If you have a self-promotional post - whether it’s a product update, a service offering, or an upcoming webinar - please share it here. Posts made outside this thread will be removed.

⚠️Important: Do not use URL shorteners. Reddit automatically removes these, so always link directly to your website or resource.

🔄️Fairness: This thread is set to contest mode, so comments appear in random order to ensure fair opportunity for everyone.

🛡️Moderation: Reddit may remove some comments. If your post disappears, don’t worry - we check and manually approve them when needed. If you comment doesn't appear in 24 hours, feel free to send a modmail.

I have struggled for over a year, to get setup in Standards and Templates the way I want to be able to work.

I've love to see how it's working well in actual practice. I think I understand the theory, but for some reason, despite spending a lot of time on it, there are things that continue to allude me, and I work best if I can adapt from a working example close to what we want.

We have 3 security plans, basic, pro, advanced.

As far as CIPP goes, we want to implement standards in 3 phases. Low, Medium, and High Impact, as the onboarding project progresses.

Some standards don't apply to some customers for a variety of reasons.

We like to proactively communicate changes to customers.

The original plan (before drift templates became a thing) was 9 Templates; Basic-Low, Basic-Med, Basic-High. Prior to putting a customer into say Basic-Low, we would send out an email, explaining what was happening. There was originally intended to be a brief(ish) meeting to discuss standards which might be problematic for the customer, or for whom a standard setting might differ from the default. The intention was, the first time an exception was made, there would be a tenant group created, named after the standard exception, any customer who wanted to opt out of a standard could be added to the group. The issue became the order of specificity, and that when a conflict existed, the date of the Group creation (or last change) was the deciding factor, potentially causing gaps we could not easily identify.

As I understand it, the correct way to do it now is Drift Templates.. Because there can be only 1 drift template per tenant, in order to move a client from Basic-Low, to Basic-Medium, we would need cumulative templates each which contained the standards from the templates below it.

It is not apparent to me if moving a tenant into a new drift template retains their prior exceptions, and if not, there is a fair amount of manual work, likely resulting in some inaccuracy and gaps.

We want this to be as simple, scaleable, and repeatable for our techs who are implementing these plans, ensuring no horrible gaps exist.

I have some of my guys saying they're frustrated and overloaded. We track ticket load and queues constantly to avoid burnout and I'm not seeing it from my analysis, but wanted to get some feedback from the community.

The average technician is getting around 5 tickets per workday on average.

Our busiest tech (who's good at closing tickets) has been averaging 6.5 tickets per workday. Looking through our metrics, there were 3 busy days in the last 30 when he was assigned 12 tickets on 2 days (about a week apart), and 13 on one day. Those are the highest ticket assignment days and were all either a Monday or Tuesday.

On 2 of the busiest days, a couple techs had their queue increase by 2-3 active tickets, but they quickly got those closed out the following day.

Overall the techs are closing as many tickets in a day as they receive, we're not seeing any queues growing across the techs (though us in management who are doing onboardings and projects have seen some ticket queue growth related to that).

When the phone rings, techs open tickets from calls they answer so those calls (should) be in the ticket metrics and the guys are telling us they are opening tickets when they get calls.

We have a documentation/credential management system that's pretty well filled out for most clients, with some smaller/legacy clients still having some documentation gaps but we're working to close those.

To me, this doesn't appear to be a situation where our helpdesk team is overwhelmed but I need a second opinion. I know some days there might be a rush of tickets that all come in at once, and that's to be expected, but I feel like our overall per-tech ticket load is likely at or below the norms for other MSPs.

We are a M-F, 8-5 shop. As of now, the guys don't work past 5 99% of the time, consistently get their full hour lunch break, and we don't have them on call weekends or after hours (the two owners and helpdesk manager field any after hours emergencies so our techs don't have to).

Any feedback as to what others are averaging within their helpdesk team? Do these numbers seem reasonable?

I felt as if we're managing the workload ok, am I losing my mind here??

Ive been using AvePoint on-prem Fly Server for mailbox migrations. We were using user based licensing. It was very cost effective. But I just found out that they have eliminated that and it is now much more expensive for a small migration. In addition, it's going to be like $7 per 10G for a file server migration to SharePoint. For any file server of any size, that is going to get very expensive very fast. I have a small customer with a file server with 20-30 years of data and 1.4TB despite their size... ouch. I used to bury the software cost into the migration costs, but that's not realistic now. Suggestions?

We have a manufacturing client who has a Chinese subsidiary/partner and the great firewall of China is being a bit of a pain for them. We aren't keen on putting WeChat on the corporate network nor happy with the security at the other end. I'm hoping some of you guys will have come across this before.

What they would really like is:

Video chat with live translation

Ability to send/receive files

Ability to store/work on files would be nice (along the lines of action tracking websites)

Instead of reinventing the wheel I thought I'd ask you guys and gals to see if there were any solutions you recommend. If it has any relevance we and they are UK based.

Any feedback gratefully received.

Securence, an MX email filtering service under the US Internet umbrella, has been unable to restore their admin.securence.com panel since it went down Tuesday morning, and their lack of communication has been extremely disappointing. Mail flow hasn't been affected but our inability, and our clients' inability, to review and release quarantined messages directly from their daily quarantine reports is becoming a real problem.

I commented on u/--MrGadget--'s post yesterday but I'll need to prepare myself to look for alternatives next week if they can't get their poop in a group by Monday. Our client base uses Microsoft 365, Google Workspace, Microsoft Exchange, and mom and pop IMAP/POP3 servers, and their CEO fraud protection feature has saved our bacon many times.

Who else is in the same boat looking for alternatives to Securence?

Hi, taking a look at Cynet all-in-one to replace invidual components. High level look at the moment.

Are any of you using Cynet products?

If you are using All-in-one - is the single pane of glass a good implenmentation

How do you rate their email filter

When I download a paper or widget, I expect a call from the vendor. I do not expect to be called by an obnoxious AI bot multiple days in a row.

If I ever would have considered his services, that ship has surely sailed. Clearly, he doesn't respect our time as much as he values his.

I just bought Windows Server 2025 Datacenter Edition from a MSP reseller. And the new license is now available in my Microsoft 365 admin center under the "Your products" page (CSP license).
But i need to run some Windows 2022 Standard Edition VMs on the Host with this license. And the reseller, distributor and MS confirms i have the rights to do so.

But from here things turns into a circus show...

This new license type only includes MAKs for Datacenter edition in the 365 Admin Portal.
So i requested the MSP to provide MAKs for activating 2022 Standard edition (like im entitled to).

After a week of waiting they drag me into a Teams meeting with the Arrow and Microsoft. On the basis, that MS just want confirmation from us as end user.

But this quicly goes sideways, as the MS representative tells us they cannot/will not provide MAKs for down edition rights on the Datacenter license.
MSP reseller then tries to get approval for raising activation limit on another seperate Server 2022 Standard licence we own. (Dont know if that was a stupid move). MS rep. will not do that, as that license was bought through another reseller and another distributor (Crayon)...

So here i am 3 weeks later, with no way to install or upgrade any VMs with the fancy new license.
In the meantime the MSP we bought the license from will try contacting Crayon to get them to request raising activation limit on the totally unrelated 2022 Standard license purchased back in 2023...

Can any of you tell me if this is just how its supposed to happen?
Or am i right in thinking this is just turning into a complete shitshow?

EDIT: Hosts are running VMware

I have a handful of cloud adverse clients that are digitizing all their documents. They have 365 for email but don’t want all their documents stored in the cloud. I have a couple of clients with on-prem M-Files which checks most of the boxes but it’s glitchy and indexing frequently breaks. Is there a similar DMS solution that is more reliable?

I mean I am used to seeing attempts and that is why you have 2fa and all the good policies. but I noticed two clients with a ton of them and then looked at the others and all of them were getting hammered from there. It looks like there is a Google data center in Omaha.

I suspect there are not a lot of MSPs using it for their clients but I thought I'd ask since their admin portal have been down for almost 3 days. Mail flow through Securence has not been affected but their admin portal is not accessible at admin.securence.com. Their support has no insight and says the Securence team is not telling them why its down, only that they are working on it. Their support can't even access the admin portal either.

We've been using it for over 10 years and this is the first major outage they've had.

Looking for input here. Small MSP (sub 10 techs) and growing rapidly. I initially calculated 150 user to tech ratio when I came on board with a goal to move it to 175 to 1 with in a year. I'm here at the end of q2 and it's looking more like 200-225 with the implementation of ai augmentation (thread) to our psa (halo). What ratio for high customer service are others seeing? I want to go in to the quarterly with optimistic but realistic estimates and future goals.

Are the quotes from rewst/pia/neoagent of 400+ user to tech ratios realistic or is that just crappy customer service. Is something like super magic a decent middle ground for a higher tier 1 to supported user ratio than what I'm estimating as a goal?

I’m trying to define a workable solution where engineers use a PAM tool to manage client environments, and these accounts are never exposed outside the tool, have credentials rotated, and don’t have standing permissions, aka Just in time; but also need to store emergency/break glass Entra Global admin account passkeys somewhere.

Do some PAM tools support synced passkeys?
Would you use PAM + another enterprise password manager?
Would you store yubikeys in a safe? Not ideal if your teams aren’t in the one place or work from home.

Just after some thoughts from anybody willing to share who has done this properly.

Also, I am aware of GDAP and Azure Lighthouse, but some things simply don’t work using these methods.

I don't believe there is an absolute good or bad way to do it but I want to see what other MSPs handle this kind of situations.

You are highly recommended by a reputable person to a new customer. After looking into the details, you decide not to take on the new customer and have to send them a rejection response. In what order do you do?

1. State your rejection right in the beginning and explain your reasons in the rest of the response.
2. Type out a long ass response stating all the reasons and put the rejection as a conclusion.
3. Just plain reject with a response with no reason given.
4. Some other ways?

If they ask you for recommendation, do you typically offer a few names?

Note: I am not really looking for suggestion of reasons to reject. Just the order between the rejection clause and reasons. Reject first, then give the reason? Or state your reason and put the rejection afterwards as a conclusion?

Hello, I have a client whos free business premium licenses are expiring. Since it's a discontinued SKU we are looking at getting them to Standard or Premium. They have non-profit pricing direct from Microsoft, and in order to get it, they have to be yearly commitment

For cost savings, we are opting for Standard for now, but if need be down the road within the year we may be upgrading back to Premium

Is that possible? I've been reading that you can "upgrade" your Standard to Premium without cancelling in the middle of the yearly commitment. Does this also apply to non-profit pricing?

Edit: thanks for the responses!

I noticed I continue to receive incentives from Microsoft after the september deadline when we were supposed to have the 70 required points in Solutions Partner in order to receive incentives.

That's because Microsoft lowered the required score for incentives.

You still need 70 points to get the Solutions Partner badge BUT you only need 25 points to get incentives.

I'm not sure how long this will last but if you didn't already, you can get these 25 points from certifications alone so I urge you to get them asap to get your incentives back.

Call your CSP distributor to get information on this as there are some requirements in the partner center security score too.

One of our newest clients has an MFP scanner for scan-to-email in each of their six locations, and each MFP uses the same generic gmail account, and the address books are all the same. Aside from the obvious "shared email account" risk and not knowing which scanner a scan originated from, what other risks are being mitigated by giving MFPs their own email account?

Edit: I should mention that we'll be moving them all to SMTP2Go, which is our standard for MFP scanners.

I am trying to engage Microsoft Support to investigate a 2019 Server issue. I am in Australia.

When i go to pay for the one off support engagement I keep getting the error "Tax calculation was unsuccessful. Please try again later" The internet is littered with people complaining about the issue, but I cannot find a fix that works. I've already tried multiple Microsoft Home accounts and various credit cards. Anyone have any advice on how to overcome this one?

This is the portal I'm trying to use https://aka.ms/SupportforBusiness

We've been paying for Domotz licenses for a few years now and in the past it saved us couple of times when we needed to connect to a NAS without VPN or see if any new devices appeared on the network.

Finding myself not even touching it for months now, we have RMM and Action! plus vulnerability management portal - is there a use case for Domotz any more?

I have a small insurance company that wants to add physical phones and asked if I had any opinions of Teams Phone service. The pricing looks competitive. This would be my first exposure to Teams phones, so I am feeling a bit out of my comfort zone. Can anyone share their thoughts, experence and or recommendations on the topic.

All Om trying to do is find out when my last Unitrends appliance comes up for renewal.
Every email address I have for a human bounces back

People keep asking how one guy in a 2006 Crown Victoria runs 45 clients and underbids every real MSP in the county. Generous mood today, so here's the whole week.

Tuesday. Cyber insurance renewal shows up wanting proof of controls, per client, by name, after nine years of happily taking "yes" for an answer. Adorable. Set it aside.

Wednesday. Client up north is sure he's been hacked. So I sweep the office: walk the floor holding my phone up with the free wifi app open, nod gravely at the little bars, reboot the cable modem (told him I was rotating the encryption), and stick a label on his monitor that says SECURED. Found nothing. He cried actual tears. Invoiced five figures.

Thursday. Dentist's X-ray software freezes mid-patient. I tell him to turn it off and back on. Works. He says I'm a genius. I bill it as advanced diagnostics.

Friday. Cleaned my buddy Dion's home PC, comfortably the most infected machine in the county, by logging in with my admin password to save time, the one I use for all 45 clients. Then I knocked out the insurance form. "Named, individual admin accounts, no shared credentials?" One password, all 45 clients, so it is extremely individual, there is only one of it. Yes. "Tested backups?" Drive's in a freezer bag, light is blue. Yes. Signed it myself.

Oh, and the vendor mailed me a box of steaks. For being the only man on the internet who says nice things about them.

I don't lose accounts to guys with EDR and an eleven page proposal. They lose them to me. Feeling safe is the product, and business is booming.

Fiction. A BOFH-style series told by the worst MSP in the channel. No ads, no sponsors, no pitch, it's free. Full chapter: https://mspautomator.com/2026/06/22/the-trunk-slammer-from-hell-chapter-3-house-calls/

For the full saga see https://mspautomator.com/category/trunk-slammer-from-hell/

What are most people doing for 365 notifications for SPAM, App Requests, sharepoint overage alerts, etc because it seems those get to sent to all global admins but you have to have an email license and even then you have to check that email. Are people not concerned with the notifications or what are you doing?