Microsoft 365 management tools for MSPs: Lighthouse, CIPP, Augmentt and RMMs compared
Whether an MSP needs a paid Microsoft 365 management tool depends less on the tool than on the licences your clients already hold. Microsoft 365 Lighthouse is free to the partner and CIPP costs little to self-host, but both only show MFA and risk data where tenants run Business Premium, E3 or E5. If most clients do, free tools cover the basics. If they run Business Basic or Standard, no tool fixes the missing data. Here is how the options compare.
The licence gate nobody puts on the feature matrix
Comparison pages tend to line up features in tidy columns. The column they leave out is the one that decides what you actually see. Multi-tenant tools read data through Microsoft's APIs, and Microsoft only produces some of that data when the customer tenant has paid for it.
Lighthouse is explicit about this. According to Microsoft Learn: Requirements for Microsoft 365 Lighthouse, a customer tenant must have delegated access (DAP or GDAP) set up, at least one licence of Microsoft 365 Business Premium, Windows 365 Business, Microsoft 365 E5, Microsoft 365 E3 or Microsoft Defender for Business, no more than 2500 licensed users, and must sit in the same geographic region as the partner. The same page states that reports such as Risky users, Multifactor authentication and Self-service password reset only populate when the tenant has Azure Active Directory Premium P1 or later, which comes with Business Premium and E3, with P2 included in E5.
That second point matters more than any vendor's marketing. Risk detections are a Microsoft licensing feature, not a tool feature. A third-party product can still query per-user MFA registration through other means, but it cannot conjure risky sign-in detections Microsoft never generated.
The licence test: before comparing tools, list every client tenant and its highest licence. Count how many have Business Premium, E3 or E5. That number tells you more about your options than any demo.
Microsoft 365 Lighthouse: free, capable, and fenced in
Lighthouse is Microsoft's own multi-tenant portal. Cost is not the obstacle: Microsoft Learn: Sign up for Microsoft 365 Lighthouse says it needs one licence in the partner tenant only, with no additional per-user licences for the partner and no Lighthouse licences in any customer tenant.
The fences are elsewhere:
- Licence eligibility. Tenants without one of the qualifying licences cannot be actively managed. A client on Business Standard is simply outside the portal.
- GDAP maturity. Delegated access must be in place. If your GDAP relationships are half-migrated, Lighthouse will show you a half-migrated client list.
- Region and size. The same-region rule catches MSPs with clients abroad, and the 2500 licensed user ceiling rarely bites small MSPs but is worth knowing.
For a client base that is mostly Business Premium, Lighthouse gives baselines, MFA status, device compliance and risky user views at no cost. That is a strong default, and an awkward one for any vendor charging per seat for the same view.
CIPP: open source, broader reach, your Azure bill
CIPP takes a different path. The CIPP Documentation describes it as an open-source Microsoft 365 multi-tenant management system created by Kelvin Tegelaar in 2021, with a React/Core UI frontend and a PowerShell-based API running on Azure Functions and Azure Static Web Apps.
Because it works through GDAP and the Graph API rather than Lighthouse's eligibility rules, CIPP tends to reach tenants Lighthouse will not onboard, though Premium-only data such as risk detections stays Premium-only. Its strengths are bulk actions: user onboarding and offboarding, standards applied across tenants, and alerting on drift.
Cost comes in two shapes. GetNerdio: Cyberdrain CIPP guide notes CIPP is licensed under AGPL-3.0 and can be self-hosted in your own Azure environment, or run as a sponsored hosted instance for a $99 monthly sponsorship that includes automated updates, staging environments and priority support. For self-hosting, tminus365: CIPP vs Lighthouse Deep Dive puts the click-to-deploy configuration with average usage at about $15 to $20 (or £17 to £22) per month in Azure charges.
The real price of self-hosting is ownership. Someone has to keep the deployment updated and understand it when it breaks. A free tool that only one technician understands is a key-person risk wearing an open-source licence.
Augmentt-style platforms: paying for polish and alerting
Commercial tools such as Augmentt package multi-tenant management into a supported product with reporting and client-facing outputs. Per Augmentt Pricing, its Secure, Engage and Intune Autopilot plans are priced per user for MSPs, with $250 per month cited as the lowest entry price for a single subscription at minimum seat volume, and final pricing varying by seats, tenants, modules and contract terms.
Alerting is sold separately. The Augmentt newsroom: Augmentt Alerts launch announced Augmentt Alerts from $99 per month for 1,000 seats, covering notifications for over 140 critical M365 activities including MFA disablement and risky sign-ins, with one-click remediation.
The arithmetic is simple. A paid platform earns its cost when it saves technician hours you would otherwise spend building and maintaining CIPP, or when its reports help you sell and retain security services. It does not earn its cost by showing Premium data on non-Premium tenants, because it cannot.
RMMs with native Microsoft 365 management
The fourth option is the one you may already pay for. Several RMM and PSA platforms now include Microsoft 365 modules covering user management, licence reconciliation, MFA status and alerting alongside devices. The appeal is one console and one alert queue, so a disabled MFA method and a failed patch land in the same ticket system rather than two.
Depth varies widely, so test it rather than trusting the checklist. Ask whether the module uses GDAP, which actions it can take rather than merely report, and whether licence counts feed client billing. We covered the monitoring side in watching the tenant, not just the endpoint; the buying question here is whether the module replaces a separate tool or just adds a tab.
Microsoft 365 management for MSPs: a decision rule
| Your situation | Likely answer |
|---|---|
| Most tenants on Business Premium, E3 or E5, GDAP complete | Lighthouse, plus your RMM's module for alerting into tickets |
| Mixed licences, a technician comfortable with Azure and PowerShell | Self-hosted CIPP |
| Mixed licences, nobody wants to own infrastructure | Sponsored CIPP or an RMM with a strong native module |
| Selling packaged security services, want client reports and supported alerting | A paid Augmentt-style platform |
| Mostly Business Basic or Standard tenants | Fix the licensing conversation first; no tool supplies missing risk data |
The same logic applies to internal IT teams managing a single tenant: multi-tenant tooling adds little, and the licence question is the whole question.
Rule of thumb: pay for a separate Microsoft 365 tool only when it removes work you are actually doing, not when it promises visibility your clients' licences do not unlock.
How each option tends to fail
- Lighthouse fails quietly: ineligible tenants simply never appear, and the dashboard looks complete.
- Self-hosted CIPP fails when its owner leaves or an update is skipped for months.
- Paid platforms fail on cost creep as per-user seats grow with your clients.
- RMM modules fail when they report but cannot act, leaving you back in the admin centre.
Where this fits with Helios
Helios includes Microsoft 365 management in the same platform as monitoring, patching, ticketing and billing, so tenant alerts become tickets that Helio, its AI agent, can triage alongside device issues. It does not change Microsoft's licence gate: Premium-only data still needs Premium licences. Every feature is on every plan, from £20 a month, with 14 days free and no card to start, and the comparison with other RMM and PSA platforms sets out where it fits. Most of the decision above is about licensing discipline, not tooling, and that holds whichever option you choose.
Common questions about Microsoft 365 management tools
Is Microsoft 365 Lighthouse really free for MSPs?
Microsoft 365 Lighthouse needs one licence in the partner tenant only, with no extra per-user licences for the partner and no Lighthouse licences in customer tenants. The practical cost is eligibility: each customer tenant needs delegated access and a qualifying licence such as Business Premium, E3, E5, Windows 365 Business or Defender for Business before Lighthouse will actively manage it.
Can CIPP and Lighthouse be used together?
CIPP and Lighthouse can run side by side because both rely on delegated access rather than an agent. Many MSPs use Lighthouse for Microsoft's own baselines and risk views on Premium tenants, and CIPP for bulk user tasks and standards across every tenant, including those Lighthouse cannot onboard. The main overhead is keeping GDAP roles consistent for both.
Why does the MFA report show nothing for some clients?
An empty multifactor authentication report in Lighthouse usually means the customer tenant lacks Azure Active Directory Premium P1 or later. P1 comes with Microsoft 365 Business Premium and E3, and P2 with E5. Tenants on Business Basic or Standard will not populate these reports, so the fix is a licence change, not a different management tool.
Read next
Why MSPs choose Helios
One platform that does the work, at a price that stays put
Helio fixes, not just flags
When an alert fires, Helio, the AI technician built into Helios, investigates it, writes the fix and runs it once you approve. It keeps what works, so the next one is quicker.
Everything in one product
RMM, a service desk with SLAs, patching including third-party apps, remote access, Microsoft 365 and Defender checks, backup monitoring, a client portal and billing into Xero or QuickBooks.
Priced by fleet, not by people
£4 a device on Launch up to 25 devices, from £20 a month, then £99, £199 or £399 a month by fleet size, with any number of technicians and every feature on every plan.
A price that stays put
Your price is locked for as long as you stay subscribed, and that is written into our terms. Monthly billing, cancel any time.
Bring your clients across
Import your clients and machines from another RMM's CSV export, then roll the Helios agent out at your own pace, with a count of how many have arrived.
14 days free, no card to start
The full platform from the first minute, on your own machines. No sales call. Remote control asks for one card check, and nothing is charged.
See it on your own fleet
Helios is the AI-native platform for MSPs: monitoring, patching, security, Microsoft 365, backup monitoring, remote access, client billing and an AI service desk in one product, at one flat price per MSP. Contracts and logged time become invoices in Xero or QuickBooks without leaving the platform. Every feature is on every plan. 14-day free trial, card-free, set up in minutes, cancel any time.
Start freeResearched and written with Helio SEO, our AI writer for business blogs.