What Microsoft 365 Management Tools Are
Written by MSP Outpost.
In Short
These tools let an MSP manage every client's Microsoft 365 tenant from one console: users, licenses, security settings and drift away from a standard you set. The built-in admin centers do the same work one tenant at a time. They are not backup: a backup tool keeps copies of mail and files, while these manage how each tenant is set up.
What It Does
- Multi-tenant view. Every client tenant in one list, without signing in and out of each.
- Baselines. Applies a standard set of security settings and shows which tenants have moved away from it.
- Licenses. Finds unassigned and unused licenses so clients stop paying for seats nobody uses.
- User lifecycle. Creates and removes users the same way every time, with groups, licenses and mailbox settings included.
- Alerts. Flags risky sign-ins, new admins and changes such as mail forwarding to an outside address.
- Reporting. Shows each client the state of their tenant in terms they can follow.
When You Need One
With a handful of tenants, the built-in admin centers and a written checklist are enough. Free and open-source options exist if you want one console, but this is not something to pay for yet.
Once you look after ten or more tenants, settings drift and license waste goes unnoticed. This is when one console and a baseline start paying for themselves.
Tenant standards become part of what you sell, and clients or auditors ask you to show them. Choose a tool that can prove a setting was in place on a given date, not only that it is in place now.
What to Look For
Must Have
- Multi-Tenant Console
- Security Baselines
- Drift Alerts
- License Reporting
- Delegated Admin Access
- Onboarding and Offboarding
Worth Having
- Automated Remediation
- Change History
- Client-Facing Reports
- PSA Integration
- Mail Forwarding Alerts
How It Is Priced
Most charge per user per month, counted across every client tenant, and some are quote only. Minimums can be high, sometimes set per module, so a tool built for large MSPs can cost a small one more than it saves. Free and self-hosted options exist, but you take on the hosting and the updates yourself.
Switching
This is one of the easier categories to leave, because the tenants stay where they are and you mainly lose baselines, templates and change history. Before you sign, ask how baselines are exported and whether history stays readable after you cancel. When you go, remove the old tool's access from every tenant.
Questions to Ask a Vendor
- How is the user count worked out: licensed users, every account, or shared mailboxes too?
- What permissions do you need in each tenant, and can they be limited to the features I use?
- Can I preview what a baseline will change before it runs?
- Is the minimum per account or per module, and does it apply from the first month?
- How long after a new setting appears in the admin center do you support it?
- Can I export baselines and change history if I leave?
