Microsoft 365 and Defender monitoring for MSPs: watching the tenant, not just the endpoint

Microsoft 365 and Defender monitoring for MSPs means watching each client tenant, not just the devices: risky sign-ins, inbox rules and external forwarding, Defender for Business alerts and Secure Score drift, all routed into your ticket queue. Endpoint agents cannot see that layer. A green dashboard of healthy laptops tells you nothing about the forwarding rule quietly copying the finance director's inbox to a Gmail address. This piece covers why endpoint monitoring alone leaves the door open, what good multi-tenant monitoring looks like, how vendors package it, and a checklist of signals every client deserves.

Why endpoint monitoring misses tenant-level risk

Traditional RMM grew up watching machines: disk space, services, patch status, CPU. If you want the basics, our explainer on what RMM actually does covers them. The model assumes the machine is where things go wrong. For a modern small business, that assumption is out of date.

Identity is now the perimeter. A stolen password plus an approved MFA prompt gives an attacker the mailbox, SharePoint and Teams from a browser on the other side of the world. No malware lands on any endpoint you manage. Every device check stays green. The compromise is entirely real.

The received wisdom is that Defender on the endpoint covers this. It does not. Defender for Endpoint and Defender for Business protect devices; the identity and mail signals sit in Entra ID and Exchange Online, and they have to be pulled and read separately.

The four tenant signals that matter most

Risky sign-ins and impossible travel

Entra ID flags sign-ins it considers risky: unfamiliar locations, anonymising IPs, token anomalies, atypical travel. Full risk detection depends on Entra ID P2, which many small clients lack, but even basic sign-in logs show failed MFA storms, legacy authentication attempts and logins from countries the client has never done business in. Someone has to be looking.

Mailbox rules and forwarding

Business email compromise follows a well-worn pattern: gain access, create an inbox rule that hides replies from a supplier or moves anything mentioning "invoice" to an obscure folder, then wait. New inbox rules, external forwarding and changes to mailbox permissions are some of the highest-value alerts you can raise, and they cost almost nothing to watch.

Defender for Business alerts

Microsoft 365 Business Premium includes Defender for Business, so plenty of your clients already own a capable EDR. The problem is that its alerts land in each tenant's own security portal. Unless you have wired them into your queue, they are a smoke alarm in an empty house. Alerts should become tickets, with an owner and a response time.

Secure Score drift

Secure Score is imperfect, but its movement is useful. A sudden drop usually means someone changed something: security defaults switched off, a conditional access policy excluded "just for now", a new admin created. The drift test: if you cannot say why a client's score fell last month, you are not managing their tenant, you are hosting it.

What good multi-tenant monitoring looks like

Logging into forty admin centres one at a time is not monitoring. It is sightseeing. Good multi-tenant M365 monitoring has a few recognisable traits.

• One consented connection per tenant. Granular delegated admin privileges (GDAP) or a scoped app registration, with least-privilege roles. Skip this and you end up with shared global admin accounts, which is the exact risk you are paid to prevent.
• Signals become tickets. Alerts belong in the same queue as everything else, tied to the client, with SLAs. A separate security inbox is where alerts go to age. If you are weighing a helpdesk, our guide to the best PSA for small MSPs covers what that queue needs.
• Baselines, not just alerts. A defined standard per client (MFA enforced, legacy auth blocked, external forwarding disabled) and a report of which tenants deviate.
• Context alongside the device. When a user reports a slow laptop and has also had three risky sign-ins this week, you want to see both on one screen.
• Licence and user hygiene. Disabled users still holding licences, leavers with active sessions, guest accounts nobody remembers inviting.

This applies whether the tenants belong to clients or to your own company. An internal IT team with one tenant needs the same signals, just without the multi-tenant switching; our piece on RMM for internal IT teams covers what else changes.

Built in or bolted on: how vendors differ

This is where buying decisions get muddy. Vendors handle Microsoft 365 in roughly three ways.

The add-on route is common, and the cost tends to hide in per-user pricing that grows with every client hire. Our breakdown of add-ons and hidden fees vendors leave off the pricing page is worth reading before you sign. During a trial, connect a real tenant, create a test forwarding rule and time how long it takes to become a ticket. That single test tells you more than any datasheet.

Failure modes: what goes wrong without tenant monitoring

• The invisible compromise. A mailbox is controlled for weeks; the first sign is a supplier asking why their bank details changed.
• The unread alert. Defender raised it correctly, in a portal no one opened.
• The temporary exception. A conditional access exclusion added for a travelling director is still there two years later.
• The ghost admin. A former technician's admin role outlives their employment.

The tenant signal checklist

Every managed client deserves someone watching these. Skip any of them and you are relying on luck.

1. Risky and anomalous sign-ins: unfamiliar countries, anonymising IPs, impossible travel.
2. MFA failures and fatigue patterns: repeated denied prompts against one user.
3. Legacy authentication attempts: these should be blocked, and attempts are worth knowing about.
4. New inbox rules: especially delete, move-to-folder or mark-as-read rules.
5. External forwarding: any mailbox forwarding outside the organisation.
6. Mailbox permission changes: new FullAccess or SendAs grants.
7. Defender for Business alerts: routed into your ticket queue with an owner.
8. Secure Score changes: with a reason recorded for every drop.
9. Admin role changes: new global admins and privileged role assignments.
10. Conditional access and security defaults edits: anything weakening policy.
11. New app consents: OAuth apps granted mail or file access.
12. Leaver hygiene: disabled users with licences, sessions or forwarding still active.

Where this fits with Helios

Helios includes Microsoft 365 management in the same platform as monitoring, patching, security and ticketing, so tenant signals and device signals sit side by side and land in one queue. Helio, the built-in AI agent, can triage those alerts and investigate alongside device data, with approvals where you want a human to decide. It is on every plan rather than sold as an add-on. The honest limit: tooling surfaces the signals, but deciding each client's baseline and acting on alerts is still discipline. You can see how Helios compares with other MSP platforms.

Helios: AI-native RMM and PSA for MSPs and internal IT. 14-day trial and no feature gating. Start free.

Related: Microsoft 365 management tools for MSPs: Lighthouse, CIPP, Augmentt and RMMs compared, Microsoft 365 security audit for MSPs: the settings to check at client onboarding

Researched and written with Helio SEO, our AI writer for business blogs.