

Why compliance frameworks matter for MSPs, not just their clients

A compliance framework is a structured set of security controls and best practices; things like requiring multi-factor authentication, encrypting data at rest, logging administrative activity, or restricting who can access sensitive systems. Frameworks exist so that a business (and its customers, regulators, or insurers) can point to a recognized standard and say, “we followed this.”

For an MSP, frameworks show up in three ways:

1. Client requirements. A healthcare client needs HIPAA. A defense contractor needs CMMC. A software client’s enterprise customers demand SOC 2. If you manage their IT environment, you’re implicated in whether they pass an audit.
2. Cyber insurance underwriting. Insurers increasingly use frameworks like the NIST Cybersecurity Framework or CIS Controls as the baseline for what they’ll ask about on an application, and what they’ll use to deny a claim if it wasn’t in place.
3. Your own differentiation. MSPs that can speak fluently about compliance, and back it up with reporting, win more security-conscious deals and justify higher-margin security services.

The good news: most of these frameworks share a large common core of controls. You don’t need to master ten separate rulebooks — you need to understand the handful that come up most often and recognize how they overlap.

The frameworks MSPs run into most often

NIST Cybersecurity Framework (CSF)

The NIST CSF, maintained by the U.S. National Institute of Standards and Technology, is less a checklist than an organizing structure. Version 2.0 groups activities into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It’s voluntary and not industry-specific, which is exactly why it’s so widely adopted. It works as a common vocabulary that other frameworks (and many cyber insurance questionnaires) map back to.

For MSPs, NIST CSF is often the framework you use to structure a client’s overall security program, even if a more specific framework governs a particular compliance obligation.

CIS Controls and CIS Benchmarks

The Center for Internet Security (CIS) publishes two related things MSPs should know apart: the CIS Critical Security Controls, a prioritized list of 18 safeguards (things like inventory and control of assets, access control management, and continuous vulnerability management), and CIS Benchmarks, which are prescriptive, product-specific configuration guides, including one built specifically for Microsoft 365.

CIS Benchmarks are popular with MSPs because they’re actionable in a way broader frameworks aren’t. Instead of “protect access to systems,” a CIS Benchmark tells you the exact tenant setting to change. Because CIS controls are deliberately cross-mapped to NIST CSF, ISO 27001, PCI DSS, CMMC, HIPAA, and GDPR, hardening a client’s environment to the CIS Microsoft 365 Foundations Benchmark also moves the needle on most other frameworks a client might need.

This is where Augmentt is most directly useful. Augmentt’s security posture checks and MFA reporting are mapped to specific controls in the CIS Microsoft 365 Foundations Benchmark v2.0.0; things like identifying admin accounts without MFA, blocking legacy authentication, monitoring Microsoft Purview audit log status, enforcing idle session timeouts, and alerting on risky sign-ins or role changes outside of Privileged Identity Management. The Security Posture Report shows a Posture Score, flags each check as compliant, partially compliant, or not compliant, and lets you export a branded PDF for a client who doesn’t have Augmentt access, turning a compliance conversation into something you can show, not just describe.

HIPAA

The Health Insurance Portability and Accountability Act governs how healthcare providers, insurers, and their business associates (which can include an MSP) protect patient health information. HIPAA’s Security Rule requires administrative, physical, and technical safeguards; access controls, audit controls, encryption, and breach notification procedures among them.

If you support any healthcare client, you’re very likely a HIPAA “business associate,” which means you need a signed Business Associate Agreement and a genuine security program behind it, not just a promise. Many of the technical safeguards HIPAA requires (access control, audit logging, encryption of data in transit, session timeouts) overlap directly with the CIS Microsoft 365 controls Augmentt already monitors.

SOC 2

SOC 2 is an attestation, not a government regulation. A CPA firm audits a company against the AICPA’s Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) and issues a report. SOC 2 matters to MSPs in two directions: clients in SaaS and professional services increasingly need a SOC 2 report to win their own enterprise customers, and MSPs themselves are sometimes asked by clients to prove their own SOC 2 compliance, since the MSP has privileged access to client systems.

Notably, Augmentt has undergone its own SOC 2 Type 2 audit as a vendor, giving its MSPs even more peace of mind.

CMMC (Cybersecurity Maturity Model Certification)

CMMC applies to companies in the Department of Defense supply chain, and it’s built on NIST SP 800-171. It has tiered levels of maturity, and unlike some frameworks, third-party or government assessment is required at the higher levels. If you have clients who are defense contractors or subcontractors, CMMC compliance isn’t optional, and the underlying controls (access control, audit and accountability, incident response, configuration management) again overlap heavily with what CIS-aligned Microsoft 365 hardening already covers.

PCI DSS

The Payment Card Industry Data Security Standard applies to any organization that stores, processes, or transmits cardholder data. It’s prescriptive about things like network segmentation, encryption, and access restrictions. MSPs supporting retail, hospitality, or e-commerce clients will run into PCI DSS regularly, particularly around securing the systems and email accounts that touch payment workflows.

ISO/IEC 27001

ISO 27001 is an international standard for information security management systems (ISMS). It’s less common among small and mid-sized MSP clients in North America than SOC 2, but it shows up often with clients that do business internationally or with enterprise customers overseas. Like the others, its control set (access control, cryptography, operations security) overlaps substantially with CIS and NIST.

GDPR and state privacy laws

The EU’s General Data Protection Regulation applies to any organization processing the personal data of EU residents, which catches more MSP clients than people expect, especially those with any European customers, employees, or web traffic. In the U.S., a growing patchwork of state privacy laws (California, Colorado, Virginia, and others) imposes similar obligations around data access, deletion rights, and breach notification. These aren’t security control frameworks in the same technical sense as NIST or CIS, but they create legal requirements around how quickly and thoroughly a client (and their MSP) can respond to a data request or breach, which is where good audit logging and access reporting (the kind Augmentt’s alerting provides) becomes evidence rather than just good practice.

How the frameworks relate to each other

The reason this list feels overwhelming at first is that most MSPs try to treat each framework as a separate project. In practice, the frameworks share a large overlapping core:

Access control and MFA enforcement appear in every single one of them, just under different names — NIST CSF calls it PR.AC, SOC 2 addresses it under CC6.1, HIPAA covers it in the Access Control standard, ISO 27001 handles it in Annex A.9, and CMMC maps it to the AC domain. The same is true of audit logging, encryption, and incident response.

That means the highest-leverage work an MSP can do is harden the common core — strong MFA, tight admin access, audit logging turned on, legacy authentication blocked, DLP and sharing policies configured correctly — and treat framework-specific requirements as the smaller layer on top. This is exactly the approach the CIS Microsoft 365 Foundations Benchmark takes, and it’s why it functions as a practical starting point regardless of which specific framework a given client ultimately needs to satisfy.

Where Augmentt fits

Augmentt isn’t a compliance certification body, and it won’t issue you a HIPAA or SOC 2 attestation. What it does is give MSPs continuous visibility into the Microsoft 365 security controls that sit underneath nearly every framework on this list:

• Security posture checks mapped directly to the CIS Microsoft 365 Foundations Benchmark v2.0.0, covering MFA enforcement, legacy authentication, conditional access, Purview audit logging, mailbox auditing, DLP policies, Sharepoint and Teams sharing settings, and more.
• The Security Posture Report, which scores a tenant’s compliance status (compliant, partially compliant, not compliant, resolved, or risk-accepted) against those checks, ties each item to its Microsoft Secure Score impact, and exports as a branded PDF for clients.
• Alerting on risky sign-ins, role and permission changes, self-service password reset activity, and mail forwarding rule changes — the kind of continuous monitoring that HIPAA, SOC 2, and CMMC all expect to see in place, not just configured once and forgotten.
• Scheduled reporting, so posture and compliance status can go out to clients automatically on a recurring cadence rather than requiring a manual pull before every QBR.

For an MSP juggling multiple clients with different compliance obligations, that combination — one dashboard mapped to a benchmark that overlaps with nearly every other framework, plus reporting you can hand to a client or auditor — turns compliance from a once-a-year scramble into an ongoing, demonstrable process.

Getting started

If you’re not sure where a given client stands, the fastest starting point is usually the same regardless of which framework they ultimately need to satisfy: run a CIS Microsoft 365 Foundations Benchmark assessment, close the highest-impact gaps (MFA, legacy auth, audit logging, admin role hygiene), and build reporting into your regular client cadence so compliance becomes a running conversation instead of a fire drill. From there, layer in the framework-specific requirements — a signed BAA for HIPAA clients, evidence collection for a SOC 2 audit, NIST 800-171 documentation for CMMC — on top of that hardened baseline.

Compliance will keep getting more complicated as more frameworks and state laws come online. But the underlying security work barely changes. Get the fundamentals right once, and you’re most of the way to satisfying whatever framework comes up next.

Want to check your own clients’ security posture? Try Augmentt for free!

Cover Photo by Jakub Żerdzicki on Unsplash

June 2026 brings a dense wave of Microsoft 365 changes across identity, security, licensing, and AI, several of which require MSP action before deadlines hit.

Intune

Hotpatching Enabled by Default Starting May 2026 Security Update

Windows Autopatch now enables hotpatch updates by default for all eligible devices, reducing the number of restarts required during patch deployment. If your clients aren’t ready for hotpatching, you need to opt out at the tenant or policy level proactively; waiting means it activates automatically across all eligible managed devices.

Windows 11 25H2 Security Baseline Now Available

The updated security baseline for Windows 11 version 25H2 is available in Intune, bringing new settings, updated defaults, and retired settings. Existing baseline profiles do not auto-update, so you must manually create or migrate profiles to the new baseline and review every setting change before pushing to client devices.

Microsoft Edge v139 Security Baseline Released

An updated Edge security baseline with new settings and revised defaults is now available in Intune. Like the Windows baseline, existing Edge profiles require a manual update — test in a pilot group before broad deployment to avoid breaking browser configurations across client tenants.

Platform SSO During macOS ADE Now Supported

macOS devices enrolled via Automated Device Enrollment can now complete Platform SSO registration during the setup flow, giving users immediate Entra ID resource access at first desktop login. This requires specific prerequisites: a settings catalog policy, Company Portal 5.2604.0 or later, a configured ADE policy, and macOS 26 or later. MSPs deploying new Mac fleets should update enrollment profiles now to take advantage of this.

Intune RBAC Roles Now Inherit Copilot in Intune Access Automatically

All built-in and custom Intune RBAC roles now automatically receive Security Copilot contributor access when Intune is enabled as a Copilot data source, no separate role assignments needed. MSPs should review whether this expanded access aligns with the least-privilege model in place for client tenants, since it applies to custom roles as well.

Entra ID

Microsoft Entra Connect Sync to Cloud Sync Migration Announced — Phased Starting July 2026

Microsoft will begin notifying customers via M365 Message Center and Entra Connect Health of their transition timelines from Connect Sync to Cloud Sync starting July 2026. MSPs managing hybrid identity environments need to assess client readiness now, identify configurations not yet supported by Cloud Sync, and start migration planning before assigned transition windows arrive.

Hard Match Blocked for Users with Entra Roles — Effective June 1, 2026

Entra Connect Sync and Cloud Sync can no longer hard-match a new AD object to an existing cloud user that holds Entra ID roles, effective June 1. This is a breaking change for any migration or re-sync scenario involving privileged cloud accounts. Audit hybrid environments for affected users immediately and use the new Graph API recovery path if hard-match errors occur.

Entra Backup and Recovery Now in Public Preview

Built-in daily snapshots of critical directory objects (users, groups, apps, Conditional Access policies, and more) are now available in public preview with 5-day retention and admin-initiated restore capability. This gives MSPs a native safety net for accidental tenant configuration changes; familiarize yourself with the restore workflow and add it to your incident response runbooks.

SAP SuccessFactors Provisioning Must Migrate from Basic Auth by November 2026

Workload identity-based authentication for SAP SuccessFactors provisioning is now in public preview, with basic auth deprecation set for November 2026. MSPs managing SuccessFactors provisioning integrations need to plan and execute migration to workload identity auth before the deadline to avoid provisioning failures.

Sensitivity Labels Now Supported on Entra Security Groups (Preview)

Microsoft Purview sensitivity labels can now be applied to Entra cloud security groups to govern settings like guest access. MSPs managing group-based access controls should evaluate whether existing label policies need updating to cover this new scope.

Defender

Local AI Agent Discovery and Runtime Protection on Windows Endpoints (Preview)

Defender now automatically discovers local AI agents — coding agents, IDE extensions, desktop AI assistants — on onboarded Windows devices and can block risky activity in the agent loop at runtime. Before broad enforcement, MSPs should assess whether any legitimate local AI tools used by client employees will generate alerts and tune accordingly.

Automatic Attack Disruption Can Now Isolate Compromised Devices (Preview)

High-confidence incident analysis can now trigger automatic network isolation of devices identified as active attacker footholds, with time-limited scope and operator release capability. This is a significant operational change. MSPs must ensure clients understand that devices may be isolated without manual intervention, and SOC runbooks need to account for this response action.

Identity Security Dashboard and Risk Score Now in Preview

A new Identity Security dashboard surfaces identity provider coverage, non-human identities, and a 0–100 risk score per identity that can be used directly in Conditional Access policies. This gives MSPs a consolidated identity risk view across human and non-human identities; evaluate the risk score integration with Conditional Access for clients where risk-based policy enforcement makes sense.

AgentsInfo Table Replaces AIAgentsInfo in Advanced Hunting — Deadline July 1, 2026

The new unified AgentsInfo table covers all agent types; the AIAgentsInfo table retires July 1, 2026. Any custom detection rules, hunting queries, or automation referencing AIAgentsInfo must be updated before that date to avoid query failures.

Built-in Alert Tuning Rules Now Generally Available

Suppression rules for common benign activity in Defender for Endpoint and Defender for Office 365 are now GA, without affecting AIR investigations. MSPs managing high-alert-volume tenants should review which rules are active and confirm they align with client security posture before relying on suppression.

Licensing

Microsoft 365 Business Standard with Copilot and Business Premium with Copilot Become Permanent SKUs July 1, 2026

The promotional offers for M365 Business Standard with Copilot and Business Premium with Copilot transition to permanent subscriptions at $23.50 and $32 USD per user/month respectively, with new SKUs available July 1 and price list preview in Partner Center starting June 1. Update quoting tools, renewal motions, and SMB offer packaging now. Every Business Standard and Premium renewal is a built-in Copilot upsell opportunity with stable, predictable pricing.

Agent 365 Now Requires Microsoft 365 E5 as Licensing Prerequisite (Effective June 1)

New Agent 365 purchases now require M365 E5 for enterprise, F5-level Defender and Purview for frontline workers, and M365 Business Premium for SMB customers. Audit client licensing before positioning Agent 365. Clients without the prerequisite licenses will lack access to certain capabilities, which creates risk of failed deployments or uncomfortable upsell conversations mid-engagement.

Work IQ API Reaches GA June 16 with Consumption-Based Copilot Credits Billing

Work IQ API is generally available June 16; custom agents using Work IQ via Copilot Studio, Foundry, or third-party platforms are billed via Copilot Credits. Admins must enable consumptive billing before use. MSPs building or managing custom AI agents need to ensure client admins configure payment methods, access policies, and spend limits in the M365 Admin Center before June 16 to avoid service interruption or uncontrolled spend.

EEA Currency Pricing Precision Updates for Select M365/O365 SKUs Effective July 1

Minor cent-level price adjustments are coming to M365 and O365 SKUs in EUR, DKK, NOK, SEK, and CHF for EU settlement compliance, effective July 1. The amounts are small, but discrepancies in automated billing systems should be corrected proactively to avoid invoice inaccuracies for clients billed in EEA currencies.

Dynamics 365 Business Central Dual Use Rights License Keys Must Be Refreshed Every Six Months

Effective June 5, on-premises Business Central deployments via Dual Use Rights require license key download and replacement every six months. MSPs managing Business Central on-premises deployments must establish a recurring process to download and apply updated DUR license keys to prevent service interruption.

Purview

Data Security Posture Management (DSPM) New Version Now Generally Available

The updated DSPM with guided workflows for proactive risk management is now GA; partner solutions for non-Microsoft sources and the Data Security Posture Agent remain in preview. MSPs advising clients on data security governance should update deployment guidance and assess whether clients need the GA version’s administrative unit support for scoped administration.

DLP Policy Device Scoping Now Available

Endpoint DLP policies can now be scoped to specific device groups (for example, enforcing a policy only on Windows devices for Finance users, not macOS) using dynamic Entra ID device groups. MSPs should review existing Endpoint DLP policies to determine whether device-scoped rules would reduce false positives or improve coverage for clients with mixed-OS environments.

Anthropic Claude Enterprise Now Supported in DSPM (Preview)

Claude interactions can now be monitored alongside Copilot, ChatGPT Enterprise, and other AI apps in DSPM activity explorer. MSPs should configure the Anthropic Claude connector for clients with Claude Enterprise deployments so AI interaction visibility and data security controls apply consistently.

eDiscovery Review Set Limit Increased from 20 to 100

The maximum number of review sets per eDiscovery case has been raised from 20 to 100. MSPs supporting legal or compliance teams running large investigations no longer need to work around the previous limit by managing case sprawl; update client guidance accordingly.

Sensitivity Label Auto-Labeling Can Now Override Manually Applied Labels (GA)

Auto-labeling policies for SharePoint and OneDrive can now be configured to always override lower-priority labels, even if manually applied, a capability previously limited to email. This is a behavior change that could override user-applied labels on files; MSPs must review auto-labeling policy configurations for clients to confirm the override option is intentionally set and that users are informed.

Teams

Copilot Call Delegation Rolling Out to Frontier in June

Copilot can now answer incoming Teams Phone calls on a user’s behalf, capture intent, and schedule follow-ups via Microsoft Bookings when the user is unavailable. This feature requires Teams Phone licensing and may trigger questions about call recording consent and data retention. Review client policies before enabling.

Scam and Impersonation Detection Now Live

Teams now detects when callers may be impersonating trusted brands (banks, IT admins) and warns users with options to decline, leave, or report. This is a default-on security control that requires no configuration; MSPs should communicate it to clients as a meaningful reduction in social engineering risk.

Video Recap for Recorded Meetings

AI-generated narrated highlight reels are now available for recorded Teams meetings, surfacing key moments without requiring full playback. This feature uses meeting recordings and transcripts, so MSPs should confirm clients have appropriate retention and compliance policies in place for AI-generated recap content.

Recap Deletion Now Available Without Admin Setup

Meeting organizers can now permanently delete recordings, transcripts, AI summaries, and notes from the recap page via a single menu action, no admin configuration required. This self-service deletion capability may conflict with client retention policies; MSPs should verify that retention labels or compliance holds are in place to prevent premature deletion.

Mobile Queues App Now Available

The Teams Queues app for collaborative call queue management is now available on Teams mobile for iOS and Android. MSPs should validate that mobile device policies permit the app and that queue agent permissions are correctly scoped before clients start using it in the field.

Copilot

ISO/IEC 42001 Certification Expanded Across Copilot Portfolio

Microsoft has extended ISO 42001 AI management certification to Copilot Studio, GitHub Copilot, Dragon Copilot, and Copilot Health, adding to existing certifications for M365 Copilot, Security Copilot, and Microsoft Foundry. Clients in regulated industries requiring AI governance documentation can now reference expanded third-party certification coverage. Update your compliance evidence packages accordingly.

Federated Copilot Connectors via MCP Now Available

Real-time enterprise data from SaaS systems (HubSpot, Notion, LSEG, Moody’s) can now be connected to Work IQ via Model Context Protocol, with native security controls maintained. Enabling these connectors requires admin configuration and access policy review; assess data exposure risk before activating third-party connectors for clients.

Teams Meeting Watermarks Reach DoD in June

Watermark overlay of attendee email addresses on shared meeting content is rolling out to DoD environments in June, following GA in March and GCC-High in May. MSPs supporting government cloud clients should validate this feature is enabled for clients handling sensitive meeting content, as it requires organizer-level configuration in Meeting options.

Learning Agent Rolling Out in June

A new in-flow learning agent powered by Work IQ delivers personalized Copilot and AI skill-building, assessments, and roleplay practice directly within user workflows. This agent will appear in licensed tenants automatically. MSPs should be prepared to field end-user questions and advise clients on whether to promote or restrict it via policy.

Anthropic Claude Opus 4.8 and GPT-5.5 Instant Now Available in Copilot

Two new AI models are available for M365 Copilot licensed users: Claude Opus 4.8 for complex multi-step tasks and GPT-5.5 Instant for faster everyday responses. Expanded model choice increases the surface area for data handling considerations. Confirm clients understand which models are active and review any data residency or compliance implications.

Outlook

Copilot Chat Now Available in Pop-Out Windows

Copilot chat is now accessible in popped-out Outlook message windows, enabling use while reading or composing separate messages. No admin action is required, but MSPs should confirm clients with Copilot licenses have appropriate usage policies in place as this expands the Copilot surface area in Outlook.

Shared Calendars Assigned by Admin Now Appear Automatically

Calendars assigned to users by admins now populate automatically in the calendar list without any user action. This should reduce helpdesk tickets for shared calendar setup, but MSPs should verify that existing admin-assigned calendar configurations are correctly scoped to avoid unexpected calendar visibility for users.

DLP Warn Dialog Now Includes Justification and False Positive Fields

The DLP warning dialog in new Outlook for Windows now includes justification, false positive reporting, and acknowledgment fields, matching the behavior of classic Outlook. MSPs managing DLP policies should confirm that client configurations include appropriate justification options and that compliance teams are reviewing override and false positive reports.

Outlook Background Sync Now On by Default When App Is Closed

Outlook now syncs email in the background even when the app is closed; users can disable this in Settings > General > Offline. This may affect battery life and data usage on managed devices. Assess whether this behavior conflicts with client endpoint management policies or mobile device profiles.

OneDrive

Custom OneDrive Folder Name Now in Deferred Ring

Admins can now set a custom name for the local OneDrive sync folder via Group Policy, replacing the default “OneDrive – {org name}” convention. This reached the Deferred ring June 1, 2026. Shorter folder names increase available path length for nested files (relevant for clients with deep folder structures) so MSPs managing Deferred ring deployments should plan rollout and update GPO configurations.

Move Folders to OneDrive from File Explorer Now in Deferred Ring

A right-click context menu option to move local folders directly to OneDrive reached the Deferred ring June 1, 2026. This feature may prompt end users to inadvertently move large local folder structures to OneDrive; communicate expected behavior to clients and confirm storage quotas are adequate before this lands broadly.

Mark of the Web for Outlook Attachments Now in Deferred Ring

Email attachments saved to OneDrive from Outlook now include the Mark of the Web security tag, enabling Windows Protected View when opened. This reached the Deferred ring as of June 1. No admin action is required, but MSPs should be aware it may affect workflows where users rely on immediate full editing of downloaded attachments.

SharePoint

SharePoint Server Patch Released May 12, 2026

KB 5002863 (version 16.0.19725.20280) was released for SharePoint Server Subscription Edition; KB 5002870 and 5002872 for SharePoint Server 2019; KB 5002868 and 5002869 for SharePoint Server 2016. MSPs managing on-premises SharePoint farms must apply the May 2026 cumulative update to maintain security patch compliance. Schedule patching windows if you haven’t already.

Custom Skills for Copilot in SharePoint Now GA

Users can now create and save reusable, site-specific Copilot skills using natural language to automate repeatable multi-step workflows. Custom skills are user-created and site-scoped, so MSPs should assess whether clients need governance controls around skill creation to prevent unintended automation or data exposure.

---

June 2026 is a high-action month for MSPs, with hard deadlines around Entra hard-match changes, hotpatch opt-outs, Work IQ billing configuration, and the AgentsInfo table retirement all requiring attention before July 1. The broader theme is clear: AI capabilities are expanding rapidly across the Microsoft 365 stack, and the compliance, governance, and licensing structures around them are maturing just as fast. Staying current with these changes is the difference between managing client environments proactively and reacting to problems after they’ve already landed.

Featured image by Jonas Leupe on Unsplash

Paying for Microsoft 365 licenses that nobody uses is one of the quietest budget leaks in IT. Under annual NCE terms, every idle seat you miss at renewal locks you into another twelve months of waste.

The good news: yes, tools exist that surface unused licenses automatically without manual exports or PowerShell scripts. This guide covers how automatic detection works, what to look for in a tool, and how MSPs can reclaim idle licenses across dozens of tenants from a single dashboard.

What is an unused Microsoft 365 license

Yes, several specialized tools automatically surface unused Microsoft 365 licenses. SaaS management platforms like Zylo and Torii pull usage data and highlight idle accounts, while MSP-focused solutions like Augmentt and CoreView do the same across multiple customer tenants without manual effort.

An unused license is one assigned to a user account that shows no sign-in or app activity over a defined period, typically 30 to 90 days. This differs from an unassigned license, which sits in your subscription inventory waiting to be allocated to someone. The distinction matters because unused licenses quietly drain budget month after month, while unassigned ones are at least visible when you check your subscription count.

Why detecting unused Microsoft 365 licenses matters

Idle licenses create problems that compound over time. The longer they go unnoticed, the more they cost you in dollars, security exposure, and audit headaches.

Cut shelfware and renewal costs

Paying for licenses nobody uses inflates your renewal bills. Under Microsoft’s New Commerce Experience (NCE) annual terms, you cannot reduce seat counts mid-contract. Every unused license you miss at renewal locks you into another year of waste.

For organizations with a few hundred seats, even a small percentage of idle licenses can translate to thousands of dollars annually. That money could go toward security tools, staffing, or other priorities instead of inflating SaaS costs.

Tighten security during offboarding

Licenses tied to departed or inactive users can become Microsoft 365 security risks if the accounts remain enabled. A former employee’s mailbox with an active license is still a valid target for credential stuffing or phishing attempts.

Linking license detection to your offboarding process closes this gap. When you catch idle accounts early, you can disable them before they become a liability.

Stay ready for audits and true-ups

Accurate license inventory simplifies Microsoft true-ups and compliance checks. When you know exactly who is using what, you avoid scrambling during an audit or overpaying because your records do not match reality.

How to find unused Microsoft 365 licenses in the admin center

The manual route starts in the Microsoft 365 Admin Center. You navigate to Reports, then Usage, select the relevant usage report, and review the last activity date for each user. From there, you can export the data to Excel for further analysis.

Here is the basic process:

• Sign in to admin.microsoft.com
• Go to Reports, then Usage
• Select the usage report for the app you want to check, such as Exchange, Teams, or OneDrive
• Review the last activity date column
• Export the report if you want to filter or share it

This approach works for a single tenant, but it does not scale. You will repeat the process for every customer, and there is no automation. Just manual exports and spreadsheets that get stale the moment you finish them.

How to detect unused Microsoft 365 licenses with PowerShell

PowerShell combined with Microsoft Graph lets you pull sign-in logs and compare them against assigned licenses programmatically. You can script a threshold check, flagging anyone who has not signed in for 60 days, and run it on a schedule.

• Last sign-in date: Pulled from Azure AD sign-in logs via Graph API
• Assigned licenses: Retrieved with Get-MgUserLicenseDetail
• Threshold comparison: Your script flags users inactive beyond your policy window

This method is flexible and free, but it requires scripting skills and ongoing maintenance. Scripts break when Microsoft updates APIs, and you have to manage credentials and permissions for each tenant. For MSPs managing dozens of customers, running and updating scripts per tenant quickly becomes unsustainable.

How to detect unused Microsoft 365 licenses automatically

Automated tools handle the heavy lifting by continuously aggregating activity data and surfacing idle accounts without manual intervention. The workflow typically follows a predictable pattern.

Step 1. Define what inactive means

Most tools let you set an inactivity threshold, commonly 30, 60, or 90 days of no sign-in or app usage. Your policy here aligns with HR and offboarding workflows so you are not flagging someone on extended leave or sabbatical.

The threshold you choose depends on your organization. A 30-day window catches idle accounts quickly but may generate false positives. A 90-day window is more conservative but lets waste accumulate longer.

Step 2. Pull sign-in and app activity signals

Automated platforms pull from multiple data sources: Azure AD sign-in logs, Microsoft 365 usage reports, and app-level activity like mail sent, Teams calls, or SharePoint edits. Aggregating all of these signals gives a fuller picture than sign-in data alone.

Someone might sign in once a month to check email but never touch Teams or OneDrive. A tool that only looks at sign-in dates would miss that the Teams license is going unused.

Step 3. Flag idle and misassigned licenses

The tool compares activity against assigned licenses to surface accounts with no usage. Some platforms also catch misassignment, like an E5 license assigned to someone who only uses email. In that case, you could downgrade to a cheaper SKU and save the difference.

Step 4. Trigger alerts or PSA tickets

Good tools push alerts via email, webhook, or directly into your PSA. Technicians can act without logging into another dashboard, and nothing slips through the cracks.

For MSPs, PSA integration is particularly valuable. An alert that creates a ticket in ConnectWise or Autotask means the work gets tracked and assigned like any other service request.

Step 5. Automate removal or downgrade

Some platforms offer auto-remediation. After a grace period or approval workflow, the tool revokes or downgrades the license automatically. This removes the manual step entirely and ensures idle licenses do not linger for months.

Step 6. Tie detection into offboarding

Linking license detection to your offboarding process ensures licenses are reclaimed as soon as a user departs, not months later when someone finally notices the account is still active. This connection between HR events and license management is where automation really pays off.

What to look for in a Microsoft 365 license detection tool

Not all tools offer the same depth. Some generate reports you still have to act on manually. Others automate the entire workflow from detection to reclamation. Here is what separates a basic report from a platform you can rely on.

Multi-tenant visibility

For MSPs, the tool aggregates license data across all customer tenants in one view. Jumping between admin centers is slow and error-prone, and it does not scale when you manage 50 or 100 customers.

Activity-based inactivity detection

Look for tools that go beyond last sign-in and examine actual app usage, including mail sent, Teams calls, and SharePoint edits. A user who signs in but never touches an app is still wasting a license.

Group-based licensing support

Azure AD group-based licensing can complicate reclamation. If a user gets their license through group membership, removing the license directly will not work. The tool you choose understands group membership so you do not accidentally break assignments or create conflicts.

Automated reclamation actions

Reports are helpful, but one-click or scheduled removal actions save time and reduce human error. The fewer manual steps between detection and action, the more likely idle licenses actually get reclaimed.

Brandable license reporting

For MSPs, the ability to generate client-facing reports with your logo and branding turns license management into a visible service. Customers see the value you deliver, and you have documentation for quarterly business reviews.

Capability	Admin Center	PowerShell	SaaS Platform	MSP Platform
Multi-tenant view	No	Manual	Varies	Yes
Activity-based detection	Limited	Custom	Yes	Yes
Automated reclamation	No	Manual	Varies	Yes
PSA integration	No	No	Rarely	Yes
Brandable reports	No	No	Varies	Yes

Tools that automatically surface unused Microsoft 365 licenses

Microsoft 365 Admin Center

Free and built-in, but manual and single-tenant only. Good for small organizations checking ad hoc, but not practical for ongoing management or multi-tenant environments.

PowerShell and Microsoft Graph

Free and flexible, yet requires scripting skills and ongoing maintenance. You can build exactly what you want, but you also own all the upkeep. For MSPs managing many tenants, the maintenance burden often outweighs the cost savings.

SaaS management platforms

Tools like Zylo, Torii, and BetterCloud aggregate SaaS usage including Microsoft 365. They are designed for enterprise IT teams managing a single large environment, not MSP multi-tenant workflows. If you only manage one organization, they work well. If you manage many, the per-tenant setup becomes cumbersome.

MSP-focused platforms

Purpose-built for managing many customer tenants, examples include Augmentt, CoreView, and CIPP. These offer multi-tenant dashboards, automated alerts, and PSA integrations that fit how MSPs actually work.

How MSPs detect unused Microsoft 365 licenses across multiple tenants

Jumping between tenants is slow and error-prone. MSP-focused tools connect via CSP Partner Portal or delegated admin and pull license and usage data across all tenants into a single dashboard.

• Single-pane visibility: See all tenants without switching contexts or logging in and out of different admin centers
• Per-tenant policies: Set different inactivity thresholds by customer based on their business needs
• Automated customer reports: Schedule branded reports for each client that show license utilization and savings opportunities

This approach turns license management from a reactive chore into a proactive service you can deliver consistently across your entire customer base.

How to reclaim unused Microsoft 365 licenses safely

Reclaiming a license without proper steps can disrupt users or lose data. A safer approach involves a few key practices.

• Notify stakeholders: Email the user or their manager before revoking to confirm the account is truly inactive
• Disable first: Block sign-in or convert the mailbox to shared before deleting the account entirely
• Export data: Ensure OneDrive and mailbox content are backed up or transferred to another user
• Log the change: Record the removal in your PSA or ticketing system for audit purposes

Some platforms offer a grace period or approval workflow so nothing gets revoked without review. This extra step prevents accidental removal of licenses from users who are simply on vacation or working remotely with limited connectivity.

Automate unused Microsoft 365 license detection with Augmentt

Augmentt surfaces unused licenses automatically across all customer tenants from a single dashboard. You get multi-tenant license reporting, one-click reclamation actions, and PSA-integrated alerts, so your team can act fast without jumping between portals.

Ready to stop paying for licenses nobody uses? See how Augmentt simplifies Microsoft 365 license management for MSPs.

Frequently asked questions about detecting unused Microsoft 365 licenses

What counts as an inactive Microsoft 365 user?

An inactive user is typically someone who has not signed in or used any Microsoft 365 app, including Exchange, Teams, SharePoint, or OneDrive, within a defined period. Most organizations use a threshold of 30 to 90 days depending on their policy and business context.

Can you remove a Microsoft 365 license without losing user data?

Yes. Removing a license does not immediately delete mailbox or OneDrive data. However, the data enters a retention window and will eventually be purged unless you convert the mailbox to shared or export the content first. The retention period varies based on your tenant settings.

Does Microsoft NCE or CSP billing affect reclaiming unused licenses?

Under NCE annual terms, you cannot reduce seat count mid-term. Reclaimed licenses sit unused until renewal, so detecting them early helps you right-size at the next renewal date rather than paying for another year of waste.

How often should you audit Microsoft 365 license usage?

Most organizations run a usage audit monthly or quarterly. Automated tools surface idle licenses continuously, so you catch issues before the next billing cycle rather than discovering them during annual renewal planning.

Can unused Microsoft 365 licenses be reassigned automatically?

Some platforms support auto-reassignment workflows where a reclaimed license is added back to an available pool and assigned to a new user via group-based licensing or provisioning rules. This keeps licenses in circulation rather than sitting idle after reclamation.

---

Photo by Ed Hardie on Unsplash

PowerShell scripts were the go-to solution for Microsoft 365 automation…until they weren’t. Managing 50 tenants with custom scripts means maintaining 50 potential points of failure, and every Microsoft Graph API update threatens to break something you don’t have time to fix.

Modern multi-tenant management platforms now handle security baselines, policy enforcement, and breach response without requiring you to write or maintain code. This guide covers why MSPs are moving away from scripts, what to look for in a replacement platform, and how to evaluate the leading alternatives—including options that work without a golden tenant.

Why MSPs are moving away from PowerShell scripts for Microsoft 365 management

Several platforms now handle Microsoft 365 management without requiring you to write or maintain PowerShell code. Tools like M365 Manager Plus, CoreView, and Augmentt provide interfaces for user provisioning, license management, and security configuration that work across multiple tenants. For MSPs managing many clients, platforms such as CIPP, Microsoft Lighthouse, and Nerdio Manager offer centralized control without relying on a golden tenant as a configuration template.

The shift reflects a practical reality. When you’re responsible for 30, 50, or 100 tenants, the hours spent writing and debugging scripts start to outweigh the benefits. What once felt like automation becomes another maintenance burden.

Brittle scripts and constant Microsoft Graph API changes

Microsoft updates the Graph API and deprecates cmdlets on its own schedule, often with limited advance notice. A script that ran perfectly last quarter can fail after an API version change, and the failure might be silent—no error message, just missing data or incomplete actions.

Common breakage scenarios include:

• Deprecated authentication methods: Basic auth retirement broke thousands of legacy scripts when Microsoft enforced the change
• Cmdlet parameter changes: Updated modules introduce new required parameters that existing scripts don’t account for
• Throttling policy updates: Scripts that worked at low volume hit rate limits as your client count grows

Each of these scenarios means unplanned troubleshooting time, usually during a client emergency.

Single point of failure on one scripting expert

Most MSPs have one person who truly understands the PowerShell scripts running in production. Maybe two, if you’re lucky. When that person takes vacation, gets sick, or leaves the company, the scripts become a black box.

L1 and L2 technicians end up escalating routine tasks to senior engineers simply because fixing the issue requires modifying code they didn’t write and don’t fully understand. That’s an expensive bottleneck, and it doesn’t scale.

Portal fatigue across dozens of tenants

Portal fatigue is the exhaustion that comes from logging in and out of multiple Microsoft admin centers throughout the day. If you manage 50 tenants and want to check MFA status in each one, that’s 50 separate login sessions. Conditional Access policies can make this even more tedious, requiring additional authentication steps for each tenant.

The cognitive load compounds quickly. Technicians lose context when switching between tenants, and the repetitive clicking increases the chance of mistakes.

No audit trail for configuration drift

PowerShell scripts rarely log what changed, when it changed, or who ran the script. When a client asks why a Conditional Access policy looks different than it did three months ago, you’re left searching through command history or making educated guesses.

This gap makes compliance reporting difficult and slows down troubleshooting when something breaks.

What is a golden tenant and why it falls short for multi-tenant MSPs

A golden tenant is a reference Microsoft 365 tenant configured with your ideal security settings. The idea is to set it up once, then use it as a template to replicate configurations across client tenants. In theory, this approach standardizes your deployments. In practice, it creates its own set of problems.

Extra licensing costs and tenant overhead

A golden tenant requires its own Microsoft 365 licenses just to exist. You’re paying for a tenant that serves no actual users—it only holds configuration settings. If you work with clients across different industries or compliance requirements, you might end up maintaining multiple golden tenants, multiplying the cost.

Configuration drift between master and client tenants

Client tenants inevitably diverge from the golden tenant over time. Someone makes a manual change to address a specific client request. A new Microsoft feature rolls out and gets enabled differently across tenants. A technician adjusts a setting during troubleshooting and forgets to document it.

There’s no automatic mechanism to detect or correct this configuration drift. The golden tenant becomes a snapshot of what you intended, not a reflection of what actually exists.

Limited fit for mixed client license tiers

A golden tenant configured for Business Premium won’t apply cleanly to clients running Business Basic. Features like Conditional Access, Defender, and Intune require specific licensing tiers. Your template either excludes those settings entirely or fails when applied to tenants that lack the required licenses.

This mismatch forces you to maintain multiple golden tenants or accept that your “standard” configuration only works for a subset of clients.

Core capabilities to look for in a PowerShell alternative

When evaluating platforms, focus on capabilities that directly address the pain points above. The right tool reduces scripting overhead while giving you more visibility and control.

Multi-tenant policy and security baseline management

Look for platforms that let you push Conditional Access, Defender, and Intune policies across all tenants from a single dashboard. This capability replaces the need to write tenant-specific scripts or log into each admin center individually.

The key distinction is centralized visibility combined with centralized action. Seeing all your tenants in one place is helpful, but being able to make changes across them from that same view is what actually saves time.

One-click application of NIST, CIS, and Secure Score best practices

Pre-built security templates aligned to recognized frameworks eliminate hours of research and manual configuration. You select a baseline, apply it to the relevant tenants, and move on.

Frameworks worth looking for include:

• CIS Benchmarks: Consensus-based security configurations maintained by the Center for Internet Security
• NIST guidelines: Federal standards that many regulated industries reference
• Microsoft Secure Score: Microsoft’s own scoring system for tenant security posture

Automated breach detection and auto-remediation

Real-time alerting on risky sign-ins matters, but automatic response actions matter more. The ability to block a compromised user or reset a password without waiting for a technician to respond reduces the window of exposure significantly.

Look for platforms that let you customize alert thresholds and remediation actions. Not every risky sign-in warrants the same response, and overly aggressive automation can create its own problems.

Branded reporting and risk assessments

White-label reports for QBRs and prospecting eliminate the manual export work that eats into billable hours. Automated scheduling means reports go out on time without technician involvement.

The best platforms also include risk assessment templates you can use during sales conversations, turning security posture into a tangible deliverable.

GDAP and CSP onboarding without a golden tenant

Direct connection via GDAP (Granular Delegated Admin Privileges)Direct connection via GDAP (Granular Delegated Admin Privileges) or Magic Link removes the need for a reference tenant entirely. You onboard clients in minutes rather than hours, with granular role assignments built into the connection process.

GDAP replaced the older DAP model and requires more specific permission scoping. Platforms that handle this natively save you from manually configuring access for each new client.

Categories of Microsoft 365 management tools that replace PowerShell

Before looking at specific products, it helps to understand the different categories of tools available. Each category serves different needs and comes with different tradeoffs.

Category	Examples	Best For	Tradeoffs
Native Microsoft tools	Lighthouse, Admin Center	Basic cross-tenant visibility at no cost	Limited automation and no PSA integration
Community platforms	CIPP	MSPs with technical staff to self-host	Requires Azure hosting and ongoing maintenance
Commercial multi-tenant platforms	Augmentt, Inforcer, CoreView	Turnkey deployment with vendor support	Subscription costs
RMM/PSA-integrated tools	Nerdio, N-able	Endpoint-focused MSPs adding M365 modules	M365 security depth varies

Native Microsoft tools like Lighthouse and the Admin Center

Microsoft 365 Lighthouse is free for CSP partners and provides basic cross-tenant visibility. You can compare Secure Scores across tenants and see which clients have risky configurations.

However, Lighthouse lacks advanced automation, PSA integration, and the remediation workflows that make management efficient at scale. It’s a reasonable starting point, but most MSPs find they outgrow it quickly.

Community platforms like CIPP

CIPP (CyberDrain Improved Partner Portal) is open-source and highly customizable. The community actively develops new features, and the platform handles many common multi-tenant tasks well.

The tradeoff is that you’re responsible for Azure hosting, updates, security patches, and troubleshooting. There’s no vendor support line to call when something breaks at 2 AM.

Commercial multi-tenant platforms built for MSPs

Purpose-built SaaS tools come with support, compliance certifications, and turnkey onboarding. Platforms in this category typically offer SOC 2 Type II compliance and align with frameworks like CIS and NIST out of the box.

Augmentt falls into this category, designed specifically for MSPs managing multiple Microsoft 365 tenants without requiring a golden tenant or premium licensing across all clients.

RMM and PSA-integrated management tools

Endpoint-focused platforms are adding M365 modules to their feature sets. If you’re already invested in a particular RMM, check whether its M365 capabilities meet your actual security and management requirements.

The depth of M365 security baselines varies significantly across RMM platforms. Some offer robust policy management while others provide only basic visibility.

Best alternatives to PowerShell scripts for Microsoft 365 management

1. Augmentt Secure Autopilot

Augmentt is built specifically for MSPs managing multiple Microsoft 365 tenants. The platform works without a golden tenant, supports all license tiers, and enables L1/L2 technicians to handle tasks that previously required senior engineers or custom scripts.

Key capabilities include:

• One-click security baselines aligned to CIS, NIST, and Secure Score
• Automated breach detection with configurable auto-remediation
• Branded reporting and unlimited risk assessments
• SOC 2 Type II certification with native GDAP support

See how Augmentt simplifies multi-tenant M365 management →

2. CIPP (CyberDrain Improved Partner Portal)

CIPP is a free, community-driven platform with strong automation capabilities. The active development community adds features regularly, and the platform handles many common MSP workflows well.

You’ll need Azure hosting and technical expertise to maintain it. Many MSPs use CIPP successfully, though the lack of vendor support means you’re responsible for troubleshooting and security updates.

3. Microsoft 365 Lighthouse

Lighthouse provides basic tenant comparison and Secure Score visibility at no additional cost beyond your CSP agreement. It’s a reasonable starting point for MSPs new to multi-tenant management.

Most MSPs find they outgrow Lighthouse as their client base expands and their security requirements become more sophisticated.

4. Nerdio Manager for MSP

Nerdio excels at Intune, Azure Virtual Desktop, and endpoint lifecycle management. The platform integrates well with existing Microsoft infrastructure and provides strong device management capabilities.

M365 security baseline features are less comprehensive than dedicated platforms, so Nerdio works best for MSPs whose primary focus is endpoint and infrastructure management.

5. CoreView

CoreView targets enterprise-grade M365 management with deep automation and governance features. The platform offers extensive customization and handles complex organizational structures well.

Pricing may be prohibitive for smaller MSPs, though larger organizations and enterprises often find value in its breadth of capabilities.

6. Inforcer

Inforcer focuses on policy management and compliance reporting for MSPs. The platform emphasizes security baseline enforcement and provides detailed compliance documentation.

As a newer entrant, Inforcer continues to expand its feature set and has positioned itself competitively against more established players.

7. SaaS Alerts

SaaS Alerts monitors behavior and breach indicators across SaaS applications including Microsoft 365. The platform focuses on detecting anomalous activity rather than configuration management.

SaaS Alerts complements configuration management tools rather than replacing them. Many MSPs use it alongside another platform for a more complete security picture.

8. BetterCloud

BetterCloud is a broad SaaS management platform where M365 is one of many supported applications. The platform handles user lifecycle management and data governance across multiple SaaS tools.

BetterCloud is less MSP-centric than purpose-built alternatives, though it offers value for organizations managing diverse SaaS portfolios beyond just Microsoft 365.

How to choose the right Microsoft 365 management platform for your MSP

Match the tool to your service portfolio and client license tiers

Consider whether the platform works across Business Basic, Business Premium, E3, and E5 without requiring premium licensing on every tenant. A tool that only performs well on E5 won’t help you standardize security across your entire client base.

The licensing question matters both for the platform itself and for the Microsoft features it manages. Conditional Access management, for example, requires clients to have appropriate licensing regardless of which platform you use.

Evaluate operational efficiency and L1 to L2 enablement

The best platforms let junior technicians handle routine security tasks confidently. If a tool still requires senior engineers for basic operations, you haven’t actually reduced your operational burden—you’ve just moved it from scripts to a different interface.

Look for platforms with clear workflows, good documentation, and guardrails that prevent accidental misconfigurations.

Verify security, compliance, and SOC 2 posture

For regulated clients, confirm the vendor holds SOC 2 Type II certification, supports GDPR requirements, and aligns with CIS or NIST frameworks. These credentials matter during client security reviews and can become deal-breakers for prospects in healthcare, finance, or government-adjacent industries.

Standardize Microsoft 365 security without a golden tenant using Augmentt

Augmentt addresses the core pain points covered throughout this article. The platform requires no golden tenant, delivers consistent security across all license tiers, and provides one-click baselines, automated breach response, and branded reporting.

L1 and L2 technicians can deliver enterprise-grade security without escalating to senior engineers or maintaining custom scripts. SOC 2 Type II certification and alignment with CIS, NIST, and Microsoft Secure Score frameworks provide the compliance foundation regulated clients expect.

Book a demo to see Augmentt in action →

Frequently asked questions about Microsoft 365 management without PowerShell

Is CIPP safe to use in production MSP environments?

CIPP is community-maintained open-source software. Safety depends on your team’s ability to audit code, apply updates promptly, and secure your Azure hosting environment. Many MSPs use CIPP successfully in production, though you’re accepting responsibility for ongoing maintenance and security.

Do PowerShell alternatives require Microsoft 365 Business Premium licensing?

Most commercial platforms work across all M365 license tiers. However, certain advanced features like Conditional Access management require the client tenant to have appropriate licensing. That’s a Microsoft limitation, not a platform limitation.

How does GDAP affect the choice between scripts and management platforms?

GDAP (Granular Delegated Admin Privileges) replaced DAP and requires tools to support granular role assignments. Modern platforms handle GDAP natively, while legacy scripts often require significant rework to accommodate the new permission model.

Can multi-tenant management platforms fully replace Microsoft 365 Lighthouse?

Yes. Commercial platforms typically offer everything Lighthouse provides plus automated remediation, PSA integration, and branded reporting. Many MSPs use Lighthouse as a free starting point before moving to more capable tools as their requirements grow.

Will moving off PowerShell scripts break existing automations?

Most platforms support APIs and webhook integrations, allowing you to migrate automations incrementally. You can start with the highest-maintenance scripts and expand from there rather than replacing everything at once.

---

Photo by Glenn Carstens-Peters on Unsplash