Augmentt Blogs

June 2026 brings a dense wave of Microsoft 365 changes across identity, security, licensing, and AI, several of which require MSP action before deadlines hit.

Intune

Hotpatching Enabled by Default Starting May 2026 Security Update

Windows Autopatch now enables hotpatch updates by default for all eligible devices, reducing the number of restarts required during patch deployment. If your clients aren’t ready for hotpatching, you need to opt out at the tenant or policy level proactively; waiting means it activates automatically across all eligible managed devices.

Windows 11 25H2 Security Baseline Now Available

The updated security baseline for Windows 11 version 25H2 is available in Intune, bringing new settings, updated defaults, and retired settings. Existing baseline profiles do not auto-update, so you must manually create or migrate profiles to the new baseline and review every setting change before pushing to client devices.

Microsoft Edge v139 Security Baseline Released

An updated Edge security baseline with new settings and revised defaults is now available in Intune. Like the Windows baseline, existing Edge profiles require a manual update — test in a pilot group before broad deployment to avoid breaking browser configurations across client tenants.

Platform SSO During macOS ADE Now Supported

macOS devices enrolled via Automated Device Enrollment can now complete Platform SSO registration during the setup flow, giving users immediate Entra ID resource access at first desktop login. This requires specific prerequisites: a settings catalog policy, Company Portal 5.2604.0 or later, a configured ADE policy, and macOS 26 or later. MSPs deploying new Mac fleets should update enrollment profiles now to take advantage of this.

Intune RBAC Roles Now Inherit Copilot in Intune Access Automatically

All built-in and custom Intune RBAC roles now automatically receive Security Copilot contributor access when Intune is enabled as a Copilot data source, no separate role assignments needed. MSPs should review whether this expanded access aligns with the least-privilege model in place for client tenants, since it applies to custom roles as well.

Entra ID

Microsoft Entra Connect Sync to Cloud Sync Migration Announced — Phased Starting July 2026

Microsoft will begin notifying customers via M365 Message Center and Entra Connect Health of their transition timelines from Connect Sync to Cloud Sync starting July 2026. MSPs managing hybrid identity environments need to assess client readiness now, identify configurations not yet supported by Cloud Sync, and start migration planning before assigned transition windows arrive.

Hard Match Blocked for Users with Entra Roles — Effective June 1, 2026

Entra Connect Sync and Cloud Sync can no longer hard-match a new AD object to an existing cloud user that holds Entra ID roles, effective June 1. This is a breaking change for any migration or re-sync scenario involving privileged cloud accounts. Audit hybrid environments for affected users immediately and use the new Graph API recovery path if hard-match errors occur.

Entra Backup and Recovery Now in Public Preview

Built-in daily snapshots of critical directory objects (users, groups, apps, Conditional Access policies, and more) are now available in public preview with 5-day retention and admin-initiated restore capability. This gives MSPs a native safety net for accidental tenant configuration changes; familiarize yourself with the restore workflow and add it to your incident response runbooks.

SAP SuccessFactors Provisioning Must Migrate from Basic Auth by November 2026

Workload identity-based authentication for SAP SuccessFactors provisioning is now in public preview, with basic auth deprecation set for November 2026. MSPs managing SuccessFactors provisioning integrations need to plan and execute migration to workload identity auth before the deadline to avoid provisioning failures.

Sensitivity Labels Now Supported on Entra Security Groups (Preview)

Microsoft Purview sensitivity labels can now be applied to Entra cloud security groups to govern settings like guest access. MSPs managing group-based access controls should evaluate whether existing label policies need updating to cover this new scope.

Defender

Local AI Agent Discovery and Runtime Protection on Windows Endpoints (Preview)

Defender now automatically discovers local AI agents — coding agents, IDE extensions, desktop AI assistants — on onboarded Windows devices and can block risky activity in the agent loop at runtime. Before broad enforcement, MSPs should assess whether any legitimate local AI tools used by client employees will generate alerts and tune accordingly.

Automatic Attack Disruption Can Now Isolate Compromised Devices (Preview)

High-confidence incident analysis can now trigger automatic network isolation of devices identified as active attacker footholds, with time-limited scope and operator release capability. This is a significant operational change. MSPs must ensure clients understand that devices may be isolated without manual intervention, and SOC runbooks need to account for this response action.

Identity Security Dashboard and Risk Score Now in Preview

A new Identity Security dashboard surfaces identity provider coverage, non-human identities, and a 0–100 risk score per identity that can be used directly in Conditional Access policies. This gives MSPs a consolidated identity risk view across human and non-human identities; evaluate the risk score integration with Conditional Access for clients where risk-based policy enforcement makes sense.

AgentsInfo Table Replaces AIAgentsInfo in Advanced Hunting — Deadline July 1, 2026

The new unified AgentsInfo table covers all agent types; the AIAgentsInfo table retires July 1, 2026. Any custom detection rules, hunting queries, or automation referencing AIAgentsInfo must be updated before that date to avoid query failures.

Built-in Alert Tuning Rules Now Generally Available

Suppression rules for common benign activity in Defender for Endpoint and Defender for Office 365 are now GA, without affecting AIR investigations. MSPs managing high-alert-volume tenants should review which rules are active and confirm they align with client security posture before relying on suppression.

Licensing

Microsoft 365 Business Standard with Copilot and Business Premium with Copilot Become Permanent SKUs July 1, 2026

The promotional offers for M365 Business Standard with Copilot and Business Premium with Copilot transition to permanent subscriptions at $23.50 and $32 USD per user/month respectively, with new SKUs available July 1 and price list preview in Partner Center starting June 1. Update quoting tools, renewal motions, and SMB offer packaging now. Every Business Standard and Premium renewal is a built-in Copilot upsell opportunity with stable, predictable pricing.

Agent 365 Now Requires Microsoft 365 E5 as Licensing Prerequisite (Effective June 1)

New Agent 365 purchases now require M365 E5 for enterprise, F5-level Defender and Purview for frontline workers, and M365 Business Premium for SMB customers. Audit client licensing before positioning Agent 365. Clients without the prerequisite licenses will lack access to certain capabilities, which creates risk of failed deployments or uncomfortable upsell conversations mid-engagement.

Work IQ API Reaches GA June 16 with Consumption-Based Copilot Credits Billing

Work IQ API is generally available June 16; custom agents using Work IQ via Copilot Studio, Foundry, or third-party platforms are billed via Copilot Credits. Admins must enable consumptive billing before use. MSPs building or managing custom AI agents need to ensure client admins configure payment methods, access policies, and spend limits in the M365 Admin Center before June 16 to avoid service interruption or uncontrolled spend.

EEA Currency Pricing Precision Updates for Select M365/O365 SKUs Effective July 1

Minor cent-level price adjustments are coming to M365 and O365 SKUs in EUR, DKK, NOK, SEK, and CHF for EU settlement compliance, effective July 1. The amounts are small, but discrepancies in automated billing systems should be corrected proactively to avoid invoice inaccuracies for clients billed in EEA currencies.

Dynamics 365 Business Central Dual Use Rights License Keys Must Be Refreshed Every Six Months

Effective June 5, on-premises Business Central deployments via Dual Use Rights require license key download and replacement every six months. MSPs managing Business Central on-premises deployments must establish a recurring process to download and apply updated DUR license keys to prevent service interruption.

Purview

Data Security Posture Management (DSPM) New Version Now Generally Available

The updated DSPM with guided workflows for proactive risk management is now GA; partner solutions for non-Microsoft sources and the Data Security Posture Agent remain in preview. MSPs advising clients on data security governance should update deployment guidance and assess whether clients need the GA version’s administrative unit support for scoped administration.

DLP Policy Device Scoping Now Available

Endpoint DLP policies can now be scoped to specific device groups (for example, enforcing a policy only on Windows devices for Finance users, not macOS) using dynamic Entra ID device groups. MSPs should review existing Endpoint DLP policies to determine whether device-scoped rules would reduce false positives or improve coverage for clients with mixed-OS environments.

Anthropic Claude Enterprise Now Supported in DSPM (Preview)

Claude interactions can now be monitored alongside Copilot, ChatGPT Enterprise, and other AI apps in DSPM activity explorer. MSPs should configure the Anthropic Claude connector for clients with Claude Enterprise deployments so AI interaction visibility and data security controls apply consistently.

eDiscovery Review Set Limit Increased from 20 to 100

The maximum number of review sets per eDiscovery case has been raised from 20 to 100. MSPs supporting legal or compliance teams running large investigations no longer need to work around the previous limit by managing case sprawl; update client guidance accordingly.

Sensitivity Label Auto-Labeling Can Now Override Manually Applied Labels (GA)

Auto-labeling policies for SharePoint and OneDrive can now be configured to always override lower-priority labels, even if manually applied, a capability previously limited to email. This is a behavior change that could override user-applied labels on files; MSPs must review auto-labeling policy configurations for clients to confirm the override option is intentionally set and that users are informed.

Teams

Copilot Call Delegation Rolling Out to Frontier in June

Copilot can now answer incoming Teams Phone calls on a user’s behalf, capture intent, and schedule follow-ups via Microsoft Bookings when the user is unavailable. This feature requires Teams Phone licensing and may trigger questions about call recording consent and data retention. Review client policies before enabling.

Scam and Impersonation Detection Now Live

Teams now detects when callers may be impersonating trusted brands (banks, IT admins) and warns users with options to decline, leave, or report. This is a default-on security control that requires no configuration; MSPs should communicate it to clients as a meaningful reduction in social engineering risk.

Video Recap for Recorded Meetings

AI-generated narrated highlight reels are now available for recorded Teams meetings, surfacing key moments without requiring full playback. This feature uses meeting recordings and transcripts, so MSPs should confirm clients have appropriate retention and compliance policies in place for AI-generated recap content.

Recap Deletion Now Available Without Admin Setup

Meeting organizers can now permanently delete recordings, transcripts, AI summaries, and notes from the recap page via a single menu action, no admin configuration required. This self-service deletion capability may conflict with client retention policies; MSPs should verify that retention labels or compliance holds are in place to prevent premature deletion.

Mobile Queues App Now Available

The Teams Queues app for collaborative call queue management is now available on Teams mobile for iOS and Android. MSPs should validate that mobile device policies permit the app and that queue agent permissions are correctly scoped before clients start using it in the field.

Copilot

ISO/IEC 42001 Certification Expanded Across Copilot Portfolio

Microsoft has extended ISO 42001 AI management certification to Copilot Studio, GitHub Copilot, Dragon Copilot, and Copilot Health, adding to existing certifications for M365 Copilot, Security Copilot, and Microsoft Foundry. Clients in regulated industries requiring AI governance documentation can now reference expanded third-party certification coverage. Update your compliance evidence packages accordingly.

Federated Copilot Connectors via MCP Now Available

Real-time enterprise data from SaaS systems (HubSpot, Notion, LSEG, Moody’s) can now be connected to Work IQ via Model Context Protocol, with native security controls maintained. Enabling these connectors requires admin configuration and access policy review; assess data exposure risk before activating third-party connectors for clients.

Teams Meeting Watermarks Reach DoD in June

Watermark overlay of attendee email addresses on shared meeting content is rolling out to DoD environments in June, following GA in March and GCC-High in May. MSPs supporting government cloud clients should validate this feature is enabled for clients handling sensitive meeting content, as it requires organizer-level configuration in Meeting options.

Learning Agent Rolling Out in June

A new in-flow learning agent powered by Work IQ delivers personalized Copilot and AI skill-building, assessments, and roleplay practice directly within user workflows. This agent will appear in licensed tenants automatically. MSPs should be prepared to field end-user questions and advise clients on whether to promote or restrict it via policy.

Anthropic Claude Opus 4.8 and GPT-5.5 Instant Now Available in Copilot

Two new AI models are available for M365 Copilot licensed users: Claude Opus 4.8 for complex multi-step tasks and GPT-5.5 Instant for faster everyday responses. Expanded model choice increases the surface area for data handling considerations. Confirm clients understand which models are active and review any data residency or compliance implications.

Outlook

Copilot Chat Now Available in Pop-Out Windows

Copilot chat is now accessible in popped-out Outlook message windows, enabling use while reading or composing separate messages. No admin action is required, but MSPs should confirm clients with Copilot licenses have appropriate usage policies in place as this expands the Copilot surface area in Outlook.

Shared Calendars Assigned by Admin Now Appear Automatically

Calendars assigned to users by admins now populate automatically in the calendar list without any user action. This should reduce helpdesk tickets for shared calendar setup, but MSPs should verify that existing admin-assigned calendar configurations are correctly scoped to avoid unexpected calendar visibility for users.

DLP Warn Dialog Now Includes Justification and False Positive Fields

The DLP warning dialog in new Outlook for Windows now includes justification, false positive reporting, and acknowledgment fields, matching the behavior of classic Outlook. MSPs managing DLP policies should confirm that client configurations include appropriate justification options and that compliance teams are reviewing override and false positive reports.

Outlook Background Sync Now On by Default When App Is Closed

Outlook now syncs email in the background even when the app is closed; users can disable this in Settings > General > Offline. This may affect battery life and data usage on managed devices. Assess whether this behavior conflicts with client endpoint management policies or mobile device profiles.

OneDrive

Custom OneDrive Folder Name Now in Deferred Ring

Admins can now set a custom name for the local OneDrive sync folder via Group Policy, replacing the default “OneDrive – {org name}” convention. This reached the Deferred ring June 1, 2026. Shorter folder names increase available path length for nested files (relevant for clients with deep folder structures) so MSPs managing Deferred ring deployments should plan rollout and update GPO configurations.

Move Folders to OneDrive from File Explorer Now in Deferred Ring

A right-click context menu option to move local folders directly to OneDrive reached the Deferred ring June 1, 2026. This feature may prompt end users to inadvertently move large local folder structures to OneDrive; communicate expected behavior to clients and confirm storage quotas are adequate before this lands broadly.

Mark of the Web for Outlook Attachments Now in Deferred Ring

Email attachments saved to OneDrive from Outlook now include the Mark of the Web security tag, enabling Windows Protected View when opened. This reached the Deferred ring as of June 1. No admin action is required, but MSPs should be aware it may affect workflows where users rely on immediate full editing of downloaded attachments.

SharePoint

SharePoint Server Patch Released May 12, 2026

KB 5002863 (version 16.0.19725.20280) was released for SharePoint Server Subscription Edition; KB 5002870 and 5002872 for SharePoint Server 2019; KB 5002868 and 5002869 for SharePoint Server 2016. MSPs managing on-premises SharePoint farms must apply the May 2026 cumulative update to maintain security patch compliance. Schedule patching windows if you haven’t already.

Custom Skills for Copilot in SharePoint Now GA

Users can now create and save reusable, site-specific Copilot skills using natural language to automate repeatable multi-step workflows. Custom skills are user-created and site-scoped, so MSPs should assess whether clients need governance controls around skill creation to prevent unintended automation or data exposure.

June 2026 is a high-action month for MSPs, with hard deadlines around Entra hard-match changes, hotpatch opt-outs, Work IQ billing configuration, and the AgentsInfo table retirement all requiring attention before July 1. The broader theme is clear: AI capabilities are expanding rapidly across the Microsoft 365 stack, and the compliance, governance, and licensing structures around them are maturing just as fast. Staying current with these changes is the difference between managing client environments proactively and reacting to problems after they’ve already landed.

Featured image by Jonas Leupe on Unsplash

Paying for Microsoft 365 licenses that nobody uses is one of the quietest budget leaks in IT. Under annual NCE terms, every idle seat you miss at renewal locks you into another twelve months of waste.

The good news: yes, tools exist that surface unused licenses automatically without manual exports or PowerShell scripts. This guide covers how automatic detection works, what to look for in a tool, and how MSPs can reclaim idle licenses across dozens of tenants from a single dashboard.

What is an unused Microsoft 365 license

Yes, several specialized tools automatically surface unused Microsoft 365 licenses. SaaS management platforms like Zylo and Torii pull usage data and highlight idle accounts, while MSP-focused solutions like Augmentt and CoreView do the same across multiple customer tenants without manual effort.

An unused license is one assigned to a user account that shows no sign-in or app activity over a defined period, typically 30 to 90 days. This differs from an unassigned license, which sits in your subscription inventory waiting to be allocated to someone. The distinction matters because unused licenses quietly drain budget month after month, while unassigned ones are at least visible when you check your subscription count.

Why detecting unused Microsoft 365 licenses matters

Idle licenses create problems that compound over time. The longer they go unnoticed, the more they cost you in dollars, security exposure, and audit headaches.

Cut shelfware and renewal costs

Paying for licenses nobody uses inflates your renewal bills. Under Microsoft’s New Commerce Experience (NCE) annual terms, you cannot reduce seat counts mid-contract. Every unused license you miss at renewal locks you into another year of waste.

For organizations with a few hundred seats, even a small percentage of idle licenses can translate to thousands of dollars annually. That money could go toward security tools, staffing, or other priorities instead of inflating SaaS costs.

Tighten security during offboarding

Licenses tied to departed or inactive users can become Microsoft 365 security risks if the accounts remain enabled. A former employee’s mailbox with an active license is still a valid target for credential stuffing or phishing attempts.

Linking license detection to your offboarding process closes this gap. When you catch idle accounts early, you can disable them before they become a liability.

Stay ready for audits and true-ups

Accurate license inventory simplifies Microsoft true-ups and compliance checks. When you know exactly who is using what, you avoid scrambling during an audit or overpaying because your records do not match reality.

How to find unused Microsoft 365 licenses in the admin center

The manual route starts in the Microsoft 365 Admin Center. You navigate to Reports, then Usage, select the relevant usage report, and review the last activity date for each user. From there, you can export the data to Excel for further analysis.

Here is the basic process:

• Sign in to admin.microsoft.com
• Go to Reports, then Usage
• Select the usage report for the app you want to check, such as Exchange, Teams, or OneDrive
• Review the last activity date column
• Export the report if you want to filter or share it

This approach works for a single tenant, but it does not scale. You will repeat the process for every customer, and there is no automation. Just manual exports and spreadsheets that get stale the moment you finish them.

How to detect unused Microsoft 365 licenses with PowerShell

PowerShell combined with Microsoft Graph lets you pull sign-in logs and compare them against assigned licenses programmatically. You can script a threshold check, flagging anyone who has not signed in for 60 days, and run it on a schedule.

• Last sign-in date: Pulled from Azure AD sign-in logs via Graph API
• Assigned licenses: Retrieved with Get-MgUserLicenseDetail
• Threshold comparison: Your script flags users inactive beyond your policy window

This method is flexible and free, but it requires scripting skills and ongoing maintenance. Scripts break when Microsoft updates APIs, and you have to manage credentials and permissions for each tenant. For MSPs managing dozens of customers, running and updating scripts per tenant quickly becomes unsustainable.

How to detect unused Microsoft 365 licenses automatically

Automated tools handle the heavy lifting by continuously aggregating activity data and surfacing idle accounts without manual intervention. The workflow typically follows a predictable pattern.

Step 1. Define what inactive means

Most tools let you set an inactivity threshold, commonly 30, 60, or 90 days of no sign-in or app usage. Your policy here aligns with HR and offboarding workflows so you are not flagging someone on extended leave or sabbatical.

The threshold you choose depends on your organization. A 30-day window catches idle accounts quickly but may generate false positives. A 90-day window is more conservative but lets waste accumulate longer.

Step 2. Pull sign-in and app activity signals

Automated platforms pull from multiple data sources: Azure AD sign-in logs, Microsoft 365 usage reports, and app-level activity like mail sent, Teams calls, or SharePoint edits. Aggregating all of these signals gives a fuller picture than sign-in data alone.

Someone might sign in once a month to check email but never touch Teams or OneDrive. A tool that only looks at sign-in dates would miss that the Teams license is going unused.

Step 3. Flag idle and misassigned licenses

The tool compares activity against assigned licenses to surface accounts with no usage. Some platforms also catch misassignment, like an E5 license assigned to someone who only uses email. In that case, you could downgrade to a cheaper SKU and save the difference.

Step 4. Trigger alerts or PSA tickets

Good tools push alerts via email, webhook, or directly into your PSA. Technicians can act without logging into another dashboard, and nothing slips through the cracks.

For MSPs, PSA integration is particularly valuable. An alert that creates a ticket in ConnectWise or Autotask means the work gets tracked and assigned like any other service request.

Step 5. Automate removal or downgrade

Some platforms offer auto-remediation. After a grace period or approval workflow, the tool revokes or downgrades the license automatically. This removes the manual step entirely and ensures idle licenses do not linger for months.

Step 6. Tie detection into offboarding

Linking license detection to your offboarding process ensures licenses are reclaimed as soon as a user departs, not months later when someone finally notices the account is still active. This connection between HR events and license management is where automation really pays off.

What to look for in a Microsoft 365 license detection tool

Not all tools offer the same depth. Some generate reports you still have to act on manually. Others automate the entire workflow from detection to reclamation. Here is what separates a basic report from a platform you can rely on.

Multi-tenant visibility

For MSPs, the tool aggregates license data across all customer tenants in one view. Jumping between admin centers is slow and error-prone, and it does not scale when you manage 50 or 100 customers.

Activity-based inactivity detection

Look for tools that go beyond last sign-in and examine actual app usage, including mail sent, Teams calls, and SharePoint edits. A user who signs in but never touches an app is still wasting a license.

Group-based licensing support

Azure AD group-based licensing can complicate reclamation. If a user gets their license through group membership, removing the license directly will not work. The tool you choose understands group membership so you do not accidentally break assignments or create conflicts.

Automated reclamation actions

Reports are helpful, but one-click or scheduled removal actions save time and reduce human error. The fewer manual steps between detection and action, the more likely idle licenses actually get reclaimed.

Brandable license reporting

For MSPs, the ability to generate client-facing reports with your logo and branding turns license management into a visible service. Customers see the value you deliver, and you have documentation for quarterly business reviews.

Tools that automatically surface unused Microsoft 365 licenses

Microsoft 365 Admin Center

Free and built-in, but manual and single-tenant only. Good for small organizations checking ad hoc, but not practical for ongoing management or multi-tenant environments.

PowerShell and Microsoft Graph

Free and flexible, yet requires scripting skills and ongoing maintenance. You can build exactly what you want, but you also own all the upkeep. For MSPs managing many tenants, the maintenance burden often outweighs the cost savings.

SaaS management platforms

Tools like Zylo, Torii, and BetterCloud aggregate SaaS usage including Microsoft 365. They are designed for enterprise IT teams managing a single large environment, not MSP multi-tenant workflows. If you only manage one organization, they work well. If you manage many, the per-tenant setup becomes cumbersome.

MSP-focused platforms

Purpose-built for managing many customer tenants, examples include Augmentt, CoreView, and CIPP. These offer multi-tenant dashboards, automated alerts, and PSA integrations that fit how MSPs actually work.

How MSPs detect unused Microsoft 365 licenses across multiple tenants

Jumping between tenants is slow and error-prone. MSP-focused tools connect via CSP Partner Portal or delegated admin and pull license and usage data across all tenants into a single dashboard.

• Single-pane visibility: See all tenants without switching contexts or logging in and out of different admin centers
• Per-tenant policies: Set different inactivity thresholds by customer based on their business needs
• Automated customer reports: Schedule branded reports for each client that show license utilization and savings opportunities

This approach turns license management from a reactive chore into a proactive service you can deliver consistently across your entire customer base.

How to reclaim unused Microsoft 365 licenses safely

Reclaiming a license without proper steps can disrupt users or lose data. A safer approach involves a few key practices.

• Notify stakeholders: Email the user or their manager before revoking to confirm the account is truly inactive
• Disable first: Block sign-in or convert the mailbox to shared before deleting the account entirely
• Export data: Ensure OneDrive and mailbox content are backed up or transferred to another user
• Log the change: Record the removal in your PSA or ticketing system for audit purposes

Some platforms offer a grace period or approval workflow so nothing gets revoked without review. This extra step prevents accidental removal of licenses from users who are simply on vacation or working remotely with limited connectivity.

Automate unused Microsoft 365 license detection with Augmentt

Augmentt surfaces unused licenses automatically across all customer tenants from a single dashboard. You get multi-tenant license reporting, one-click reclamation actions, and PSA-integrated alerts, so your team can act fast without jumping between portals.

Ready to stop paying for licenses nobody uses? See how Augmentt simplifies Microsoft 365 license management for MSPs.

Frequently asked questions about detecting unused Microsoft 365 licenses

What counts as an inactive Microsoft 365 user?

An inactive user is typically someone who has not signed in or used any Microsoft 365 app, including Exchange, Teams, SharePoint, or OneDrive, within a defined period. Most organizations use a threshold of 30 to 90 days depending on their policy and business context.

Can you remove a Microsoft 365 license without losing user data?

Yes. Removing a license does not immediately delete mailbox or OneDrive data. However, the data enters a retention window and will eventually be purged unless you convert the mailbox to shared or export the content first. The retention period varies based on your tenant settings.

Does Microsoft NCE or CSP billing affect reclaiming unused licenses?

Under NCE annual terms, you cannot reduce seat count mid-term. Reclaimed licenses sit unused until renewal, so detecting them early helps you right-size at the next renewal date rather than paying for another year of waste.

How often should you audit Microsoft 365 license usage?

Most organizations run a usage audit monthly or quarterly. Automated tools surface idle licenses continuously, so you catch issues before the next billing cycle rather than discovering them during annual renewal planning.

Can unused Microsoft 365 licenses be reassigned automatically?

Some platforms support auto-reassignment workflows where a reclaimed license is added back to an available pool and assigned to a new user via group-based licensing or provisioning rules. This keeps licenses in circulation rather than sitting idle after reclamation.

Photo by Ed Hardie on Unsplash

PowerShell scripts were the go-to solution for Microsoft 365 automation…until they weren’t. Managing 50 tenants with custom scripts means maintaining 50 potential points of failure, and every Microsoft Graph API update threatens to break something you don’t have time to fix.

Modern multi-tenant management platforms now handle security baselines, policy enforcement, and breach response without requiring you to write or maintain code. This guide covers why MSPs are moving away from scripts, what to look for in a replacement platform, and how to evaluate the leading alternatives—including options that work without a golden tenant.

Why MSPs are moving away from PowerShell scripts for Microsoft 365 management

Several platforms now handle Microsoft 365 management without requiring you to write or maintain PowerShell code. Tools like M365 Manager Plus, CoreView, and Augmentt provide interfaces for user provisioning, license management, and security configuration that work across multiple tenants. For MSPs managing many clients, platforms such as CIPP, Microsoft Lighthouse, and Nerdio Manager offer centralized control without relying on a golden tenant as a configuration template.

The shift reflects a practical reality. When you’re responsible for 30, 50, or 100 tenants, the hours spent writing and debugging scripts start to outweigh the benefits. What once felt like automation becomes another maintenance burden.

Brittle scripts and constant Microsoft Graph API changes

Microsoft updates the Graph API and deprecates cmdlets on its own schedule, often with limited advance notice. A script that ran perfectly last quarter can fail after an API version change, and the failure might be silent—no error message, just missing data or incomplete actions.

Common breakage scenarios include:

• Deprecated authentication methods: Basic auth retirement broke thousands of legacy scripts when Microsoft enforced the change
• Cmdlet parameter changes: Updated modules introduce new required parameters that existing scripts don’t account for
• Throttling policy updates: Scripts that worked at low volume hit rate limits as your client count grows

Each of these scenarios means unplanned troubleshooting time, usually during a client emergency.

Single point of failure on one scripting expert

Most MSPs have one person who truly understands the PowerShell scripts running in production. Maybe two, if you’re lucky. When that person takes vacation, gets sick, or leaves the company, the scripts become a black box.

L1 and L2 technicians end up escalating routine tasks to senior engineers simply because fixing the issue requires modifying code they didn’t write and don’t fully understand. That’s an expensive bottleneck, and it doesn’t scale.

Portal fatigue across dozens of tenants

Portal fatigue is the exhaustion that comes from logging in and out of multiple Microsoft admin centers throughout the day. If you manage 50 tenants and want to check MFA status in each one, that’s 50 separate login sessions. Conditional Access policies can make this even more tedious, requiring additional authentication steps for each tenant.

The cognitive load compounds quickly. Technicians lose context when switching between tenants, and the repetitive clicking increases the chance of mistakes.

No audit trail for configuration drift

PowerShell scripts rarely log what changed, when it changed, or who ran the script. When a client asks why a Conditional Access policy looks different than it did three months ago, you’re left searching through command history or making educated guesses.

This gap makes compliance reporting difficult and slows down troubleshooting when something breaks.

What is a golden tenant and why it falls short for multi-tenant MSPs

A golden tenant is a reference Microsoft 365 tenant configured with your ideal security settings. The idea is to set it up once, then use it as a template to replicate configurations across client tenants. In theory, this approach standardizes your deployments. In practice, it creates its own set of problems.

Extra licensing costs and tenant overhead

A golden tenant requires its own Microsoft 365 licenses just to exist. You’re paying for a tenant that serves no actual users—it only holds configuration settings. If you work with clients across different industries or compliance requirements, you might end up maintaining multiple golden tenants, multiplying the cost.

Configuration drift between master and client tenants

Client tenants inevitably diverge from the golden tenant over time. Someone makes a manual change to address a specific client request. A new Microsoft feature rolls out and gets enabled differently across tenants. A technician adjusts a setting during troubleshooting and forgets to document it.

There’s no automatic mechanism to detect or correct this configuration drift. The golden tenant becomes a snapshot of what you intended, not a reflection of what actually exists.

Limited fit for mixed client license tiers

A golden tenant configured for Business Premium won’t apply cleanly to clients running Business Basic. Features like Conditional Access, Defender, and Intune require specific licensing tiers. Your template either excludes those settings entirely or fails when applied to tenants that lack the required licenses.

This mismatch forces you to maintain multiple golden tenants or accept that your “standard” configuration only works for a subset of clients.

Core capabilities to look for in a PowerShell alternative

When evaluating platforms, focus on capabilities that directly address the pain points above. The right tool reduces scripting overhead while giving you more visibility and control.

Multi-tenant policy and security baseline management

Look for platforms that let you push Conditional Access, Defender, and Intune policies across all tenants from a single dashboard. This capability replaces the need to write tenant-specific scripts or log into each admin center individually.

The key distinction is centralized visibility combined with centralized action. Seeing all your tenants in one place is helpful, but being able to make changes across them from that same view is what actually saves time.

One-click application of NIST, CIS, and Secure Score best practices

Pre-built security templates aligned to recognized frameworks eliminate hours of research and manual configuration. You select a baseline, apply it to the relevant tenants, and move on.

Frameworks worth looking for include:

• CIS Benchmarks: Consensus-based security configurations maintained by the Center for Internet Security
• NIST guidelines: Federal standards that many regulated industries reference
• Microsoft Secure Score: Microsoft’s own scoring system for tenant security posture

Automated breach detection and auto-remediation

Real-time alerting on risky sign-ins matters, but automatic response actions matter more. The ability to block a compromised user or reset a password without waiting for a technician to respond reduces the window of exposure significantly.

Look for platforms that let you customize alert thresholds and remediation actions. Not every risky sign-in warrants the same response, and overly aggressive automation can create its own problems.

Branded reporting and risk assessments

White-label reports for QBRs and prospecting eliminate the manual export work that eats into billable hours. Automated scheduling means reports go out on time without technician involvement.

The best platforms also include risk assessment templates you can use during sales conversations, turning security posture into a tangible deliverable.

GDAP and CSP onboarding without a golden tenant

Direct connection via GDAP (Granular Delegated Admin Privileges)Direct connection via GDAP (Granular Delegated Admin Privileges) or Magic Link removes the need for a reference tenant entirely. You onboard clients in minutes rather than hours, with granular role assignments built into the connection process.

GDAP replaced the older DAP model and requires more specific permission scoping. Platforms that handle this natively save you from manually configuring access for each new client.

Categories of Microsoft 365 management tools that replace PowerShell

Before looking at specific products, it helps to understand the different categories of tools available. Each category serves different needs and comes with different tradeoffs.

Native Microsoft tools like Lighthouse and the Admin Center

Microsoft 365 Lighthouse is free for CSP partners and provides basic cross-tenant visibility. You can compare Secure Scores across tenants and see which clients have risky configurations.

However, Lighthouse lacks advanced automation, PSA integration, and the remediation workflows that make management efficient at scale. It’s a reasonable starting point, but most MSPs find they outgrow it quickly.

Community platforms like CIPP

CIPP (CyberDrain Improved Partner Portal) is open-source and highly customizable. The community actively develops new features, and the platform handles many common multi-tenant tasks well.

The tradeoff is that you’re responsible for Azure hosting, updates, security patches, and troubleshooting. There’s no vendor support line to call when something breaks at 2 AM.

Commercial multi-tenant platforms built for MSPs

Purpose-built SaaS tools come with support, compliance certifications, and turnkey onboarding. Platforms in this category typically offer SOC 2 Type II compliance and align with frameworks like CIS and NIST out of the box.

Augmentt falls into this category, designed specifically for MSPs managing multiple Microsoft 365 tenants without requiring a golden tenant or premium licensing across all clients.

RMM and PSA-integrated management tools

Endpoint-focused platforms are adding M365 modules to their feature sets. If you’re already invested in a particular RMM, check whether its M365 capabilities meet your actual security and management requirements.

The depth of M365 security baselines varies significantly across RMM platforms. Some offer robust policy management while others provide only basic visibility.

Best alternatives to PowerShell scripts for Microsoft 365 management

1. Augmentt Secure Autopilot

Augmentt is built specifically for MSPs managing multiple Microsoft 365 tenants. The platform works without a golden tenant, supports all license tiers, and enables L1/L2 technicians to handle tasks that previously required senior engineers or custom scripts.

Key capabilities include:

• One-click security baselines aligned to CIS, NIST, and Secure Score
• Automated breach detection with configurable auto-remediation
• Branded reporting and unlimited risk assessments
• SOC 2 Type II certification with native GDAP support

See how Augmentt simplifies multi-tenant M365 management →

2. CIPP (CyberDrain Improved Partner Portal)

CIPP is a free, community-driven platform with strong automation capabilities. The active development community adds features regularly, and the platform handles many common MSP workflows well.

You’ll need Azure hosting and technical expertise to maintain it. Many MSPs use CIPP successfully, though the lack of vendor support means you’re responsible for troubleshooting and security updates.

3. Microsoft 365 Lighthouse

Lighthouse provides basic tenant comparison and Secure Score visibility at no additional cost beyond your CSP agreement. It’s a reasonable starting point for MSPs new to multi-tenant management.

Most MSPs find they outgrow Lighthouse as their client base expands and their security requirements become more sophisticated.

4. Nerdio Manager for MSP

Nerdio excels at Intune, Azure Virtual Desktop, and endpoint lifecycle management. The platform integrates well with existing Microsoft infrastructure and provides strong device management capabilities.

M365 security baseline features are less comprehensive than dedicated platforms, so Nerdio works best for MSPs whose primary focus is endpoint and infrastructure management.

5. CoreView

CoreView targets enterprise-grade M365 management with deep automation and governance features. The platform offers extensive customization and handles complex organizational structures well.

Pricing may be prohibitive for smaller MSPs, though larger organizations and enterprises often find value in its breadth of capabilities.

6. Inforcer

Inforcer focuses on policy management and compliance reporting for MSPs. The platform emphasizes security baseline enforcement and provides detailed compliance documentation.

As a newer entrant, Inforcer continues to expand its feature set and has positioned itself competitively against more established players.

7. SaaS Alerts

SaaS Alerts monitors behavior and breach indicators across SaaS applications including Microsoft 365. The platform focuses on detecting anomalous activity rather than configuration management.

SaaS Alerts complements configuration management tools rather than replacing them. Many MSPs use it alongside another platform for a more complete security picture.

8. BetterCloud

BetterCloud is a broad SaaS management platform where M365 is one of many supported applications. The platform handles user lifecycle management and data governance across multiple SaaS tools.

BetterCloud is less MSP-centric than purpose-built alternatives, though it offers value for organizations managing diverse SaaS portfolios beyond just Microsoft 365.

How to choose the right Microsoft 365 management platform for your MSP

Match the tool to your service portfolio and client license tiers

Consider whether the platform works across Business Basic, Business Premium, E3, and E5 without requiring premium licensing on every tenant. A tool that only performs well on E5 won’t help you standardize security across your entire client base.

The licensing question matters both for the platform itself and for the Microsoft features it manages. Conditional Access management, for example, requires clients to have appropriate licensing regardless of which platform you use.

Evaluate operational efficiency and L1 to L2 enablement

The best platforms let junior technicians handle routine security tasks confidently. If a tool still requires senior engineers for basic operations, you haven’t actually reduced your operational burden—you’ve just moved it from scripts to a different interface.

Look for platforms with clear workflows, good documentation, and guardrails that prevent accidental misconfigurations.

Verify security, compliance, and SOC 2 posture

For regulated clients, confirm the vendor holds SOC 2 Type II certification, supports GDPR requirements, and aligns with CIS or NIST frameworks. These credentials matter during client security reviews and can become deal-breakers for prospects in healthcare, finance, or government-adjacent industries.

Standardize Microsoft 365 security without a golden tenant using Augmentt

Augmentt addresses the core pain points covered throughout this article. The platform requires no golden tenant, delivers consistent security across all license tiers, and provides one-click baselines, automated breach response, and branded reporting.

L1 and L2 technicians can deliver enterprise-grade security without escalating to senior engineers or maintaining custom scripts. SOC 2 Type II certification and alignment with CIS, NIST, and Microsoft Secure Score frameworks provide the compliance foundation regulated clients expect.

Book a demo to see Augmentt in action →

Frequently asked questions about Microsoft 365 management without PowerShell

Is CIPP safe to use in production MSP environments?

CIPP is community-maintained open-source software. Safety depends on your team’s ability to audit code, apply updates promptly, and secure your Azure hosting environment. Many MSPs use CIPP successfully in production, though you’re accepting responsibility for ongoing maintenance and security.

Do PowerShell alternatives require Microsoft 365 Business Premium licensing?

Most commercial platforms work across all M365 license tiers. However, certain advanced features like Conditional Access management require the client tenant to have appropriate licensing. That’s a Microsoft limitation, not a platform limitation.

How does GDAP affect the choice between scripts and management platforms?

GDAP (Granular Delegated Admin Privileges) replaced DAP and requires tools to support granular role assignments. Modern platforms handle GDAP natively, while legacy scripts often require significant rework to accommodate the new permission model.

Can multi-tenant management platforms fully replace Microsoft 365 Lighthouse?

Yes. Commercial platforms typically offer everything Lighthouse provides plus automated remediation, PSA integration, and branded reporting. Many MSPs use Lighthouse as a free starting point before moving to more capable tools as their requirements grow.

Will moving off PowerShell scripts break existing automations?

Most platforms support APIs and webhook integrations, allowing you to migrate automations incrementally. You can start with the highest-maintenance scripts and expand from there rather than replacing everything at once.

Photo by Glenn Carstens-Peters on Unsplash

May 2026 is packed with Microsoft 365 updates hitting identity, device management, security, licensing, and AI, and some of them come with hard deadlines you really can’t ignore.

This isn’t an exhaustive list of everything Microsoft shipped this month. Instead, we’ve pulled out the changes that actually matter for how you manage tenants, keep clients protected, control costs, and stay ahead of what’s coming.

Intune

Higher-Frequency Windows App Inventory Updates

App inventory now refreshes most active Windows devices multiple times per day, replacing the previous 7-day cycle. The expanded data includes install paths, uninstall commands, architecture, and per-user install scope. This capability requires a new device configuration policy targeting Entra-enrolled Windows 11 devices; it does not activate automatically. Deploy the policy to start benefiting from near-real-time software asset visibility for compliance and vulnerability management.

Modernized SSO for Linux via Microsoft Identity Broker

A new C++ identity broker replaces the legacy Java broker for Linux endpoints, enabling phishing-resistant MFA (CBA, smart cards, PIV keys), full Entra ID device join, and Conditional Access enforcement. The Java runtime dependency is removed, which reduces the attack surface and simplifies deployment. MSPs managing Linux fleets can now enforce the same Zero Trust controls already in place for Windows and macOS.

visionOS and tvOS Automated Device Enrollment (Including Government Cloud)

Userless Automated Device Enrollment for Apple TV and Vision Pro devices is now available in Intune Plan 2, including GCC High and DoD environments, with remote management actions and custom profile support. This enables MSPs to manage shared-use Apple devices — conference rooms, kiosks, training headsets — in regulated environments. Confirm Intune Plan 2 licensing is in place before attempting deployment.

Managed Apple Account Restriction to Org-Owned Devices

Intune now allows organizations to restrict Managed Apple Accounts to organization-owned devices only, blocking personal Apple IDs on corporate hardware. This is a critical control for regulated clients in financial services, healthcare, and other sectors where corporate identity data must not reside on unmanaged personal devices.

Entra ID

Entra Connect Sync to Cloud Sync Migration — Plan for Change

Starting July 2026, Microsoft will begin phased notifications to customers to migrate from Entra Connect Sync to cloud-native Entra Cloud Sync, with initial waves targeting tenants with straightforward configurations. MSPs managing hybrid identity environments need to start assessing client readiness now. Review the feature comparison guide, identify which tenants are likely in early waves, and build migration runbooks before notifications arrive.

Hard Match Blocked for Users with Entra Roles (Effective June 1, 2026)

Effective June 1, 2026, Entra Connect Sync and Cloud Sync will block hard-matching new AD objects to existing cloud users that hold Entra roles. This change prevents account takeover via AD attribute manipulation. MSPs must audit any sync configurations that rely on hard-matching privileged accounts before June 1. Review audit logs for recent OnPremisesObjectIdentifier changes on role-assigned users to identify exposure.

SCIM Provisioning Apps Moving to Modern Authentication — Plan for Change

Provisioning jobs using OAuth 2.0 Authorization Code grant will need to be updated to OAuth 2.0 Client Credentials or workload identity federation; timing varies by application. Some gallery apps that cannot support modern auth may be retired entirely. MSPs managing SaaS provisioning integrations should inventory affected apps now and plan reconfiguration ahead of the relevant deadlines.

SAP SuccessFactors Provisioning Moving to Workload Identity Auth (Basic Auth Deprecated November 2026)

A new workload identity-based authentication option for SAP SuccessFactors provisioning is available from May 2026. SAP is deprecating basic auth by November 2026, and no automatic migration will occur. MSPs managing SuccessFactors integrations must migrate provisioning jobs before that deadline to avoid integration failures.

Entra Backup and Recovery (Public Preview)

Entra Backup and Recovery is now in public preview, providing a built-in daily backup of critical directory objects (users, groups, apps, Conditional Access policies, and more) with 5-day retention for P1/P2 tenants, plus difference reports and recovery jobs. This gives MSPs a native safety net for accidental or malicious tenant changes. Evaluate it as a complement to or replacement for third-party backup tooling for Entra objects.

Defender

Custom Data Collection Now Generally Available

Custom telemetry collection rules are now GA, with the per-rule event limit increased from 25,000 to 75,000 events per device per 24-hour window. MSPs running advanced threat hunting or specialized monitoring for clients can now deploy custom collection rules in production with confidence and higher event thresholds.

Secure Boot 2023 Certificate Recommendation in Microsoft Secure Score

A new Secure Score recommendation identifies devices not yet transitioned to Secure Boot 2023 certificates, ahead of the June 2026 expiration of older certificates. Devices remaining on expired Secure Boot certificates will lose early-boot security protections. MSPs must identify and remediate affected devices across client fleets before June 2026.

Selective Response Actions for High-Value Assets (Preview)

Admins can now restrict which response actions — isolation, containment, and others — can be applied to designated Tier-0 and high-value devices during security operations. This prevents accidental isolation of critical infrastructure during incident response. MSPs should define high-value asset policies for clients with sensitive operational systems before this feature reaches GA.

Linux Offline Security Intelligence Update Configuration via Defender and Intune Portals

Offline security intelligence update settings for Linux endpoints can now be configured directly from the Defender or Intune portal, eliminating the need for manual endpoint configuration. MSPs supporting clients with offline or air-gapped Linux fleets should migrate to portal-based configuration to simplify ongoing management.

Licensing

Microsoft 365 Commercial Price Increase Effective July 1, 2026

Prices increase July 1, 2026 for Office 365 E3/E5, Microsoft 365 E3/E5, Business, Frontline, EMS, Windows, Entra P1/P2, and per-device SKUs. Existing customers on multi-year agreements are protected until their next renewal after July 1. MSPs must review all client renewal dates immediately; customers renewing before July 1 can lock in current pricing, while those renewing after will pay the new rates.

New Capabilities Bundled into Existing SKUs (Rolling Out CY26 Q3, Complete by August 1, 2026)

Microsoft 365 E3/E5 and EMS E3 will gain Intune Remote Help, Advanced Analytics, Intune Plan 2, Privilege Management, Microsoft Cloud PKI, Intune Application Management, and Defender for Office 365 Plan 1 at no additional cost, completing rollout by August 1, 2026. Clients currently paying for standalone Intune Suite add-ons or Defender for Office P1 may be able to reduce licensing costs. Audit client add-on subscriptions against the new bundle inclusions before August 2026.

Microsoft 365 E5 Now Includes Security Copilot (400 SCUs per 1,000 Licenses/Month)

E5 customers will receive Security Copilot capacity automatically — 400 SCUs per month per 1,000 seats, up to a maximum of 10,000 SCUs per month — with 30-day advance notice sent before activation. MSPs managing E5 tenants must prepare for this activation: review deployment documentation, ensure proper role assignments, and communicate the change to clients before their activation window opens.

Microsoft 365 E7 Pricing Unchanged but Receives E5 Packaging Changes

E7 pricing is not affected by the July 2026 increase, but all new capabilities added to E5 will also apply to E7. Clients on E7 should be informed they will receive the same new feature inclusions as E5 customers — relevant context for clients evaluating whether to upgrade or remain on E7.

Purview

Data Security Posture Management (DSPM) Now Generally Available

The new unified DSPM is GA, combining the previous DSPM and DSPM for AI (classic) versions into a single experience with guided workflows, posture reports, AI observability, and item-level oversharing remediation for SharePoint. MSPs advising clients on data security strategy now have a GA tool for proactive risk management and AI governance. Evaluate it for clients with Copilot deployments or active data compliance requirements.

Data Security and Compliance Protections for Microsoft Agent 365 (GA)

Purview now provides GA-level data security and compliance coverage for Agent 365, including sensitivity label enforcement and compliance policy application to agent interactions. As clients deploy AI agents, MSPs must ensure Purview policies extend to agent activity. Include these controls in Copilot and agent deployment checklists going forward.

Sensitivity Label Auto-Labeling Policy Enhancement — Override Lower-Priority Labels (GA)

Auto-labeling policies for SharePoint and OneDrive files can now be configured to always override existing lower-priority labels, including manually applied ones. This strengthens automated data classification enforcement for clients. MSPs should review existing auto-labeling policies to determine whether enabling override behavior aligns with each client’s data governance requirements.

eDiscovery Review Set Limit Increased to 100

The maximum number of review sets per eDiscovery case has increased from 20 to 100 for cases with premium feature support. No action is required, but this removes a common bottleneck for clients with large or complex legal matters; worth communicating to clients with active eDiscovery workflows.

DLP Unsaved File Protection (Preview)

DLP Unsaved File Protection extends just-in-time DLP protection to files that have not yet been saved, including new files and files with unsaved modifications on endpoints. This closes a gap where sensitive data could be exfiltrated before a file was written to disk. MSPs managing clients with strict DLP requirements should evaluate this preview for early adoption.

Teams

Sensitivity Label Inheritance for Meeting Recordings and Loop Notes

Meeting recordings and Loop meeting notes now automatically inherit the sensitivity label applied to the meeting when label inheritance is enabled in policy. This closes a compliance gap where recorded content could escape the meeting’s data handling controls. MSPs managing regulated clients should verify that label inheritance policies are correctly configured.

External Domains Anomalies Report

A new report in Teams Admin Center detects unusual spikes, new domains, or abnormal engagement patterns with external organizations, updated daily. This provides proactive visibility into potential data exfiltration or shadow collaboration risks across client tenants without requiring custom alerting infrastructure.

User Reported Security Signals in Teams Admin Center

End-user security reports from Teams messages are now visible and downloadable in TAC Protection reports. This surfaces user-identified threats directly in the admin console, enabling MSPs to identify policy gaps and respond to emerging threats without relying solely on automated detection.

Teams Phone User Multi-Line (Up to 10 Numbers per User)

Admins can now assign up to 10 phone numbers to a single Teams user via Teams Admin Center, supported on desktop and Teams phone devices. This eliminates workarounds for clients with multi-role or multi-region calling requirements. MSPs should evaluate existing routing configurations that may be replaceable with this native capability.

Copilot Call Delegation (Frontier Program)

Copilot Call Delegation allows Copilot to answer incoming Teams calls on a user’s behalf, gather caller context, and schedule follow-up appointments via Microsoft Bookings. A Microsoft 365 Copilot license is required. MSPs should identify users who would benefit, confirm Bookings is configured, and communicate the license dependency to clients before enabling.

Copilot

Prepaid Capacity Pack Credits as Sole Billing Method

Admins can now create capacity pack policies that force Copilot pay-as-you-go usage to draw exclusively from prepaid credits, preventing unexpected overage charges. This enables predictable spend management for clients using consumption-based Copilot scenarios — a meaningful control for MSPs managing budgets across multiple tenants.

Power Users Insights in Copilot Dashboard

The Adoption tab in the Copilot Dashboard now classifies users as power, habitual, novice, or non-Copilot users based on usage frequency, rolling out in May. This gives MSPs data-driven segmentation to focus Copilot enablement efforts and justify license assignments or reassignments to clients.

Copilot Dashboard Export by Day (Public Preview)

Admins can now download de-identified Copilot usage metrics aggregated by user and day for the most recent 28 days. This supports faster, evidence-based decisions on license optimization and adoption interventions across client tenants.

Agent Store Submission via Agent Builder

Users can now submit custom agents for admin review and approval before publication to the organization’s Agent Store. MSPs need to establish an approval workflow for client tenants to prevent ungoverned agent proliferation; this feature provides the control mechanism to do so.

Organizational Messages Now Support Email Delivery and User Segments

Admins can send organizational messages via email in addition to Windows surfaces, and can target dynamic usage-based audiences rather than only static groups. This enables more effective Copilot adoption campaigns and change communications at scale without requiring separate tooling or manual list management.

Outlook

Copilot Chat Available in Pop-Out Windows

Copilot chat is now accessible in popped-out message windows, allowing users to use Copilot while reading or composing detached emails (May 8, 2026). No admin action is required, but this confirms Copilot license entitlement is being surfaced across more Outlook surfaces — relevant context for client communications about Copilot rollout scope.

Background Email Sync When Outlook is Closed

New Outlook now syncs email in the background even when the app is closed; users can disable this in Settings > General > Offline. MSPs should verify this behavior aligns with client security and data residency requirements, and communicate the new setting location to end users where relevant.

DLP Warn Dialog Now Includes Justification and False Positive Reporting Fields

The DLP warn dialog in new Outlook now matches classic Outlook behavior, including justification, false positive reporting, and acknowledgement fields (March 6, 2026). This closes a feature parity gap that may have been blocking some clients from migrating to new Outlook. MSPs managing DLP-sensitive clients should revalidate new Outlook readiness in light of this change.

OneDrive

Custom OneDrive Folder Name via Group Policy

Admins can now set a custom name for the local OneDrive sync folder, replacing the default “OneDrive – {organization name}” convention to increase available path length. This directly addresses path-length errors in deeply nested file structures. MSPs deploying OneDrive at scale should evaluate this policy for clients with complex folder hierarchies.

Deferred Ring Update Targeting May 29, 2026 (v26.040)

The Deferred ring is receiving Improved First Run Experience, Custom Folder Name, Mark of the Web for Outlook attachments, and macOS login item management via command line, with a target date of May 29, 2026. MSPs using the Deferred ring for controlled rollouts should validate these features in test environments ahead of that date.

Mark of the Web for Outlook Attachments

Email attachments saved to OneDrive from Outlook now include the Mark of the Web security tag, ensuring Windows Protected View applies when files are opened. No admin action is required, but this is worth communicating to clients as a meaningful security improvement for users saving email attachments to OneDrive.

OneDrive Sync Health Dashboard Now Supports Government Clouds

GCC, GCC High, and DoD environments can now use the Sync Health Dashboard to monitor sync status and identify issues. MSPs serving government cloud clients can now proactively monitor OneDrive sync health with the same tooling available in commercial tenants.

SharePoint

May 2026 Security Updates for SharePoint Server

Security patches released May 12, 2026 cover SharePoint Server Subscription Edition, 2019, and 2016, including language packs and Office Online Server. Any MSP managing on-premises SharePoint deployments must apply these patches promptly to address security vulnerabilities across all supported versions.

Admin Center

No updates this month.

May 2026 comes down to two things: deadlines you can’t miss — the June 1 hard match block, the June 2026 Secure Boot certificate expiration, and the July 1 price increase — and a bunch of features that just went from preview to production across Purview, Defender, and Intune. These are the updates that’ll actually impact your clients, your billing calls, and your security setup this month. Getting ahead of these deadlines is what’ll set you apart from MSPs who are always playing catch-up.

Photo by Jonathan Francisca on Unsplash

Managing Intune policies across 50 tenants using the same workflow you’d use for one is like trying to run a restaurant kitchen with home appliances—technically possible, but you’ll burn out before lunch.

The math is simple: every policy you recreate manually is time you’re not spending on higher-value work. This guide covers the techniques that actually scale: dynamic groups, security baselines, drift detection, and the architecture decisions that separate efficient MSPs from overwhelmed ones.

Why Intune policy management at scale matters for MSPs

Managing Intune policies at scale comes down to three core techniques: automating assignments with Entra ID dynamic groups, bundling configurations into Policy Sets, and using security baselines to standardize settings across devices. For MSPs juggling dozens or hundreds of tenants, these approaches turn what would otherwise be endless manual work into something repeatable and efficient.

Here’s the reality. Every hour spent recreating the same policy in a different tenant is an hour that could go toward higher-value work. When you’re responsible for 50 clients, each with their own Intune environment, that math adds up quickly.

Common Intune policy management challenges for MSPs

Before getting into solutions, it helps to name the problems. If you’ve been managing multiple tenants for a while, these pain points probably sound familiar.

Repetitive manual configuration across tenants

Creating the same device configuration policy 30 times—once per client—isn’t just tedious. It’s error-prone. A missed setting in tenant 17 might not surface until a compliance audit months later, and by then, tracking down the root cause becomes its own project.

Inconsistent policy deployment

Different technicians often have different approaches. One tech might configure BitLocker with certain recovery options while another uses slightly different settings. Over time, small variations create security gaps that are hard to spot and even harder to fix systematically.

Configuration drift without visibility

Configuration drift happens when policies change over time without anyone noticing. Maybe a client’s IT contact tweaked a setting. Maybe a technician made a “temporary” change that became permanent. Without centralized monitoring, deviations go undetected until something breaks.

No centralized multi-tenant view

Native Intune requires switching between tenants to see what’s happening. There’s no single dashboard showing policy status across all your clients, which makes it nearly impossible to spot problems before they turn into incidents.

How to design an Intune policy architecture that scales

The foundation of scalable Intune management is thoughtful policy design. Get this part right, and everything else becomes easier to manage.

Group policies by function

Rather than creating one massive policy that configures everything, break policies into functional categories. This approach—sometimes called “functional bucketing”—makes policies easier to troubleshoot and reuse across different clients.

Common functional groupings include:

• Security settings: BitLocker, Windows Defender, firewall rules
• Compliance requirements: OS version checks, encryption status, password policies
• App deployment: Required apps, optional apps, app configuration
• Device restrictions: Camera access, USB storage, screen capture

Keep policies modular and reusable

Smaller, single-purpose policies are easier to manage than monolithic ones. If a client needs a specific app configuration, you can add that policy without touching their security baseline. When something breaks, you can isolate the problem faster.

Use clear naming conventions

A policy named “Policy1” tells you nothing. A policy named “Win11-Security-Baseline-v2.1” tells you the OS, purpose, and version at a glance. When you’re managing hundreds of policies across dozens of tenants, clear naming saves significant troubleshooting time.

Balance granularity with manageability

There’s a tradeoff between customization and operational overhead. Too few policies means less flexibility. Too many means more complexity and more chances for conflicts.

Most MSPs find a middle ground works best; modular enough to be flexible, consolidated enough to stay manageable.

How to standardize configuration with security baselines

Security baselines are pre-configured sets of Windows settings that Microsoft recommends for securing devices. They provide a starting point so you’re not building security configurations from scratch every time.

Align baselines to CIS, NIST, or Microsoft Secure Score

CIS (Center for Internet Security) and NIST provide industry-recognized security benchmarks. Microsoft Secure Score measures how well a tenant follows Microsoft’s security recommendations. Aligning your baselines to one or more of these frameworks supports compliance reporting and gives clients confidence in your approach.

Create custom configuration profiles

Out-of-the-box baselines won’t fit every client. Healthcare organizations have HIPAA requirements. Financial services firms have their own regulations. Custom profiles let you modify baselines for specific industries or client needs without starting from zero.

Apply templates across all tenants

The real efficiency gain comes from defining a baseline once and deploying it everywhere. Instead of manually configuring each tenant, you apply a template and move on. This is where multi-tenant management platforms add significant value.

Tip: Augmentt’s Intune Autopilot lets you define configuration baselines once and deploy them across all client tenants with a single click, eliminating the repetitive work of tenant-by-tenant setup.

How to use dynamic groups for policy assignment

Dynamic groups in Entra ID (formerly Azure AD) automatically add or remove members based on device or user attributes. Instead of manually assigning policies to individual devices, you define rules like “all Windows 11 devices” or “all devices in the Sales department.”

When a new device enrolls, it automatically receives the right policies based on its attributes—no technician intervention required. Common attributes include:

• Device type (Windows, iOS, Android)
• OS version
• Department or cost center
• Physical location
• Device ownership (corporate vs. personal)

This automation is essential at scale. Without it, every new device enrollment means manual policy assignment, which doesn’t work when you’re onboarding devices across 50 different clients.

How to enforce compliance policies with automated remediation

Compliance policies define what requirements a device has to meet to be considered “healthy.” They’re different from configuration policies, which apply settings. Compliance policies check whether settings are actually in place.

Define compliance requirements

Typical compliance checks include:

• Encryption status: Is BitLocker enabled?
• OS version: Is the device running a supported Windows version?
• Password requirements: Does the device enforce minimum password complexity?
• Antivirus status: Is Windows Defender active and up to date?

Configure remediation actions

When a device falls out of compliance, you can configure automatic responses. Options include sending the user a notification, setting a grace period for remediation, or restricting access to corporate resources until the issue is resolved.

Set noncompliance escalation workflows

A tiered response works well in practice: mark noncompliant, then notify user, then block access after grace period, then retire device if unresolved. This automation reduces manual follow-up while giving users a chance to fix issues themselves before access gets cut off.

How to detect and prevent Intune configuration drift

Drift detection is where many MSPs struggle. You set up policies correctly, but over time, things change. Without monitoring, you won’t know until something breaks or a client fails an audit.

Monitor for unauthorized policy changes

Comprehensive audit logging tracks who changed what and when. This visibility is critical when multiple technicians—or client IT contacts—have access to Intune. Without it, you’re flying blind.

Set alerts for baseline deviations

Proactive alerting notifies you when policies deviate from your approved baseline. You find out about problems before they cause incidents, rather than discovering drift during a quarterly review.

Remediate drift with one-click baseline reapplication

When drift occurs, you want to fix it quickly. The ability to restore policies to their baseline state with minimal effort keeps your clients secure without consuming hours of technician time. This is one area where purpose-built MSP tools outperform native Intune capabilities.

How to standardize enrollment with Windows Autopilot

Windows Autopilot enables zero-touch deployment. Devices ship directly to end users and configure themselves automatically when they first connect to the internet. No imaging, no hands-on setup from your team.

Configure enrollment profiles

Enrollment profiles control the user experience during setup—what screens they see, how the device is named, and which policies apply initially. You can create different profiles for different client types or device use cases.

Deploy zero-touch onboarding

The end user unboxes the device, signs in, and the device configures itself. For MSPs, this means new client devices arrive ready to work without requiring a technician visit or remote session.

Assign policies automatically at enrollment

Policies apply immediately based on dynamic group membership and enrollment profile settings. The device is compliant from minute one, which matters both for security and for client perception.

How to integrate Conditional Access with Intune policies

Conditional Access policies control who can access what resources under which conditions. When integrated with Intune, you can require devices to be compliant before they access Microsoft 365 or other corporate resources.

Common scenarios include:

• Blocking access from noncompliant devices
• Requiring MFA for unmanaged devices
• Restricting access based on geographic location
• Limiting access to specific apps based on device health

The key connection is that Intune compliance status becomes a condition that Conditional Access evaluates. A device that fails compliance checks can be automatically blocked from accessing sensitive resources.

How to structure role-based access for delegated administration

When multiple technicians manage multiple tenants, access control becomes critical. You want people to have the access they need—and nothing more.

Assign least-privilege roles

The principle of least privilege means giving users only the permissions required for their job. Intune includes built-in roles like Helpdesk Operator and Policy and Profile Manager. You can also create custom roles for specific needs.

Separate permissions by tenant

Preventing technicians from accidentally modifying the wrong client’s policies protects both you and your clients. Clear tenant separation reduces the risk of costly mistakes that could affect the wrong environment.

Enable multi-admin approval

For sensitive changes—like modifying security baselines—approval workflows add a safety check. A second set of eyes catches errors before they reach production, which is especially valuable for high-impact policy changes.

How to monitor and report on Intune policies across tenants

Visibility across all clients from a single place is essential for MSP operations. You can’t manage what you can’t see, and native Intune doesn’t give you a cross-tenant view.

Track policy deployment status centrally

A central view shows which policies deployed successfully, which failed, and which devices are still pending. This visibility lets you catch problems early rather than discovering them when a client calls with an issue.

Generate compliance reports by client

Client-facing reports prove your security posture to stakeholders. They’re essential for quarterly business reviews and compliance documentation, especially for clients in regulated industries.

Automate stakeholder reporting

Scheduled, branded reports save hours of manual work. Instead of building reports from scratch each month, they generate automatically and land in the right inboxes on schedule.

How MSPs can scale Intune management with the right platform

Native Intune works well for single organizations, but it wasn’t designed for MSPs managing dozens of tenants. The challenges covered throughout this guide—repetitive configuration, inconsistent deployment, configuration drift, lack of visibility—all stem from this fundamental mismatch.

Purpose-built MSP platforms address these gaps directly. You define baselines once, deploy across all tenants, monitor for drift, and remediate with a click. That’s the difference between managing Intune and managing Intune at scale.

See how Augmentt automates multi-tenant Intune management and reporting →

FAQs about managing Intune policies at scale

Which takes precedence when GPO and Intune policies conflict?

On Azure AD-joined devices, Intune policies typically take precedence. On hybrid-joined devices, the outcome depends on the specific setting and MDM wins configuration. Microsoft’s documentation on policy conflict resolution provides detailed guidance for specific scenarios.

What types of Intune policies should MSPs manage for clients?

MSPs typically manage device configuration policies, device compliance policies, app protection policies, Windows Autopilot enrollment profiles, and security baselines. Together, these cover the core requirements for consistent security across client environments.

How do I review which Intune policies are applied to a specific device?

In the Intune admin center, navigate to Devices, select the specific device, and review the Device configuration and Compliance sections. You’ll see all assigned policies and their deployment status for that device.

Can I export Intune policies from one tenant and import them into another?

Yes. You can export policies as JSON files using Microsoft Graph API or third-party tools, then import them into other tenants. Multi-tenant management platforms simplify this with template-based deployment that handles the export and import process automatically.

How do Intune policies align with Microsoft Secure Score recommendations?

Many Intune security baselines and compliance policies directly address Secure Score recommendations. Deploying recommended configurations can improve a tenant’s Secure Score automatically, which is useful for demonstrating security posture to clients during reviews.

Featured Photo by Maxwell Ridgeway on Unsplash

March 2026 brings a dense set of M365 updates across security, identity, device management, and AI, several with hard enforcement deadlines that require immediate action. This article covers a curated selection of the updates most relevant to MSPs, focused on what affects tenant management, client security posture, licensing decisions, and day-to-day operations at scale.

Intune

macOS Recovery Lock Support is now available, allowing admins to set and rotate a recovery OS password on Apple Silicon Macs via MDM. This prevents users from booting into recovery mode to bypass security controls — a gap that has existed on Apple Silicon devices since their introduction. MSPs managing Mac fleets should implement this immediately as part of macOS security hardening, particularly for clients with compliance requirements aligned to frameworks like STIG.

Managed Installer Policy During Windows Autopilot OOBE now applies during device preparation, automatically marking Win32, Store, and Enterprise App Catalog apps as trusted before the user reaches the desktop. This reduces post-deployment app trust issues and the manual whitelisting overhead that typically follows. MSPs using Autopilot should validate that managed installer policy is configured to take advantage of this earlier in the provisioning flow.

The new Scope Tag De-Union Setting prevents role assignments with overlapping scope tags from granting unintended combined access. A new Permissions Assessment Report lets you preview the impact of enabling de-union before making changes. MSPs with complex Intune RBAC configurations across multiple client tenants should run the Permissions Assessment Report now to identify and remediate unintended privilege escalation before enabling the setting.

DDM-Based LOB App Reporting on iOS/iPadOS extends Declarative Device Management to line-of-business apps, enabling proactive real-time installation status reporting back to Intune rather than waiting for device check-in. This gives MSPs faster, more accurate deployment confirmation for iOS/iPadOS fleets. No more relying on check-in cycles to verify app status.

Windows Autopatch Update Readiness has reached General Availability with four new experiences: device-level quality update visibility, centralized alerts with remediation guidance, and an Update Readiness Checker across the tenant. MSPs using Windows Autopatch can now proactively identify and remediate update blockers before they cause compliance drift. Incorporate this into monthly patch management workflows.

Entra ID

Entra Connect Hard Match Block for Role-Assigned Users takes effect June 1, 2026. Starting that date, Entra Connect Sync and Cloud Sync will block hard-matching new AD user objects to existing cloud users that hold Entra ID roles, closing an account takeover vector via hard match abuse. MSPs must audit hybrid environments for any sync configurations that hard-match privileged cloud accounts before June 1; this is a breaking change with a defined enforcement date and no grace period after it hits.

Entra Backup and Recovery is now in Public Preview. Entra automatically takes daily backups of critical directory objects — users, groups, apps, Conditional Access policies, and more — with a 5-day retention window for P1/P2 tenants. Admins can view snapshots, generate diff reports, and run recovery jobs. For MSPs, this is a meaningful operational safety net: accidental deletion or misconfiguration of CA policies or user accounts can now be recovered without manual recreation, significantly reducing incident response time.

Synced Passkeys are now Generally Available as an authentication method in Entra ID, supporting FIDO2 passkeys stored in built-in or third-party passkey providers and manageable via passkey profiles in authentication methods policy. Passkeys are now production-ready and policy-manageable. MSPs should evaluate phishing-resistant MFA rollout plans for clients and update authentication method policies accordingly.

The Passkey Adoption Campaigns via Conditional Access Optimization Agent feature is in Public Preview. The CA Optimization Agent can assess readiness, generate deployment plans, guide users, and automatically enforce CA policies for passkey rollouts, starting in report-only mode. This automates the most operationally complex part of passkey deployment, allowing MSPs to drive phishing-resistant MFA adoption at scale without manual policy staging.

Cross-Tenant Security Group Synchronization is now in Public Preview, allowing organizations to synchronize security groups across Entra tenants for centralized group management. This requires Entra ID Governance licenses, a new licensing dependency MSPs need to account for. It’s relevant for MSPs managing multi-tenant organizations or clients with subsidiary structures where duplicate group management is a recurring overhead.

Defender

The Sentinel Azure Portal Sunset deadline has been extended by one year to March 31, 2027. MSPs with clients still managing Sentinel in the Azure portal have additional runway, but migration planning to the Defender portal should continue; this extension is not a reason to defer.

Sentinel Account Name Standardization takes effect July 1, 2026. Account Name in Sentinel analytics, incidents, and automation will shift to showing only the UPN prefix, with new fields introduced for full UPN and UPN suffix. MSPs managing Sentinel analytic rules, automation playbooks, or custom workbooks that reference Account Name fields must audit and update those configurations before July 1 to avoid broken logic.

The UEBA Behaviors Layer has reached General Availability in Sentinel, providing a behaviors layer that aggregates raw security logs into normalized, human-readable behavioral insights. A prebuilt behaviors workbook is included in the UEBA essentials solution. MSPs providing SOC or MDR services should enable the behaviors workbook for clients to accelerate triage and improve detection quality.

Defender for Endpoint Effective Settings Reporting is now Generally Available. A new “Effective Settings” tab on the device page shows the actual security settings enforced on each device, the configuring source, and any conflicting configurations that were not applied. This directly addresses one of the most common MSP pain points — verifying that intended security policies are actually in effect on endpoints — and should be incorporated into device compliance review workflows.

Custom Guidebooks (SOP) for Copilot Guided Response are now Generally Available. Organizations can upload their own Standard Operating Procedures into the Copilot Guided Response experience in the Defender portal to align investigations with internal processes.

MSPs providing managed security services can now embed client-specific runbooks directly into the Defender investigation workflow, improving consistency and reducing escalation time.

Licensing

M365 E7 — the “Frontier Suite” was announced on March 9, 2026, priced at $99/user/month. It combines the full E5 security and compliance foundation with an integrated AI stack, and introduces a human-led, agent-operated model where AI can take action rather than just generate content. It also adds a unified governance layer for AI agents and cross-app intelligence not present in earlier suites.

A key component of M365 E7 is Agent 365, the control plane for agents, which will be Generally Available on May 1, 2026. Agent 365 extends existing user management infrastructure and incorporates Defender, Entra, and Purview to protect and govern agents, delivering observability, governance, and security for all agents across an organization without requiring a new management framework.

MSPs should monitor for official licensing documentation and detailed feature inclusions as they become available. The immediate priority is assessing whether E7 represents a cost-effective upgrade path from E3 or E5 for enterprise clients, and identifying where Copilot and agent governance requirements might make the SKU relevant in upcoming renewal conversations.

Purview

Sensitivity Labels for OneNote at Section Level are now Generally Available for manual labeling. This requires SharePoint/OneDrive sensitivity label enablement and activation via a PowerShell command: Set-SPOTenant -EnableSensitivityLabelforOneNote $true. This will not activate automatically — MSPs must add this command to post-update configuration checklists for any client using OneNote with sensitivity labels.

Auto-Labeling Policy Override for Lower-Priority Labels is moving from Preview to GA in April. Auto-labeling policies for SharePoint and OneDrive can now optionally override manually applied labels with lower priority, extending a capability previously available only for email. MSPs should review existing auto-labeling configurations before GA to confirm the override behavior aligns with client data classification intent. This is a behavioral change, not just a new option.

Data Security Investigations: Audit Search is now Generally Available, allowing investigators to collect content based on user activities — file access, copy, download — from the unified audit log. MSPs providing compliance services should update investigation runbooks to include audit search as a standard collection method.

The Insider Risk Management Quick Policy Template for Non-M365 App Data Theft is now Generally Available. It detects data theft from non-M365 apps by departing users and extends insider risk coverage beyond the M365 ecosystem. MSPs managing IRM for clients with mixed app environments — Dropbox, Box, personal cloud storage — should deploy this template as part of standard offboarding risk controls.

Teams

Teams on the Web — Browser Enforcement Deadline May 15, 2026: After May 15, Teams on the web will only load on ES2022-compliant browser versions. Users on older browsers will hit a hard blocking page with no fallback. MSPs must audit browser versions across all client environments now and push updates before May 15; this is a breaking change with a firm deadline.

Simplified External Collaboration Controls are now available in the Teams admin center. A new overview page consolidates external collaboration settings with guided Open/Controlled preset modes or a custom configuration path.

MSPs should review current external collaboration posture across client tenants and align settings to client security requirements using the new guided flow.

EXIF Metadata Stripping from Images Shared in Teams is now on by default. Teams automatically removes EXIF metadata — GPS location, device details — from images shared in chats and channels. No configuration is required, but MSPs should communicate this to clients in privacy-sensitive industries such as healthcare, legal, and finance as a positive compliance improvement.

The Multi-Tenant Multi-Account Activity Feed allows users to view and manage notifications from multiple tenants in a single consolidated feed without switching accounts, with sidebar pinning for key tenants.

This is directly relevant for MSP engineers and client-facing staff operating across multiple tenants — it reduces friction and missed notifications in multi-tenant workflows.

Sharing Files and Loop Components in External Chats is now supported in Teams, with automatic permission management for external participants. Admin configuration is required to enable this feature. MSPs should evaluate whether to enable it per client based on data sharing policies before it surfaces as a user request.

Copilot

Purview DLP Expansion to Copilot Prompts and Web Search enables Purview DLP to block sensitive data — financial data, national IDs, bank numbers, custom SITs — from being used in Copilot prompts and web search queries in real time. Web search DLP is in Public Preview rolling to GA in June; prompt DLP is rolling out in March.

MSPs managing regulated clients now have enforceable controls to prevent sensitive data exfiltration through Copilot. Review and configure these proactively for any client with existing DLP policies.

High-Usage Users Visibility in M365 Admin Center surfaces a new “High-usage users” category that identifies individuals driving disproportionate consumption across pay-as-you-go Copilot services, rolled out in March.

This is critical for cost management at scale. MSPs can now identify clients at risk of unexpected Copilot billing spikes before invoices arrive and adjust license allocation accordingly.

Copilot Tuning Templates in Agent Builder introduces new templates for document drafting, validation, and style editing, available to enterprises with 5,000 or more Copilot licenses. These roll to Frontier in April and worldwide in June.

MSPs with large enterprise clients approaching the 5,000-seat threshold need to be aware of this capability and begin planning for agent governance and deployment support.

Domain Exclusion for Web Grounding allows admins to specify domains to exclude from Copilot’s web grounding, giving IT control over which external sources Copilot references. Rolling out in April. MSPs should include this in Copilot governance configuration checklists for clients in regulated industries with compliance or content governance requirements.

Authoritative Sources Management in Admin Center allows admins to designate SharePoint Online sites as authoritative for Copilot search results to improve relevance and ranking, rolling out in April.

MSPs configuring Copilot for clients should plan to set authoritative sources as part of onboarding to ensure Copilot surfaces trusted internal content rather than noise from across the tenant.

Outlook

Online Archive Access for Shared Mailboxes in New Outlook is now available. The new Outlook for Windows surfaces the Online Archive folder directly in the folder list for shared mailboxes, resolving a long-standing gap. MSPs should communicate this to clients who have been staying on classic Outlook specifically for shared mailbox archive access since a common migration blocker is now removed.

Expanded Search Folder Configuration has moved to Settings with additional folder types and the ability to scope results to specific folders. The direct MSP impact is low, but this is relevant for clients being migrated from classic Outlook. Update end-user training materials and migration guides to reflect the new Search Folder location and capabilities.

OneDrive

Mark of the Web for Outlook Attachments means email attachments saved to OneDrive from Outlook now include the MOTW security tag, ensuring Windows Protected View applies when files are opened (Version 26.002.0105.0001). No action is required, but MSPs should note this as a positive security posture change. It reduces the risk of malicious attachments bypassing Protected View for clients using the new Outlook.

Custom OneDrive Folder Name via Group Policy allows admins to set a custom name for the local OneDrive sync folder, replacing the default “OneDrive – {org name}” convention to increase available path length (Version 26.032.0217.0003). MSPs can now standardize folder naming via Group Policy as part of OneDrive deployment templates, useful for clients with deep folder structures hitting Windows path length limits.

OneDrive Sync Health Dashboard for Government Clouds now supports GCC, GCC High, and DoD environments for proactive sync monitoring (Version 25.199.1012.0002). MSPs with government cloud clients should add the Sync Health Dashboard to monitoring workflows for GCC/GCC-H/DoD tenants.

Copilot Actions in File Explorer and OneDrive Activity Center allow users with M365 Copilot licenses to summarize, compare, and query files directly from File Explorer and the OneDrive Activity Center (Version 25.194.1005.0003). This feature is license-gated to M365 Copilot; MSPs should confirm client license assignments are accurate to avoid unlicensed feature access or user confusion.

SharePoint

Security Updates for SharePoint Server 2016, 2019, and Subscription Edition were released on March 10, 2026: KB5002843 for Subscription Edition, KB5002845 for SharePoint Server 2019, and KB5002850 for SharePoint Server 2016. MSPs managing on-premises SharePoint environments must apply these patches immediately as part of standard Patch Tuesday operations to maintain security compliance.

AI in SharePoint (formerly Knowledge Agent) is now in Public Preview, enabling natural language site, library, page, and list building. Worldwide rollout is planned for May. Notably, this preview is powered by Anthropic’s Claude model. MSPs should inform clients with strict data handling or AI governance policies before the May worldwide rollout, as a third-party AI model is involved.

March 2026 is a high-action month for MSPs, with two hard enforcement deadlines — the Teams browser cutoff on May 15 and the Entra Connect hard match block on June 1 — demanding immediate attention alongside the M365 E7 announcement reshaping enterprise licensing conversations. The depth of updates across Intune, Entra, Defender, and Purview reinforces how much of the MSP workload now lives in governance, compliance, and AI controls rather than just deployment.

Looking to simplify your multi-tenant management? Click here to see how Augmentt can help!

Cover Photo by Bank Phrom on Unsplash

Managing Microsoft 365 for one client is straightforward. Managing it for 50 or 100 clients, each with their own tenant, security requirements, and user lifecycle needs, is an entirely different challenge that native Microsoft tools weren’t designed to solve.

MSPs that scale successfully treat multi-tenant M365 management as an operational discipline rather than a collection of ad-hoc tasks. This guide covers the core challenges, the capabilities that matter most, and how to build a repeatable approach to security, user management, and reporting across your entire client base.

What is Microsoft 365 multi-tenant management

MSPs manage Microsoft 365 for multiple clients by using centralized, multi-tenant tools like Microsoft 365 Lighthouse, Partner Center, and specialized third-party platforms. These tools enable automation, standardized security policies, centralized user onboarding and offboarding, and unified monitoring. The result is that MSPs can scale their operations without manually logging into each client environment one by one.

A tenant is simply a dedicated instance of Microsoft 365 services for a single organization. Multi-tenant management, then, refers to the practice of administering many of these separate client environments from one centralized platform or workflow.

Here’s why this distinction matters: internal IT teams typically manage a single environment, while MSPs often oversee dozens or even hundreds of unique tenants. This reality calls for a fundamentally different approach, one built around consistency, automation, and cross-tenant visibility rather than one-off configurations.

A few terms worth knowing as you read through this guide:

• Baseline: A standardized set of security and configuration settings that an MSP defines as their best practice and applies across all clients.
• Configuration drift: The gradual process where a tenant’s settings change over time, deviating from the established baseline due to manual changes or lack of oversight.
• Policy enforcement: The automated process of ensuring all tenants adhere to the MSP’s defined security and operational policies.

Why managing multiple M365 tenants is hard for MSPs

Without purpose-built solutions, MSPs struggle to manage Microsoft 365 at scale. The core challenges come from the fact that native Microsoft tools were designed for single-tenant administration, which creates significant inefficiencies and risks for service providers managing many clients.

Configuration drift across client environments

When managing many tenants manually, maintaining consistent configuration becomes nearly impossible. Settings change over time due to one-off client requests, technician errors, or simply forgetting to apply an update everywhere. Tenants drift away from the MSP’s security baseline without any centralized oversight, and often nobody notices until something breaks or a security incident occurs.

Security gaps without centralized visibility

Lacking a single-pane-of-glass view across all tenants creates a major security risk. MSPs cannot easily identify which clients have inconsistent security policies, outdated settings, or emerging threats. This leaves dangerous gaps in service delivery that are difficult to spot until they become problems.

Manual reporting and compliance overhead

Generating security reports, tracking compliance, and preparing for client business reviews takes an enormous amount of time. Technicians often log into each tenant individually, gather data, and format reports manually. This process is both inefficient and prone to error, especially when managing 50 or 100 clients.

Portal fatigue from tenant switching

The constant need to log in and out of different Microsoft admin portals (Entra ID, Exchange, Intune) for each client drains productivity. This “portal fatigue” slows down service delivery and frustrates technicians who spend more time navigating than actually solving problems.

Why Microsoft Lighthouse falls short for MSPs

Microsoft Lighthouse is Microsoft’s native attempt at a multi-tenant tool, but it has significant limitations that prevent it from being a complete solution for most MSPs. Its restrictions on licensing, limited automation capabilities, and lack of deep remediation workflows explain why a market for third-party, purpose-built MSP platforms exists.

For MSPs serving clients across various license tiers, these limitations create real operational friction. You might find Lighthouse useful for visibility, yet still require additional tooling to actually act on what you see. The gap between “seeing a problem” and “fixing a problem” is where most MSPs feel the pain.

Essential capabilities for multi-tenant M365 management

To effectively manage Microsoft 365 for multiple clients, MSPs typically look for a management platform with a core set of features designed specifically for their business model. Here’s what matters most.

Centralized policy and configuration templates

The ability to define security policies and configuration settings once in a template, then apply them across all or a select group of tenants, ensures consistency and saves hundreds of hours over manual configuration. Instead of configuring each tenant individually, you configure once and deploy everywhere.

One-click security baseline deployment

A mechanism to apply security best practices to new and existing tenants quickly and reliably hardens environments without hours of manual configuration per tenant. This capability is particularly valuable during client onboarding, when you want to bring a new tenant up to your standards immediately.

Automated policy drift detection and remediation

The platform continuously monitors all managed tenants for unauthorized changes or deviations from the baseline. Ideally, it can automatically correct drift to maintain compliance without technician intervention. This turns security maintenance from a reactive task into a proactive, automated process.

Role-based access for tiered technician teams

Role-Based Access Control (RBAC) allows MSPs to grant L1 and L2 technicians access to perform specific tasks, like MFA resets or user onboarding, through a secure, audited interface without giving them full Global Admin rights. Junior techs can handle routine work safely, while senior engineers focus on complex issues.

Automated and brandable client reporting

The ability to schedule and automatically generate white-labeled reports for client communication, Quarterly Business Reviews, and compliance documentation is essential for demonstrating value without manual effort. Reports run on a schedule, pull data automatically, and arrive in your client’s inbox with your branding.

PSA and RMM integration

Integration with the MSP’s existing toolset, such as ConnectWise, Autotask, or RMM platforms, is critical for creating seamless ticketing, alerting, and billing workflows. When a security alert fires, it creates a ticket in your PSA automatically rather than requiring someone to notice and log it manually.

How to standardize Microsoft 365 security across tenants

Moving from theory to implementation requires creating repeatable and enforceable security standards across your entire client base. Here’s how MSPs approach this in practice.

Aligning with CIS, NIST, SCuBA, and Microsoft Secure Score

MSPs often map their security configurations to recognized industry standards like the Center for Internet Security (CIS) Benchmarks, NIST, Microsoft’s Secure Cloud Business Applications (SCuBA) framework, and Microsoft Secure Score. Aligning with these frameworks provides a defensible, best-practice foundation for your security offering and gives clients confidence that their environment meets recognized standards.

Deploying security baselines without premium licensing

Meaningful security monitoring and enforcement are possible across all Microsoft 365 license tiers. Purpose-built platforms can enforce critical security settings without requiring clients to have expensive E5 or other premium licenses. This is a significant advantage when serving SMB clients who may not have the budget for premium licensing but still expect solid security.

Automating breach detection and remediation

Automated alerts for suspicious activities, such as impossible travel, mass file deletion, or risky sign-ins, combined with one-click remediation actions dramatically accelerate incident response times. Platforms like Augmentt provide noise-tuned alerting that surfaces real threats without overwhelming technicians with false positives. When an alert fires, you can block a user, reset a password, or revoke sessions with a single click rather than navigating through multiple portals.

Automating user lifecycle management across M365 tenants

MSPs can streamline their most frequent and time-consuming administrative tasks, including onboarding, offboarding, and ongoing user management, through automation.

Streamlining onboarding with user cloning

User cloning allows a technician to replicate all settings, group memberships, and policies from a pre-configured template user. This ensures every new user is set up quickly, consistently, and correctly, regardless of which technician handles the request. Instead of manually configuring each setting, you clone from a template and make minor adjustments.

Configuring scheduled offboarding workflows

Automated offboarding workflows handle all necessary steps when an employee leaves:

• Converting the mailbox to shared
• Removing group access
• Reclaiming the license for reuse
• Setting an out-of-office reply

This process can be scheduled in advance to ensure nothing is missed. When HR notifies you that someone’s last day is Friday, you schedule the offboarding to run automatically that evening.

One-click MFA reset and access controls

Simplifying common helpdesk tasks like Multi-Factor Authentication resets into a one-click action within a central console reduces ticket volume and improves security hygiene. When MFA is easy to reset, technicians are more likely to enforce it consistently rather than creating workarounds.

Managing Intune and devices across multiple tenants

Device management via Microsoft Intune is a critical part of a complete M365 managed service, yet it presents the same multi-tenant challenges as user and security management.

Deploying Intune policies from a central console

A multi-tenant platform allows MSPs to define device configuration profiles and compliance policies once, then push them out to multiple client tenants. This ensures all managed devices meet security standards without repetitive manual work. You define your baseline device policy, and every client gets the same consistent configuration.

Monitoring compliance and detecting drift

MSPs benefit from a centralized view to track the compliance status of all devices across all clients. This includes identifying non-compliant devices and detecting any configuration changes that deviate from established Intune policies. When a device falls out of compliance, you see it in one dashboard rather than discovering it during a client call.

Creating predictable device enrollment workflows

Standardized enrollment profiles for Autopilot can be managed and deployed from a central console, creating a consistent and predictable device onboarding experience for end-users across different clients. New devices enroll the same way every time, which reduces support tickets and improves the end-user experience.

Best IT solutions for MSPs managing multi-tenant environments

Selecting the right multi-tenant management platform is crucial for growing your Microsoft 365 practice profitably. Here’s how to think about the decision.

Purpose-built MSP platforms vs enterprise tools

Tools designed specifically for multi-tenant MSP workflows differ significantly from tools built for single-tenant enterprise administration. MSP-specific design is essential for scalability, billing integration, and multi-client reporting. Enterprise tools assume you’re managing one organization, while MSP tools assume you’re managing many.

What to evaluate in a Microsoft 365 MSP platform

Key evaluation criteria include:

• Multi-tenant architecture: Is the tool built from the ground up for MSPs, or is multi-tenancy bolted on?
• Security framework alignment: Does it support standards like CIS benchmarks and Microsoft Secure Score?
• Automation depth: How much manual work does it truly eliminate?
• Reporting quality: Are reports automated, brandable, and client-friendly?
• Integrations: Does it connect with your core PSA and RMM tools?
• Pricing model: Is the pricing per-user or per-tenant, and does it scale profitably as you grow?

Questions to ask before selecting a vendor

Before committing to a platform, consider asking:

1. What is your support model for MSP partners?
2. What compliance certifications (SOC 2, GDPR) does your platform hold?
3. What does the onboarding process for a new MSP partner look like?
4. Can you share your product roadmap for the next 6-12 months?
5. How does your platform help us prove the value of our services to clients?

How Microsoft 365 MSPs can simplify management and scale profitably

To succeed, MSPs operationalize their Microsoft 365 practice by turning it into a repeatable, standardized, and profitable managed service. This involves leveraging automation to enforce security baselines, streamline user management, and generate value-driven reports for clients.

By adopting a purpose-built platform, MSPs move away from reactive, time-consuming manual tasks and build a scalable engine for growth. Augmentt, for example, is designed to help MSPs automate, secure, and simplify M365 management across all their tenants from a single console.

See how Augmentt helps MSPs manage Microsoft 365 at scale →

FAQs about Microsoft 365 multi-tenant management for MSPs

Can MSPs manage Microsoft 365 tenants without premium licensing?

Yes. MSPs can implement meaningful security monitoring and best-practice configurations across all M365 license tiers using purpose-built management platforms that don’t require E5 or other premium licensing for their core functionality. Many security controls are available at lower license tiers when you have the right tooling.

How do MSPs onboard a new Microsoft 365 tenant quickly?

MSPs connect new tenants to their management platform via the CSP Partner Portal or delegated admin permissions. From there, they apply pre-built security and configuration templates in a single action to bring the tenant up to standard in minutes rather than hours.

What is the difference between Microsoft Lighthouse and third-party MSP tools?

Microsoft Lighthouse provides basic multi-tenant visibility but lacks the advanced automation, deep remediation workflows, license-agnostic support, and automated branded reporting that purpose-built MSP platforms offer for managing M365 efficiently at scale. Lighthouse shows you problems; third-party tools help you fix them quickly.

How do MSPs generate automated security reports for Microsoft 365 clients?

MSPs use multi-tenant management platforms with built-in reporting engines. They schedule reports to run automatically, pulling data from all relevant Microsoft services, formatting it into a professional branded template, and emailing it directly to clients or account managers without manual intervention.

Can junior technicians safely manage Microsoft 365 without full admin access?

Yes. Platforms with robust Role-Based Access Control allow MSPs to create custom roles for L1 and L2 technicians. These roles grant access to perform common, low-risk tasks through guided workflows without ever needing high-privilege accounts in Microsoft admin portals. Junior techs work safely within guardrails while senior engineers retain full control.