Team: Huntress Managed Identity Security Posture Management (ISPM)
Product: Huntress ISPM
Environment: Microsoft 365
Summary: Find answers to common questions about Huntress Managed ISPM onboarding, deployment baselines, security controls, posture assessments, and troubleshooting.

Availability and Onboarding

Review requirements, integration details, and expected timelines to get started with Huntress Managed Identity Security Posture Management.

What is Managed ISPM?

Huntress Managed Identity Security Posture Management (ISPM) helps identify and harden Microsoft 365 identity and security settings using a Huntress-maintained security framework, managed controls, drift detection, and Continuous Enforcement.

Is Managed ISPM available without a Managed ITDR subscription?

Managed ISPM is available independently of a Managed ITDR subscription, subject to current product requirements and the supported Microsoft 365 integration flow.

How do I enable Managed ISPM?

Follow the steps in Managed ISPM Onboarding. Connect or edit a Microsoft 365 integration, select ISPM, approve the requested Microsoft permissions, and enable the organization.

Why is my organization not eligible?

Review the eligibility status shown in the Huntress Platform. Common causes include an unsupported Microsoft 365 environment, an outdated integration or application version, an unsupported organization mapping, or incomplete permissions.

If the reason remains unclear, contact Huntress Support with the organization name and the displayed eligibility message.

How long does onboarding take?

After onboarding, Huntress imports and evaluates Microsoft 365 configuration data. The dashboard and assessments might not be available immediately; initial assessment data is typically ready within 15 minutes. For more information, see Review and Generate Identity Posture Assessments.

Deployments

Understand baseline selection, automated schedules, and how Huntress applies security configurations across your organization(s).

What is Managed Deployment?

Managed Deployment is the default deployment mode for eligible organizations added on or after August 3, 2026. Huntress maintains a curated selection of controls and can add eligible controls as the managed library evolves.

What is Modified Deployment?

Modified Deployment lets you select and maintain the default control selection at the account level. New organizations inherit that selection, and new controls are not added automatically.

Does Managed Deployment deploy every available control?

Managed Deployment uses a curated baseline. Controls outside the managed selection remain available for manual deployment or scheduling.

Can I skip one control for one organization?

Yes. An organization-level skip prevents that control from deploying to that specific organization. It does not switch the organization to Modified Deployment, nor does it prevent the organization from inheriting future Huntress-managed controls.

When do scheduled deployments run?

Scheduled deployments run Monday through Thursday each week.

Will Managed Deployment deploy a control that the organization is not licensed for?

Managed Deployment uses license gating to avoid deploying controls for unlicensed features. You remain responsible for maintaining Microsoft licensing compliance.

Can I turn deployments off?

Yes. The deployment feature supports an Off mode. You can also use an organization-level skip for a specific control to retain the rest of the managed baseline.

Can I roll back a deployed control?

Supported controls can be reverted from the Managed Deployments page or from the individual control page. If Continuous Enforcement is active, disable it before making manual changes or reverting the setting. For details, see Managed ISPM Rollback and Microsoft Account Access Issues.

Controls and Posture

Learn how security controls function, how drift detection operates, and how ratings compare to native vendor scoring.

What does a security control do?

Each control includes a description of its purpose, expected impact, and current state. Review the control details before deploying it.

Can I use my own baseline?

Yes. Use Modified Deployment when you want to choose and maintain the default control selection at the account level.

What is Continuous Enforcement?

Continuous Enforcement keeps a supported control compliant after deployment. If configuration drift is detected, Huntress restores the control to its compliant state.

Disable Continuous Enforcement before manually editing or reverting a protected control.

What is the difference between Huntress ISPM alignment and Microsoft Secure Score?

The Huntress ISPM compliance rating evaluates the organization's controls against the Huntress Identity Security Framework. The Huntress Score is currently calculated as the number of compliant controls out of the total available (e.g., XX/34). Microsoft Secure Score is calculated independently by Microsoft and does not change the Huntress compliance rating. For detailed Secure Score recommendations, use the Microsoft Defender portal.

Assessments, Coverage, and Existing Policies

Review reporting capabilities, platform coverage, API access, and policy coexistence rules.

Can I generate a posture report for a customer or organization?

Yes. Generate an Identity Posture Assessment on demand from the Account or Organization view in the Huntress Platform. It provides a point-in-time view of assessed controls, compliance status, gaps, recommended actions, and remediation options (deployable by Huntress versus completed manually in Microsoft 365). Reports can be downloaded and co-branded. For more information, see Review and Generate Identity Posture Assessments.

Which Microsoft 365 areas does Managed ISPM assess?

The assessment covers controls across Microsoft Entra ID, Exchange, SharePoint, and Teams. Coverage includes authentication, guest access, administrator protection, application consent, email security, and external collaboration. The assessment applies specifically to Microsoft 365 and is not currently available for Google Workspace.

How does licensing affect the assessment?

The assessment evaluates the controls available to the organization and excludes those that the Microsoft 365 tenant is not licensed to use. For non-compliant controls, the report identifies whether Managed ISPM can deploy the change or whether a Microsoft 365 administrator must complete it manually.

Why is an existing Conditional Access policy not showing as compliant? Can I adopt it?

A customer-created Conditional Access policy is not automatically recognized as a Huntress-managed policy, even if technically similar. Adopting existing Conditional Access policies is not currently supported; instead, use the supported Huntress-managed policy workflow. Before deploying a policy, evaluate potential user impact using Learning Mode.

What does Learning Mode do?

Learning Mode analyzes the potential impact of a Huntress-managed Conditional Access policy before deployment, identifying users who could be affected to help you make an informed deployment decision.

Can I get assessment data through the Huntress API?

Yes. Security-control status and full assessment data are available through the Huntress API.

Make a GET request to /v1/organizations/<organization_id>/posture_assessment to retrieve complete report data.
Refer to the Huntress REST API documentation for current endpoints and schema details.

Does disabling or removing ISPM revert changes already made in Microsoft 365?

Disabling ISPM does not undo policy changes already applied in Microsoft 365. Deployed settings remain active unless you manually revert them. For supported controls, disable Continuous Enforcement before reverting the setting. See Disable or Revert a Policy After Microsoft Account Access Issues.

Troubleshooting

Resolve common access conflicts, sign-in issues, and dashboard sync delays.

What should I do if an ISPM policy causes a sign-in problem?

If you can access the Huntress Platform with an unaffected administrator account, complete the following steps:

Disable Continuous Enforcement for the affected control.
Revert the affected security setting.
Allow standard Microsoft propagation time.
Test the sign-in flow using a new private browsing window.

For comprehensive recovery steps, review Managed ISPM Rollback and Microsoft Account Access Issues.

What should I do if Self-Service Password Reset conflicts with secure authentication methods?

Review the configuration steps in Managed ISPM Self-Service Password Reset Configuration.

What should I do if the dashboard does not populate?

Confirm that onboarding is complete, review integration status details, and allow time for initial data import and evaluation. Contact Huntress Support if the status remains unchanged or displays an error.

How do I request a feature or provide feedback?

Submit feature requests and feedback through the Managed ISPM Feedback Portal.

Huntress Managed ISPM - Frequently Asked Questions (FAQ)

In This Article