Skip to main content

Huntress Managed ISPM Readiness and Requirements

Nick
  • Updated

TEAM: Huntress Managed Identity Security Posture Management (ISPM)
PRODUCT: Huntress ISPM
ENVIRONMENT: Microsoft 365
SUMMARY: How to prepare and enroll in Huntress Managed ISPM (Identity Security Posture Management)

 

Requirements

  • A current paying (not trialing) ITDR partner with a Microsoft 365 environment, AND:
    • Have app version 5+ in order to have the correct permissions needed for ISPM
    • Can not be a CSP/CPV mapped organization
    • Can not be GCC/GCC High
      • GCC/GCC High is being investigated and may be available at GA

How to enroll

  • ISPM enrollment will be done via an in-portal experience.
    • Select the ISPM button. 
  • It uses the same Graph API as Managed ITDR. 
  • Once you click the button to join EA in the portal, the ISPM Dashboard will be available in the left-hand navigation menu. From there, individual Organizations can be enabled for ISPM, and the dashboard will populate over time. 

How ISPM works

  • How does Managed ISPM work? 
    • It connects to Microsoft 365 Organization using the same Enterprise Application as ITDR. (version 5+)
    • ISPM will connect to the Microsoft Graph API, retrieve the tenant data, and import it to the database.
    • The analysis of “current settings” vs. “recommended settings” will be populated in the portal. Clearly identifying settings that need to be secured.
    • Users can elect to resolve settings one at a time (EA limitation) and enable auto-remediation.
    • At GA: During onboarding, all “low impact” security settings will be deployed by default (opt-out possible)
    • At GA: Settings can be enforced and auto-remediated tenant-wide
    • When changes are made, ISPM stores the previous configuration to enable a rapid rollback to the previous state.
    • ISPM is tied into the Microsoft 365 Unified Audit Log to track changes to the managed settings. When changes are detected, these can either be auto-remediated or escalated to the partner. 
    • If auto-remediation is enabled and we successfully secure the setting, we will not escalate to the partner and will simply log it in the portal. If a setting can't be remediated, we will escalate to the partner (no SOC incidents).
  • What does ISPM being “Managed” look like
    • Huntress owns the best practice Microsoft 365 identity security framework 
    • Posture changes and enforcement are automated 
    • Priorities in the framework are driven by attacks we actually see across 10M+ identities
    • We help you identify impact and keep you out of the weeds 
    • Managed ISPM is left of boom so it doesn’t generate incidents or use SOC investigation
    • Our SOC is part of the intelligence engine behind ISPM. ITDR incidents tell us which attack paths are most abused and where ISPM can improve posture
    • Managed ISPM operationalizes our SOC’s learnings at scale by creating an identity framework to harden Microsoft 365
  • What exactly does Managed ISPM enforce in EA?
    • 30+ policies/configurations spanning Multi-Factor Authentication (MFA), Administrative Account Policies, Password Policies, Standard User Permissions, Guest Permissions, and Conditional Access Policies. 

EA Frequently Asked Questions (FAQ)

  • Who will provide support to those participating in Early Access? 
    • Product support will answer tickets, but will internally route most questions and support to the Managed ISPM team.
  • How does an EA participant provide feedback or request a new feature on their Managed ISPM experience?
  • Extensive ISPM EA FAQ KB

Additional information can be found in the Huntress Managed ISPM FAQ

Related articles