Running the MSP security practice: GDAP, Lighthouse, NCE and licensing strategy, PowerShell automation, migrations, QBR reporting, and vCISO services.
A HaloPSA self-service form, one webhook, and a Power Automate flow per tenant turn user onboarding into a hands-off process. Here is the full build, including the ROI math.
Microsoft Forms plus Power Automate can create the user, license them, set their manager, mirror group access, and send the welcome email. No third-party tools, one tenant at a time.
Most MSPs stall on security because they assess ad hoc and remediate reactively. A repeatable loop of assess, prioritize, implement, and monitor fixes both, and it maps cleanly to the CIS Controls.
CIPP and Microsoft 365 Lighthouse both beat Partner Center for multi-tenant management. Here is the full comparison across twelve categories, with a downloadable matrix and a clear verdict.
App secrets and refresh tokens hardcoded in scripts are a breach waiting to happen. Two scripts to load Secure Application Model secrets into Azure Key Vault and pull them at runtime for headless automation.
Microsoft unbundled Teams from Microsoft 365 worldwide in April 2024. Existing subscriptions keep Teams; net-new quotes need a decision. Here is the SKU map, the pricing math, and the catch.
Lighthouse now flags which customers are ready to buy Microsoft 365 Copilot. Here is how to size the revenue, time the pitch to NCE renewals, and open with an AI readiness assessment.
When you widen an app registration's Graph permissions under GDAP, every customer relationship needs the matching role. Here is the architecture and script that updates them all at once.
Build an Entra ID app registration, mint a refresh token, and call any Microsoft Graph API from a script with no human at the keyboard. Every step, every screenshot, two reusable scripts.
September 25 ends DAP for new customers, Conditional Access protected actions hit GA, Python lands in Excel, and the legacy Exchange Online client ID heads for retirement.
GDAP removes the pre-consent that delegated vendor integrations rely on. Here is the split of work: the prerequisites the MSP configures and the consent workflow the vendor has to build.
GDAP removes the pre-consent that made partner app registrations just work. Here is the full repair path: service account, app registration, GDAP roles, and the consent API, with scripts.
