MSP

Running Microsoft 365 security at scale: the multi-tenant MSP playbook

EntraGUARD·2026-08-06·9 min

Securing one tenant is a project. Securing forty, each with its own drift and its own client, is an operating model. Here is the playbook that makes multi-tenant security repeatable and profitable.

Securing one Microsoft 365 tenant is a project. Securing forty of them, each with its own baseline, its own drift and its own client on the other end, is an operating model. MSPs that treat multi-tenant security as forty separate projects burn margin and miss regressions. This is the playbook that makes it repeatable.

Standardise the baseline, vary the exceptions

The mistake is auditing each client from scratch. The pattern that scales is a house baseline — your opinionated set of controls that every client should meet — applied everywhere, with documented per-client exceptions where a business reason overrides it. Now every audit answers one question: how far is this tenant from our standard? Drift becomes visible because you have a fixed line to measure against. EntraGUARD's custom baselines exist precisely for this.

Make it a cadence, not an event

A one-time assessment ages the moment it is delivered. The value for an MSP is the recurring read: the same baseline, run monthly across the fleet, with the score difference against last month front and centre. A regression — a client who disabled a Conditional Access policy, added a Global Admin, or turned on legacy authentication — surfaces as a red delta, not as a surprise in next year's review.

The regression is the product. Clients rarely notice the slow erosion of their own posture. An MSP that can say "your score dropped 8 points this month because these three things changed" is selling something no annual audit can.

Package it so it sells

Onboarding audit — a fixed-scope initial assessment that sets the reference point and justifies remediation work.
Monthly posture report — recurring, low-effort, high-visibility; the recurring-revenue anchor.
Remediation projects — the findings feed a backlog you bill against.
Quarterly business review — the score trend and the compare-two-audits view make the QBR write itself.

Watch the operational details

At scale, the friction is in the plumbing: consistent read-only connector permissions per tenant, per-client branding on the report so it looks like your service and not a tool, and offline or per-tenant licensing so a workstation can audit many tenants without re-provisioning. Getting these right is the difference between a service that scales and one that eats an engineer per ten clients.