CloudCapsule Manage Adds Multi-Tenant Microsoft 365 Remediation

Microsoft 365 security has become an operational scaling problem as much as a technical one, and CloudCapsule CEO Nick Ross argues that managed service providers need to stop treating it as an endless stream of alerts and start delivering it as a repeatable, continuously improving service. In an interview with CRN, Ross described a security market in which MSPs are expected to protect hundreds or thousands of tenants, interpret Microsoft’s relentless platform changes, align work to frameworks such as CIS and NIST, and still make the business case to customers.
That is an ambitious diagnosis, but it is also directionally correct. Microsoft 365 is no longer merely an email and productivity suite sitting at the edge of an organization’s security program. It is often the center of identity, collaboration, file sharing, endpoint management, data protection, and now AI-assisted work. For MSPs, that means a missed configuration, a lingering account, or a broadly shared SharePoint site can become a recurring commercial, technical, and insurance risk.
CloudCapsule’s thesis is that the winning Microsoft 365 security playbook will be proactive, standardized, evidence-driven, and automated where automation is safe. Its recently expanded CloudCapsule Manage tier is positioned as a way for partners not only to identify Microsoft 365 security gaps but to remediate policies across multiple customer environments and document the work for compliance and cyber-insurance needs. CRN

Background: Why Microsoft 365 Security Has Become an MSP Bottleneck​

For a typical MSP, Microsoft 365 security rarely arrives as one neat project. It arrives as a relentless accumulation of onboarding work, tenant exceptions, licensing differences, incomplete offboarding, shifting security defaults, customer requests, compliance questionnaires, and incident-driven cleanup.
The practical result is often a fragmented workflow. Engineers log into several Microsoft portals, check policies manually, export screenshots or reports for audits, create tickets, chase customer approvals, make changes, and then try to establish whether the intended control actually took effect. That sequence is manageable for a handful of tenants. It becomes economically punishing when repeated across a large client base.
Ross’s description of the challenge focuses on time, consistency, and scalability, not a shortage of security products. He argues that partners have accumulated dashboards and alert streams faster than they have built a scalable method for prevention. In that model, technicians spend their best hours interpreting noise and recovering from avoidable gaps rather than delivering higher-value security guidance. CRN
Microsoft’s own security tooling illustrates both the opportunity and the complexity. Microsoft Secure Score gives organizations a numerical representation of security posture, a dashboard of recommended actions, historical trends, and benchmark comparisons. It spans areas including identity, devices, applications, and data. Yet Microsoft also explicitly cautions that the score is not a guarantee against a breach; it is a measurement of recommended controls and actions that can help reduce exposure. Microsoft Learn
That distinction matters. A higher score can show that an organization has implemented more of Microsoft’s recommended security actions. It cannot prove that configuration decisions are appropriate for every business process, that third-party controls are configured correctly, or that employees will never make risky decisions.
For an MSP, then, the goal should not be “raise every customer’s score at all costs.” The goal should be build an accountable security baseline, identify meaningful exceptions, prove the status of controls, and continuously improve the environment without breaking customer operations.

---

CloudCapsule’s Proposed Shift: From Findings to Managed Outcomes​

CloudCapsule is making a deliberate distinction between a platform that produces findings and one that helps MSPs operate a security service. Ross said the company’s assessment technology maps more than 250 Microsoft security data points and can scan a tenant in roughly a minute, while CloudCapsule Manage adds multi-tenant remediation, policy deployment, and evidence documentation. CRN
Those vendor-reported figures should be viewed as product claims rather than independent benchmarks. Still, the product direction addresses a genuine MSP problem: visibility has little value when remediation remains manual, inconsistent, or difficult to explain to customers.

Assessment alone is not a security program​

A point-in-time assessment can be useful for sales, onboarding, renewal discussions, insurance applications, and incident follow-up. It can show that multifactor authentication coverage is incomplete, legacy authentication remains enabled, user accounts have not been cleaned up, or information-sharing settings are too permissive.
But assessment-only tools can create a second workload: someone must decide what to change, obtain approval, implement it in the proper admin portal, validate the result, and document the business rationale. If the customer has 50 recommendations, the outcome can be an impressive report with very little completed work.
CloudCapsule’s emphasis on a feedback loop—explaining the risk, identifying the policy to deploy, recording what changed, and surfacing the next recommended action—is significant because it turns a finding into a workflow. CRN
That workflow has commercial importance. MSP customers often do not purchase “a list of configurations.” They purchase confidence that their provider has a controlled process for reducing risk. A report that translates technical language into business implications can make security work easier to approve and easier to renew.

The need for a stable baseline​

The foundation of any repeatable managed security service is a baseline. CIS publishes a Microsoft 365 Foundations Benchmark, with version 7.0.0 listed as the current benchmark family on its Microsoft 365 resource page. CIS describes these benchmarks as community-consensus secure configuration guidelines. CIS
That does not mean every CIS recommendation should automatically be pushed into every tenant. A law firm, a construction company, a healthcare provider, and a design agency can have different operational requirements, licensing positions, regulatory duties, and tolerance for user friction.
The better model is a tiered policy architecture:

• Mandatory baseline controls that should exist in almost every tenant, such as strong identity protections and secure administrative practices.
• Recommended controls that are evaluated against customer workflows and licensing.
• Customer-approved exceptions with a documented owner, business reason, compensating controls, review date, and renewal path.
• Enhanced controls for regulated clients, executive-risk groups, privileged accounts, sensitive data repositories, and high-value endpoints.

This is where a platform such as CloudCapsule can become more than a scanner. If it helps an MSP establish, deploy, track, and report against that architecture across tenants, it becomes part of the provider’s delivery system rather than another portal competing for attention.

---

The Real Security Problem Is Often Operational Drift​

Ross said CloudCapsule regularly finds gaps involving identity, endpoint security, email security, governance, stale accounts, and devices associated with people who were never properly offboarded. He also said the company sees Microsoft Secure Score values around 40 to 45 across its customer base. CRN
The specific score range is CloudCapsule’s own observation and should not be generalized as an industry-wide average. Yet the underlying concern is familiar: security drift.
Security drift happens when an environment starts in a reasonably controlled state but slowly diverges:

• A temporary administrator role is never removed.
• A departing employee’s account remains enabled or retains access.
• A new collaboration site inherits overly broad membership.
• An exception to conditional access becomes permanent.
• A third-party application receives permissions without a periodic review.
• New security recommendations appear after Microsoft changes a product or control.
• A customer adopts Copilot or another AI tool before reviewing the data it can access.

This kind of drift is difficult because no single event necessarily looks catastrophic. The environment simply becomes more permissive, more complicated, and harder to defend over time.
Microsoft Secure Score can help surface recommended actions and categorize them by status, including “to address,” “planned,” “risk accepted,” “resolved through third party,” and “completed.” Microsoft notes that recommended actions are ranked using factors such as remaining points, implementation difficulty, user impact, and complexity. Microsoft Learn
That is valuable, but MSPs need to add an operational layer that Secure Score alone cannot supply:

1. Who owns the remediation?
2. Which tenants should receive the change?
3. What customer approval is required?
4. What will the end-user impact be?
5. How is the change validated?
6. How is the exception recorded if the control cannot be applied?
7. When will the exception be revisited?

Without answers to those questions, security posture management can devolve into a backlog that looks rational in a dashboard but is never meaningfully reduced.

Why alert fatigue destroys margin​

Ross’s reference to “reactive hours per endpoint per month” captures a core managed-services economic reality. If engineers are constantly triaging security alerts, chasing false positives, and recovering from preventable issues, the labor cost of each endpoint rises while customer satisfaction often falls. CRN
The solution is not to declare alerts unimportant. Detection and response remain essential. The solution is to prevent the most common, highest-confidence configuration and governance failures from reaching the alert queue in the first place.
A prevention-oriented Microsoft 365 security service should therefore prioritize:

• Identity hygiene, including MFA coverage, privileged-account controls, conditional access, and prompt offboarding.
• Email resilience, including anti-phishing and anti-malware policies, mailbox auditing, and secure external sharing practices.
• Endpoint alignment, particularly where device compliance, antivirus, vulnerability management, and access policy intersect.
• Data governance, including ownership, sensitivity, sharing rules, retention, and access reviews.
• Continuous evidence, so the MSP can show what is configured now rather than relying on a historical attestation.

The most mature providers will measure not only tickets closed but also avoidable exposure removed, exceptions reduced, inactive accounts remediated, high-risk sharing paths eliminated, and policy conformance maintained.

---

Cyber Insurance Raises the Stakes for Evidence​

CloudCapsule has incorporated cyber-insurance templates into its platform, Ross said, because insurers increasingly want evidence instead of checkbox assurances. He added that insurers are asking for Microsoft Secure Score in some cases, although how consistently carriers use that information remains unclear. CRN
This is an important nuance. A Secure Score can be useful evidence of posture, but it should not become the only proof point in an insurance or compliance process. As Microsoft explains, the score reflects the degree to which recommended actions are in use; it does not represent an absolute measure of breach likelihood. Microsoft Learn
For MSPs, the more defensible approach is an evidence package that combines:

• Current control status and configuration exports.
• Exception records with approvals and compensating safeguards.
• User and administrator access reviews.
• MFA and conditional-access coverage information.
• Endpoint and device-compliance evidence where applicable.
• Incident-response documentation and recovery testing records.
• Dates, owners, and validation notes for completed remediation.

The emphasis should be on truthful, reproducible evidence. If a customer represents that MFA is enabled, but broad exclusions, legacy protocols, unmanaged service accounts, or incomplete enrollment undermine the claim, the risk is not merely technical. It becomes an issue of governance, contractual accuracy, and potentially insurance coverage.
NIST’s Cybersecurity Framework 2.0 strengthens this governance perspective through its Govern function. NIST says the function was added to give greater visibility to activities such as setting risk tolerance, assigning roles, and establishing policies, connecting cybersecurity work more directly to enterprise risk and legal obligations. NIST
That is precisely the lens MSPs should apply. Security evidence is not just a file to attach to an insurance application. It is the record that proves a provider and customer made deliberate risk decisions.

---

AI Readiness Is Becoming the Next Microsoft 365 Security Service​

The most forward-looking part of CloudCapsule’s strategy is its focus on AI readiness, shadow AI investigations, and governance. Ross argues that organizations often discover old permission problems only after enabling Copilot, AI tools, or employee-created agents that make information easier to find. CRN
That framing is technically sound. AI does not need to “break” permissions to create a serious data-exposure problem. It can simply make existing permissions far more discoverable and usable.
Microsoft states that Microsoft 365 Copilot works within existing permissions and access controls, while warning that overshared or poorly governed content can affect Copilot results and increase risk. Microsoft Learn In practical terms, an old SharePoint folder shared too broadly, an ownerless team site, or a document library with broken inheritance may suddenly become much more visible when employees can ask natural-language questions.

Copilot turns dormant governance debt into a live issue​

Microsoft’s guidance for Copilot and agents makes the connection explicit: Copilot and agents retrieve data through Microsoft Graph while respecting existing permissions, sharing settings, and policies. Microsoft recommends using data access governance reports to identify oversharing risks and highlights risk signals such as “Anyone” links, organization-wide access, excessive permissions, weakly protected sensitive content, and ownerless or inactive sites. Microsoft Learn
This creates a substantial managed-service opportunity. Many SMBs do not employ a dedicated data-governance officer, a Purview specialist, or a team responsible for permission architecture. Yet they are being encouraged to adopt AI tools that will touch email, files, Teams content, SharePoint sites, and business records.
An MSP-led AI readiness assessment should not begin with whether a client can buy Copilot licenses. It should begin with whether the data environment is governable.
A practical assessment framework would include:

1. Data discovery
   Identify business-critical repositories, sensitive data categories, stale sites, inactive Teams, public links, and external-sharing patterns.
2. Access review
   Examine privileged groups, broad membership, ownerless sites, dormant accounts, inherited permissions, and exceptional access paths.
3. Information protection
   Review sensitivity labels, DLP policies, retention settings, sharing restrictions, and controls around high-risk data.
4. Agent and application governance
   Establish who can create, publish, connect, and administer AI agents or third-party AI applications.
5. Monitoring and response
   Define how the customer and MSP will detect risky sharing, investigate anomalous behavior, handle AI-related incidents, and maintain evidence.

Microsoft’s own foundational guidance for Copilot centers on three pillars: remediate oversharing, establish guardrails, and meet regulations. It also recommends identifying high-risk sites and files, applying temporary restrictions where needed, fixing access issues, and enforcing secure defaults continuously. Microsoft Learn

Shadow AI cannot be treated as a side project​

CloudCapsule says it is building shadow AI investigations to help MSPs identify the AI applications used inside customer environments. CRN
The need is apparent, but the service must be framed carefully. “Shadow AI” can encompass unauthorized consumer AI use, unsanctioned browser extensions, independently created agents, personal accounts, API-connected SaaS tools, and AI features embedded in already-approved software. Discovery may be technically difficult, dependent on available telemetry, licensing, and customer consent.
MSPs should avoid promising complete visibility where there is none. Instead, they should deliver an iterative governance program:

• Identify what can be observed.
• Classify applications by business value and data risk.
• Block or restrict clearly unacceptable usage.
• Create approved paths for legitimate productivity use.
• Document remaining blind spots and compensating controls.
• Reassess as new AI features and data connectors appear.

Microsoft has also expanded administrative attention around AI risk, with its Microsoft Security Dashboard for AI designed to aggregate risk signals across Defender, Entra, Purview, Microsoft 365 Copilot, agents, and certain third-party AI applications. Microsoft Learn That does not eliminate the need for MSP expertise; it reinforces the importance of providers that can interpret data, prioritize remediation, and explain risk in customer terms.

---

Strengths of the CloudCapsule Approach​

CloudCapsule’s strongest strategic idea is not the claim that it can find more settings than competitors. It is the claim that MSPs need a service-delivery engine for Microsoft 365 security.
Several elements stand out.

A multi-tenant mindset​

MSPs do not need another security product designed primarily for a single enterprise security team. They need a system that recognizes the operational reality of many customers, different service tiers, varying licenses, and recurring customer-facing reporting.
CloudCapsule’s focus on assessing tenants at scale, standardizing policies, and deploying remediations across customer environments directly addresses that model. CRN

Better translation between technical controls and customer decisions​

Customer understanding is often the bottleneck in remediation. David Lewian, CEO of Go West IT, told CRN that CloudCapsule’s language around why controls matter is a meaningful differentiator because compliance platforms can struggle to make the case intelligible to clients. CRN
That is not a cosmetic advantage. If a platform can explain the business impact, expected user disruption, remediation priority, and framework alignment of a control, it can shorten approval cycles and improve accountability.

Alignment with prevention rather than dashboard accumulation​

The industry does not need more dashboard theater. It needs fewer recurring gaps. CloudCapsule’s approach is compelling where it converts detection into guided action and lets MSPs show sustained improvement rather than merely presenting monthly exposure snapshots.

A timely AI governance expansion​

The overlap between Microsoft 365 permissions, Copilot, agents, data classification, and external AI tools is likely to become one of the most valuable advisory areas for MSPs. CloudCapsule is sensible to move toward AI readiness while the market is still forming its operational habits.

---

Risks MSPs Should Not Ignore​

Automation can be valuable, but it cannot substitute for change management. A platform that makes it easier to push policies at scale also makes it easier to create widespread disruption at scale.

Policy deployment needs guardrails​

Before enabling automated remediation, an MSP should have:

• Customer-specific policy templates.
• Approval workflows for disruptive changes.
• Pilot groups or test tenants.
• Maintenance windows where appropriate.
• Clear rollback procedures.
• Exception processes that do not disappear into ticket comments.
• Verification that a policy is behaving as intended after deployment.

A conditional-access rule, mail-flow policy, sharing restriction, or endpoint configuration can improve security while also interfering with a line-of-business workflow. “CIS-aligned” does not automatically mean “safe to deploy without review.”

Secure Score is a signal, not the service​

Microsoft advises that Secure Score should not be interpreted as a guarantee against breach and notes that usability must be balanced against security; not every recommendation will work for every environment. Microsoft Learn MSPs should resist packaging security as a simple promise to reach a particular score.
The better promise is a documented program of risk reduction: baseline controls, measurable improvement, prioritized remediation, accepted exceptions, and business-aligned governance.

Vendor dependency and data access must be scrutinized​

Any platform managing or assessing Microsoft 365 security posture needs meaningful permissions and access to tenant data. MSPs should examine the vendor’s application permissions, data handling, audit logging, authentication model, data residency, retention practices, incident-notification commitments, and offboarding process.
The decision should be treated as an extension of the MSP’s own privileged-access strategy. A security platform that reduces configuration drift but introduces poorly governed high-privilege access would undermine its purpose.

---

The New MSP Playbook​

CloudCapsule’s message is ultimately broader than one product launch. The future of Microsoft 365 security services will belong to MSPs that operationalize prevention, documentation, and governance.
A modern playbook should look like this:

1. Standardize the baseline around CIS, NIST, Microsoft guidance, customer risk tolerance, and service-tier commitments.
2. Assess continuously, not just during onboarding or after a breach.
3. Prioritize by impact, focusing first on identity, privileged access, exposed data, insecure sharing, stale accounts, and other high-confidence risks.
4. Automate carefully, using proven templates, scoped deployment, approval gates, and rollback plans.
5. Document every meaningful decision, including control status, evidence, exceptions, and customer acceptance.
6. Translate technical findings into business outcomes, showing customers what changed, why it mattered, and what should happen next.
7. Treat AI readiness as data governance work, not merely as a licensing or productivity project.
8. Measure prevention, including reduced reactive labor, fewer security exceptions, stronger evidence quality, and a shrinking backlog of material exposure.

CloudCapsule has identified the correct pressure point: MSPs cannot scale Microsoft 365 security simply by adding more analysts, more alerts, or more dashboards. They need an operating model that makes good security practices repeatable across tenants while preserving customer-specific judgment.
The firms that build that model will be better positioned to protect margins, improve customer trust, meet growing evidence demands, and guide SMB customers through the much larger governance challenges that AI is about to expose.

---

References​

1. Primary source: crn.com
   Published: Tue, 28 Jul 2026 17:05:00 GMT
   
   

   CloudCapsule CEO: MSPs Need A New Playbook For Microsoft 365 Security

   Here’s Why CloudCapsule CEO says MSPs need to stop chasing alerts.

   www.crn.com
2. Related coverage: learn.microsoft.com
   
   

   Cloud Secure Score in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn

   Learn about the Microsoft Defender for Cloud secure score, which is part of the Microsoft cloud security benchmark.

   learn.microsoft.com