Managed or Modified: Choose How Huntress Hardens Microsoft 365

Picture your Microsoft 365 environment being hardened around the clock, controls rolling out on a set schedule based on expert best practices, without you having to do a thing. Some security teams would take that deal without blinking. Others have spent years building change control processes that require more involvement.

Both approaches understand the same premise. Most Microsoft 365 environments don't get safer with time. Huntress data shows that over half of recommended identity controls are missing in more than 60% of tenants, even ones already running some kind of posture tool. Teams might know what policies they should have in place. But most don't implement them for fear they'll lock someone out at 8am on a Monday.

That hesitation is exactly why identity hardening stalls out industry-wide. In fact, left to their own devices, we've found more than 90% of organizations won't touch their settings at all… so gaps pile up while Microsoft keeps shipping updates. Automating control deployment and drift remediation closes that gap (and it works). Across the thousands of tenants running Managed ISPM (Identity Security Posture Management), the rollback rate for controls has stayed under 1%. Still, the fear of breaking something is understandable, but the odds of it happening when we vet the controls are low enough that doing nothing is the bigger risk.

Adding scale creates its own version of this tension, and it shows up differently depending on where you sit. An MSP protecting 550 clients doesn't want to review and approve a new control 550 times by hand. Similarly, a two-person internal security team doesn't have the bandwidth to vet every new control by hand either. The reality is, manual review doesn't scale, no matter which org you're in.