For MSPs managing multiple customer environments, identifying a security gap is only part of the job. They also have to fix it, track the change and show clients what was done.
ConnectSecure has expanded its platform with Microsoft 365 Auto Remediation and AI-powered Training Assessments to give MSPs more ways to manage security findings, client training, and remediation work across customer environments.
The Microsoft 365 capability builds on ConnectSecure’s M365 Security Inspector, which assesses customer environments against CIS Microsoft 365 Foundations 5.0. The assessment covers 108 checks across areas including Conditional Access, Exchange mail flow, SharePoint sharing, Teams external access, MFA, data loss prevention and anti-phishing and anti-malware policies.
For
ConnectSecure CEO Peter Bellini, the bigger issue is how Microsoft 365 security fits into the rest of an MSP’s security operations.
“The difference is structural rather than feature-level. Microsoft Secure Score tells you about Microsoft, and most vulnerability management platforms tell you about endpoints and networks. MSPs are often left manually correlating two separate pictures of the same client, with M365 posture living in its own silo, disconnected from the rest of their security operations,” Bellini said.
ConnectSecure brings Microsoft 365, endpoint and network vulnerability findings into the same multi-tenant platform, so MSPs can manage them in one place.
“A Conditional Access gap and an unpatched endpoint appear in the same prioritized queue, client report, and QBR,” Bellini said.
This is useful for MSPs as they manage larger numbers of Microsoft 365 tenants. Bellini said posture also needs to be reassessed over time as Microsoft changes defaults and customers or administrators change configurations.
“M365 posture is not a one-time assessment. Microsoft changes defaults, clients change settings, and administrators make temporary exceptions that are never reverted. Scheduled re-scans help catch those regressions, turning posture management into an ongoing service instead of a one-off engagement,” he said.
Keeping remediation under technician control
ConnectSecure said the new Microsoft 365 capability can address certain Security Inspector findings, including MFA gaps, legacy authentication, risky sign-ins and Microsoft Secure Defaults. Technicians still review changes before they are applied, especially when those changes could affect user access.
“Today, remediation remains a technician-led process. Findings are surfaced and prioritized by the platform, but technicians review and apply changes within Azure or Microsoft 365,” Bellini said.
This is important with identity and email settings, because the wrong identity or email setting can lock users out.
“Changes to a client's identity and email security configuration can have real operational impact. A Conditional Access policy applied without the proper context could lock users out of critical systems. We believe it is better for a technician to validate the recommended changes than for the platform to make those decisions automatically in the background,” Bellini said.
ConnectSecure is also looking at approval-based automation, where the platform recommends a change and a technician approves it before it is applied.
“Human oversight will remain part of the process. Our direction is approval-based automation: the platform recommends a specific change, the technician approves it, and the action remains reversible,” Bellini said.
For MSPs managing hundreds of environments, much of the scaling happens before remediation. Scans can run on a schedule, tenants are mapped once and technicians can work from a prioritized view rather than moving manually through each customer environment.
Bellini said the resulting reports are also designed to feed directly into client conversations.
“The output is what many MSPs value most: a per-tenant posture report mapped directly to CIS controls, with documented gaps, supporting evidence, and remediation status. That's the document that goes into a QBR or in front of a client's auditor, without any need for further time-consuming reformatting,” he said.
Training assessments add a client education piece
ConnectSecure is also adding Training Assessments, which lets MSPs create and assign security training assessments for clients. MSPs can build assessments from a topic, source text, uploaded content or a template, then edit the questions before publishing. They can also set difficulty, time limits, passing scores and other requirements.
The platform tracks results such as pass rates and question-level performance, giving MSPs data they can use in client reviews, compliance work and ongoing security training.
How ConnectSecure expects MSPs to package it
ConnectSecure expects partners to package the new capabilities at different service levels rather than putting everything into a single security bundle.
“We see this as a tiered offering rather than one universal bundle,” Bellini said.
Patch 360 is included in ConnectSecure’s core platform. Training & Security Awareness and M365 Security Inspector are part of its Silver tier.
“Patch management is a baseline expectation for virtually every MSP client, so we don’t treat it as an upsell,” Bellini said.
The Microsoft 365 and training capabilities are aimed at MSPs building broader security programs around recurring posture reviews, compliance evidence and client reporting.
“These solutions are particularly valuable for MSPs building and selling a broader security program rather than simply providing security tools. They’re designed for providers conducting quarterly posture reviews, delivering evidence for client auditors, and establishing security as a dedicated line of business rather than folding it into managed services,” Bellini said.
ConnectSecure prices those capabilities per tenant rather than per user. That can make costs easier to model for MSPs serving a large number of smaller businesses, where per-seat pricing can change considerably as customer headcount moves up and down.
“From a commercial standpoint, pricing is structured per tenant rather than per seat. That keeps costs predictable for MSPs managing a large number of smaller customers,” Bellini said.
ConnectSecure also said Patch 360 is now available. It includes pilot-first testing, risk-based prioritization, staged deployments, approval workflows, rollback and visibility into the patch lifecycle. These give MSPs a way to test updates before pushing them more broadly across customer environments.
Taken together, the updates give MSPs one place to handle more of the ongoing work around Microsoft 365 security, patching, training and client reporting.
