Most Microsoft 365 tenants were set up to get people working, not to keep attackers out. Managed ISPM checks yours against close to 80 security controls, fixes the gaps in a safe order, and watches for changes that undo them.
In two separate 2026 campaigns, attackers got into Microsoft 365 accounts protected by policies that required MFA. The policies had gaps: the wrong apps in scope, rules left in report-only mode. The attackers didn't beat MFA. They found where it wasn't applied.
of Microsoft 365 tenants reviewed had incomplete multi-factor authentication configurations.
were missing key restrictions on administrator accounts.
had standard users who could perform administrative functions.
Sources: Huntress Managed ISPM early access findings across more than 12,000 Microsoft 365 tenants, published at general availability (June 2026); Huntress, Future-Ready Your Security Team (2026).
Multi-factor authentication, Conditional Access, legacy sign-in methods and administrator roles.
Mail protection settings that stop phishing, spoofing and silent forwarding.
Sharing and external access settings that decide who outside your business can see your files.
Changes that weaken a protected setting are detected and can be put back, so a fix doesn't quietly come undone.
Every control is checked and ranked by risk and by how much it would affect your people. We walk you through what was found.
Huntress · RRCyberControls that won't change anyone's day are scheduled and deployed automatically.
Huntress · scheduledHigher-impact policies run in Learning Mode, using real sign-in data to show exactly who would be affected before anything is enforced.
Huntress · Learning ModeThe scanner in the front office or the founder who travels constantly: we agree any exceptions with you, on purpose, and write them down.
RRCyber · with youSettings stay monitored, and the monthly summary shows what's protected.
Huntress · ongoingIncluded
Not included
Some controls, Conditional Access in particular, need Microsoft 365 Business Premium or an Entra ID P1 licence. We'll tell you which controls your current plan supports before anything changes.
Where your data goes. Security data from your computers and accounts is processed by Huntress, our security operations partner, in the United States. Huntress handles it under a data processing agreement that covers Canada's privacy law (PIPEDA), notifies us of any breach affecting it within 72 hours, and redirects government requests for it to us where the law allows. If your organization has rules about where data can be processed, raise it on your call and we'll walk through it before anything is installed.
Each service is watched by the same 24/7 security operations centre, so a stolen login and a suspicious laptop are seen as one incident, not two.
Endpoint detection and response. 24/7 detection and response on every computer.
Learn more →Identity threat detection and response. Stop account takeover in Microsoft 365 and Google Workspace.
Learn more →Security information and event management. Your logs collected, watched and kept for compliance.
Learn more →Thirty minutes. We'll look at how your computers are covered today, what would happen if one were compromised after hours, and where the gaps are. A plain answer either way.
Or email sales@rrcyber.ca