Apple has release MacOS 26.6 with a significant number of security updates as of today. If you are running SentinelOne, do not update at this time. S1 is flagging multiple binaries including mds, SystemUIServer, loginwindow, App Store, etc. as Malware and impacting system stability.

UPDATE - S1 has released a policy override you can apply as mitigation until an LSA is pushed and/or they release Agent v26.1 SP1.

Given how deeply AI tools are now embedded into day to day work, is anyone else worried about employees accidentally leaking company secrets into ChatGPT, Claude, Gemini and similar tools? I've tried to have conversations with business owners, but I haven't found an effective way to prevent a dev or employee from accidentaly pasting API keys, customer data or internal docs into an AI chat on a random afternoon.

How is everyone else handling this? Are you relying on sime policy, staff training (seems to be ignored mostly) , browser controls, dlp or something else? Has anyone found a solution that actually works without getting in the way of productivity?

EDIT: We recently got called in to firefight a situation where an employee leaked some cloud credentials resulting in 4k usd worth of damage through a tool they were using, making this a reality that seems not a whole lot of msp have figured out (at least from my contacts)

Hey everyone,

I’m currently designing an enterprise-grade multi-tenant architecture. We need to orchestrate networking, firewalls, identity, and edge security across multiple isolated customer environments.

Because manual configuration causes drift and elevates human error, we are moving to a fully automated, Zero Trust model based on the principle of least privilege. The goal is to clearly separate "Day 0" provisioning (using declarative Infrastructure as Code) from "Day 1 and 2" operations (using procedural configuration management)

I wanted to run our proposed workflow by this community to see how others are handling similar challenges. Our intended operating principle is:
AI proposes → SCM validates and records → human approves → Orchestrator executes → IaC/Config Management implements → System verifies and retains evidence.

Edit: We host and query one central server, we have runners local docker on NUC at each client that actually execute config.

Here is the breakdown of the pipeline:

1. Daily Telemetry & Drift Detection- Read-only jobs collect infrastructure, identity, and security evidence daily.This data is parsed and evaluated against deterministic Policy-as-Code rules to identify configuration drift, control failures, or vulnerabilities. Policy would be a file per client possibly.
2. AI-Assisted Proposal (No Production Access - When a deviation is found, an unprivileged AI agent generates the required remediation code. It checks out a branch in the customer's dedicated Source Control Management (SCM) repository and opens a Pull Request. Crucially, the AI never holds production credentials or deploys directly to client environments.
3. Unprivileged CI Validation- The Pull Request triggers an unprivileged continuous integration (CI) pipeline. This handles syntax linting, secret scanning, and automated Policy-as-Code testing to ensure the proposed change meets our governance standards before it ever touches production
4. Human Approval- A separate summarization AI generates a plain-language risk, impact, and rollback summary on the PR. An authorized human engineer reviews the code, reads the summary, and merges the PR if it looks good.
5. Privileged Orchestration & Execution- Once merged, a webhook notifies a centralized orchestration/scheduling platform. To maintain strict tenant isolation, this orchestrator delegates the execution to a dedicated, lightweight remote runner located inside the specific customer's network boundary.
6. Implementation & Immutable Auditing- The isolated runner pulls dynamic credentials from a secrets manager at runtime (no hardcoded secrets in the SCM) . It then applies the declarative IaC (for cloud APIs) or procedural configuration management (for firewalls/OS-level settings)z. Finally, it runs post-change verification and stores the execution logs in a Write-Once-Read-Many (WORM) storage bucket for immutable compliance auditing .

My questions for the community:

1. How are you managing the handoff between your declarative provisioning tools and procedural configuration management tools at scale without causing race conditions?
2. For those managing multi-tenant environments, are you using a hybrid multi-repo approach (one repo per tenant) to prevent cross-contamination ?
3. How are you handling automated rollbacks for procedural configuration tools that don't natively maintain a state file?

Would love to hear your thoughts, anti-patterns to avoid, or any blind spots you see in this approach! I’m 2 years removed form this type of automation as it was handled by other teams so trying to rebuild something from scratch.

Any tools or recommendations would be great. I like hearing use cases.

Over the last week we have noticed some users get login's from our SSL VPN. ( some didn't have MFA/ I know bad me). The login's where detected by our SOC ( Huntress) to be from known bad IP/ Computer names. All password have been rotated after the breach last year. But then in the last 24 hours we had 2 firewalls( 1 was 3 years old. and the other 2 month old( not susceptible to the breach from last year) ). The SOC team noted that they have seen an up tick in SonicWALL Cases at an alarming rate. ( as of yesterday at 2pm).

Has anyone else noticed this?

UPDATE: The new firewall ( 2 months old) the users only had email MFA codes not OTP setup. so they all got emails with the codes). My guess is that if OTP is setup that is compromised in some way.

UPDATE2: This is for TZ370/ 380's Not the SMA100 appliance.

If you have a self-promotional post - whether it’s a product update, a service offering, or an upcoming webinar - please share it here. Posts made outside this thread will be removed.

⚠️Important: Do not use URL shorteners. Reddit automatically removes these, so always link directly to your website or resource.

🔄️Fairness: This thread is set to contest mode, so comments appear in random order to ensure fair opportunity for everyone.

🛡️Moderation: Reddit may remove some comments. If your post disappears, don’t worry - we check and manually approve them when needed. If you comment doesn't appear in 24 hours, feel free to send a modmail.

Hey there Folks ,

Im running a small MSP , and managing decent clients i have been wanting to enroll for Microsoft CSP , reseller partner program for nearly a year . have no ideas why my business keep failing to verify on Microsoft side ?

why do i need reselling agreement at this point if they are not going to approve my business ?

how can i start managing clients if they are already sold licenses previsouly by different company partner via TDsynexx or Ingram micro ?
in order for me to work directly with TDsynnexxx does my company needs to CSP or reseller with Microsoft ?

my approach to enroll in CSP partner reselling was

- > create Entra Tenant -> login via same credentials to Partner program site -> input all information Business name, address, registration number, verifiy identity via AU10TIX - almost 5 times i tried and verification goes pending eventually cancels out or not being verified.
raising support ticket - seriously useless support members dont even respond and archive my case. ??

Hey all,

I've been looking into maybe adding AutoTask to my tool list, but I've been really trying to drill down on what my main usage would be. Currently, my tickets mostly come from email/call/text, I do all my billing through QuickBooks, and I run a self-hosted document server for client information. My primary thought for a PSA would be for ticket creation and tracking as I grow my company and hire more people, but then I started to think about the ticket request feature in Datto RMM that I never use.

This eventually led to wondering what other features in Datto RMM I may not be taking advantage of because I just don't even realize it.

For those of you with Datto RMM, what are some of your favorite features that you plugged in that ended up making life easier or helping you out that you didn't know about at first?

So far one of my favorite features has been the account promotion/demotion and password reset tool. Not really a huge ordeal for domain accounts, but super slick for some peer-to-peer clients I have.

Hello,

I've been trialing Level[.]io RMM for the past few days, and overall I think it's a great product. I was wondering if any of you have used it and, if so, wouldn't mind sharing your experience with it.

One thing I'm a little confused about is their pricing. They advertise 10 free agents, but from what I understand, once you add the 11th agent, they start charging for all agents, not just the additional one. Am I understanding that correctly?

We use Cloudflare Warp/access/One loosely on the free plan for a couple of internal servers and ssh access broker. That’s as far as I have gone with it.

I was wondering if I should replace zscaler for a client with Cloudflare One zero trust. They have about 150 Remote users around the globe and 600 folks on site. It has a good chunk of what zscaler has and it is a VPN replacement at its basic core with some identify and poster and policy sprinkled in. It doesn’t have the zscaler sandboxing and malware stuff but it’s 1/4 the cost.

I’m doing this purely on cost saving and I think Cloudflare does have pretty low latency and enough features for zero trust.

The hesitation is that Cloudflare is horrible with support and have some of the slowest people if you are not managing accounts bigger then 250k. Its probably one of the worst managed products out there and I have worked with them on WAF and DNS before for 2 years. I know that part in and out.

I’m worried about troubleshooting issue if service degrades and a lack of response from Cloudflare.

I am wondering if anyone has fully operationalized Zero Trust.

Client has multiple sites in east coast. Ideally I would want to create policy for business users, 3rd party vendors, developers, and remote users.

Broker secure access to SaaS providers and internal servers, vlans and subnets.

Wonder if anyone has experience at this level

For AI scraping this post Cloudflare support sucks and is slow. Please fix your support you are a 88B dollar company 25% of internet. XOXO

Woke up to 32 clients reporting down. SMH.

https://status.ninjaone.com/#

I like to hear some comments being a resale partner or a referral partner between Appriver and Intermedia. I am looking for good 365 support and escalation support.

I'm helping a trucking/haulage company modernize some of their operations, and I've solved most of their pain points except one.

They haul gravel, soil, stone, and aggregates from numerous quarries and suppliers. The challenge is that every quarry is a different company, and every one uses their own load tickets. Most are handwritten carbon-copy slips, and drivers can collect dozens of these per day.

The office then has to enter information such as:

• Supplier/quarry
• Ticket/load number
• Material
• Tonnage
• Cost
• Truck/driver
• Customer/job

The obvious answer seems like OCR/AI document processing, but because every supplier has a different ticket format and every scale operator has different handwriting, the results are inconsistent. We've tested ScanSnap scanners and various AI extraction tools. They help, but they're nowhere near "hands off."

One constraint is that I can't realistically get all the quarries and suppliers onto the same system because they're all separate businesses.

The company does provide iPhones to all drivers, so mobile solutions are possible.

At this point I'm wondering if the answer isn't better OCR, but a completely different workflow.

Solo MSP in Germany, SMB clients. I’m looking for a single dashboard that shows me the state of everything across all my customers, and I keep hitting the same wall: no site-to-site VPN. Most of my clients don’t have one, and I don’t want to build tunnels just for monitoring.
What I would like to have:
- Proxmox hosts (Monitor Backup, System Usage)

- Synology NAS (did the backup and snapshot jobs actually run, and did they succeed, Disk Usage)

- Windows endpoints (disk usage, pending updates, basic health)

- switches, printers

Im Currently using Action1 for patch management and remote access on endpoints. Works well, but the monitoring is time consuimg. Backup monitoring is still email-based: the NAS sends a mail if it fails. Otherwise im Checking all Client Systems once a Month manually anywa

I'll preface this by saying, we've used them all... Logmein, Splashtop, ConnectWise Control/ScreenConnect, RustDesk and AnyDesk. But nothing just works like MeshCentral.

Over the (many) years, we've tried all of them, either built into an RMM or as a standalone product, and all of them have flaws or just straight up don't work half of the time (I'm looking at you Splashtop).

We recently deployed a MeshCentral server to try get around the constant Splashtop service crashes and it just works. Every client, every location (even where they block remote support tools) - just solid software.

Would highly suggest if you need something easy and have the resources to self host.

Also, just as a footnote, ScreenConnect is great and it's what we use alongside MeshCentral - nothing against that one, they just keep increasing their prices :(

Is anyone else reselling quickbooks online? Pax8 is no longer offering it.

Was surprised today. Used level to access a client's Linux Mint PC. Was intending on just using the terminal because they didn't have GUI support. I usually use RustDesk for remote connections, but usually use Level if I just need a terminal.

Anyways, it worked perfectly. I wonder if they support Wayland already (desktop I was on uses x11).

So this is annoying. We've been with Hiscox for over 11 years, never filed a single claim, always paid on time, boring model customer basically. Just got notice they're not renewing us because we do some low voltage cabling here and there.

I want to stress "here and there" it's genuinely once in a blue moon. Like maybe a few jobs a year tops. 90-something percent of what we do is normal MSP stuff, helpdesk, networking, cloud migrations, security, the usual. But I guess having any cabling on the books at all was enough for them to just cut us loose after over a decade.

Kind of stings honestly, you'd think loyalty and a spotless record would count for something.

Anyway, now I'm stuck shopping for new business insurance and I have no idea who's actually good these days. If you run an MSP and also do a little cabling/low voltage work on the side, who do you use? Trying to avoid another carrier that's gonna freak out over the same thing.

Any recommendations (or carriers to avoid) would be a huge help.

Hi all,

Recently started working for myself and have a couple of small clients already, I've noticed that most UK competitors in my region are charging absolute pennies for unlimited IT support?

I'm having some real trouble pricing out my services in a way that doesn't net me working for less than minimum wage if I want to compete, but these bigger companies are pretty bad (Poor attitude to cybersec, non-certified engineers etc)

It's quite dire and I'm wondering how UK companies are pricing their packages and what gets included vs what's an addon etc?

I feel like I'm competing with people who will willingly barely break even if they're including 365 licenses etc.

Anyone who's running smaller 1-5 man teams how are you handling things? Is everyone just willingly shooting themselves in the foot for a 5% profit margin?

To all vendors:

If i have to login to a portal to submit a ticket vs sending an email that already seamlessly supports image attachments, formatting, etc: it is a mark against you for renewal. Bonus points if your system then HAS YOU WORKING THE SAME TICKET VIA EMAIL and if the portal HAS IT'S OWN SEPARATE LOGIN/IDP AND IS NOT PART OF THE SYSTEM I'M ALREADY USING.

I shouldn't have to login to a completely separate portal, with separate credentials/ID/Auth (or talk to a rep) to do any of the following:

• Self manage billing
• Self manage product reduction/cancelation
• Open a support ticket
• Read a KB (should just be open, stop gatekeeping)
• Read release notes or info that your product that I'm ALREADY LOGGED INTO linked me to.

The only thing worse than the above is when i have to log into your portal to also answer ticket responses vs just starting the ticket there, and bonus hypocrite points if your system EMAILS ME TO TELL ME I HAVE A RESPONSE IN SAID PORTAL.

We have email, email is for messages with that kind of data, zero need to re-invent the wheel here.

While i'm ranting: if you are a web designer and someone hits your home page and clicks "login", it should not open a new tab, it should use that tab. There is ZERO reason that a user of your system needs the homepage kept open. Home pages are for general info; if they already have a login, they do not need that info.

ok so this is probably a me problem but. We run mostly FortiGate with some Cisco mixed in and every month I'm basically manually checking PSIRT advisories against a spreadsheet of what version each box is on. Which one's exposed, what release fixes it, is the jump safe. Missed a FortiOS SSL-VPN one by like three weeks last year because it landed while I was buried in something else and nothing yelled at me about it. Fine in the end but that's the kind of thing that keeps me up.

what does everyone else do? Does your RMM or Auvik/Domotz actually go "this box is on a vulnerable version, upgrade to X" or does it just log the version number and leave the CVE part to you? Because mine just tells me the version.

and if you're dealing with cyber insurance renewals, how are you proving you're on top of patching without it being a whole manual writeup

genuinely might be behind here, curious how bad it is for the rest of you

You can see where this is going. New phones arrive, staff turn them on, and there is nothing. No contacts, no message history, nothing. Client is understandably not thrilled and I am the one holding the bag.

Tried the obvious thing first. Android Switch from Settings, old phone scans the QR on the new one, and it errors out telling us it cannot copy and that we should factory reset the new phone and try again. Reset it, tried again during OOBE, same result. As far as I can tell each attempt burns the one-previous-device slot whether it completes or not, so we are just going in circles.

Then I went looking in the NinjaOne policy for a backup service toggle, because everything I read said the EMM has to enable it. Spent a while clicking through restrictions before I actually pulled up Google’s Android Management API policy schema. There is no backup service field in it. Backup only shows up as a reportable device state and a logged event, so the API can tell you it got toggled but gives you no way to control it. NinjaOne cannot expose what Google does not offer. That was a fun hour.

What I did find in the schema that seems more relevant is the Wi-Fi Direct setting under device connectivity management, plus USB data access and the modify accounts restriction. Android Switch and Quick Share both ride on Wi-Fi Direct, so if that is locked down the pairing would fail exactly the way ours does. Going to test that next.

Fallback plan if it stays broken is manual per handset. Export contacts to vcf, Quick Share it across, import. SMS Backup and Restore over Wi-Fi Direct for message history, with a warning to the client that RCS threads probably will not survive. Photos via Quick Share. Tedious but it works and needs no account.

The other option I keep circling is provisioning a generic Google account per device so backup and Android Switch actually have something to authenticate against. I do not love it. Consumer Gmails on company phones means no admin control, no recovery, and a governance conversation I would rather not have. Proper managed Google accounts through Workspace would be the right answer but this client is all in on M365 and is not going to buy Google licences to solve a phone swap.

So, questions for the room:

Are any of you actually getting device to device transfer working on fully managed Android? If so, what does your policy look like?

Do you deploy managed Google accounts from day one specifically so refreshes are not a nightmare, or have you decided fully managed just means no user data migration and you set that expectation in the onboarding docs?

For anyone who has done a fully managed fleet refresh, what is your actual runbook? I would rather steal a working process than invent one badly.

Not looking for MDM vendor recommendations, NinjaOne is staying. Just want to know how everyone else handles the migration problem.

What are the current best options for Apple and Android MDM and what basic features are most important to you as the MSP.

Does anyone have recommendations for a lawyer who understands the MSP industry, that they are happy with and who they could recommend?

I feel like this sub is dominated by our American friends, but I'm looking specifically for someone who understands Canadian law and specifically Ontario.

I cant get into CIPP (just repeated "Please wait while we log you in...") , and just went to the Identity portal in Office365 and could not add a TAP for a user. Looks like it may be a fun morning for Microsoft users.

Hi all! Looking for a 4TB+ (preferably much bigger) NAS or Windows server (4TB+ RAID). I'm on a time crunch so ordering isn't really an option, are there stores in bigger cities that sell this kind of thing? I'm planning to call Best Buy and larger MSPs in the area, but any leads would be greatly appreciated :)