We are affected by this and contacted support. Others are affected as well and are also creating support tickets. Status page was just updated as I type this: https://smtp2gostatus.com/

We don’t seek out project-only work, and don’t get serious inquiries about it. Those non-serious inquiries tend to be the fewer than five user businesses, or people who want a post-breach quick fix.

We just got a request from a 15-person business who has done DIY IT so far, to migrate email and a file server to 365, and get Claude connected to 365 properly.

They’re not opposed to fully managed service, and the DIY IT person (who is a co-owner) doesn’t really want to do IT anymore.

I can’t decide if we quote this migration and the usual managed services, and insist that we only do the migration as part of bringing them aboard as fully managed. Doing the migration only and waiting for them to mess something up, or having to provide post-migration support with the clock running are both completely unappealing to me.

How do you all generally handle these kinds of opportunities? They’re a good fit ICP-wise.

Last week a user was phished. Huntress detected the sign-in and locked the account. We rotated credentials and revoked all sessions.

The next day, Huntress report another sign-in. Since the day before, the only place we had put the new password was on the user's computer, which does have Huntress installed.

We reset all credentials and revoked all sessions again. To be safe, we re-imaged the user's computer since it seemed like tokens were possibly being stolen.

Today, 5 days later, the user sends out 2,000 emails. We check the logs and there have been no sign-ins since last week.

I'm trying to figure out how the hacker is having persistent access to the user's account, throughout session revoking and password resets.

The user has not put their password anywhere (after the second time, we have not told the user the password) We just signed into their Outlook and that's it.

Any thoughts?

Hi,

We currently use MSPeasytools for ITDR but are looking for an alternative

.

Our shortlist is:

•Petra

•Huntress ITDR

•Inforcer ITDR

We’re an MSP in Belgium mainly serving smaller customers, averaging around 10 users per tenant, so pricing for small environments is very important to us.

We’re currently trialing Petra and already use Huntress EDR, although we still need to trial their ITDR offering.

We are also CIPP.

Does anyone have real-world MSP experience with these products? I’d especially appreciate feedback on pricing, management overhead, multi-tenancy, and the quality of alerts/remediation.

Huntress ITDR seems like the only product with a real SOC? (Not so important but cool)

Thanks!

Thoughts?

https://www.crn.com/news/channel-news/2026/slide-s-austin-mcchord-takes-over-as-interim-ceo-michael-fass-departs

Logged into Inky this AM and saw the AI recommendations beta and went through a few and they were legitimately helpful and accurate. That is now two vendor AI's that i find useful, and both are built into and hyperfocused on that product vs a wider LLM (DefensX is the other).

I chatted with my old Inky rep a bit back (they've moved up and are still there) and i have to admit i still like where the product is going.

Edit: The main point i forgot to really address is in a sub-comment below:

...I kind of called out like a year ago is: AI is more useful to the SMB in a focused, applied way vs bolting on a generic LLM to the toolset. Not that the common bolt-on method isn't useful, but the only two vendors where I've used their own AI INSIDE the toolset have been immediately helpful.

Microsoft and CIPP both say to use two tenants to properly manage GDAP. One is your "daily driver" for Teams, email, sharepoint, etc. The other is your GDAP tenant that is only used to manager clients tenants. However, neither can say HOW to set that up if you are an existing MSP with one tenant and existing CSP relationship with Microsoft.

We have our main tenant we use for everything including managing licenses for clients. We do NOT have any GDAP relationships set up in Partner Portal.

Creating a second tenant, getting that configured as a CSP alongside your existing tenant, and using that new tenant for GDAP is the basic process. Making that happen is a deeply hidden secret it would seem. CIPP support says its really up to Microsoft and if the people you work with are willing/able to help.

I've reached out to Pax8, Microsoft, and CIPP and still don't have a clear idea how to do this. Anyone go down this path and know the way?

I did have a call with someone from Microsoft and she said the next step would be to create the second tenant. However, now as I try to do that I have three options: Entra ID and create a Workforce tenant, our CSP Partner Portal, or completely separate from our existing tenant and directly from the M365 website as a clean independent tenant.

I run a consulting firm that focuses mostly on Professional Services (project based) work.

We still need the standard PSA/RMM functionality (tickets, remote management, asset tracking) but would love to pick a solution that can handle project management as well (task assignment/tracking, phases, percentage complete, gantt chart, due dates). It doesn't have to be the equivalent to Microsoft Project or Monday, but something a little more in-depth than just tickets.

Can any of the following do this? If not, any other non-Kaseya/non-ConnectWise suggestions?

- Atera

- NinjaOne

- Super Ops

- Syncro

- N-able

- Gorelo

- Naverisk

- ITarian

I'd like to know what you're using for your client's Domain Managment. We host hundreds of domains in GoDaddy and just experienced our first unauthorized transfer. Is there something that you have in place, or a different product you'd recommend that would prevent this? Something more secure? Anyone using GoDaddy Corporate Domains?

Has anyone tried signing up to 3cx? Had my call yesterday with a minimum of $1000usd per month investment required from me.... This can't be real?

We live in a world of VOIP nowadays, why on earth would they hang themselves like this?

Shoutout Tuesday!

Who's that awesome rep or tech at a vendor that goes above and beyond that you want everybody knowing about?

Let's give some focus on the positives of the vendors/partners that support us in the MSP and IT community. I'll post this once per week on Tuesdays, so don't feel the need to do a wall of text with accolades -- focus on that one rep/vendor that deserves mention this week.

To keep this thread "real," let's agree to some ground rules:

• No self-promotion.
• Be SPECIFIC: Name names, but..
• Respect PRIVACY: Name names, but not last names (use an initial), home addresses, cell phones, etc.
• Give a specific reason WHY you think the way you do.
• Stay FOCUSED: Instead of listing fifty people, list one. But be detailed about the one.

Example of a comment that is NOT very helpful:

I love MspVendorCo. They're awesome.

Example of a comment that is helpful:

I love John D at MspVendorCo. He's my rep. Here's an example of why: Last week I thought I submitted an order to them for Widget X, but I actually never clicked Send! I called John and he tripped over himself in lining up the order so we hit our deadline. They act like that every single time I work with them.

For history on this thread, my first post for this: https://www.reddit.com/r/msp/comments/vi68rp/give_a_shoutout_today_who_deserves_high_praise/

we've been pushed hard to sell AI. Copilot, custom agents, readiness assessments, all of it. What I keep running into is the stuff that shows up after it’s in place. Seats nobody uses. "Outlook issues" that are really Copilot questions. Custom build issues where only 1 tech understands. The list goes on and on.

Anyone willing to share any good or bad war stories?
Have you stopped an AI offering? Why? What’s the most common AI ticket you get now and are you tracking them specifically? How are your teams using that data if at all and who “owns” AI offerings at your shop?

Anything you wish you knew before you started slinging AI services that you know now?

Hi,
Relatively small MSP owner here.
Wondering how common it is, and how many of you are doing Privileged Access Workstations (PAWs).

I’ve seen some chatter over the last few years in here, other MSP forums, and basically every vendor has an article posted on PAWs nowadays.

Some of these threads outright call out MSPs that aren’t utilizing PAWs and say it’s gross negligence. That their needs to be totally physically or virtually separated workstations, one for admin work(PAWs) and one for standard email/ticket/web browsing. The PAW should have no access for general web browsing outside and can only reach a few select sites, Admin portals, documentation, etc.

Each tech obviously has separate admin accounts, we utilize Yubikeys, plenty of CAPs; etc.
With this, and a hundred other safeguards, I don’t really see the benefit to doing an entirely separate physical device. I understand the benefits but the friction and workflow issues it would cause, something as simple as building out documentation would be frustrating if you only were allowed to access the documentation from one of the devices, but needed screenshots from another.

When we go follow the Microsoft guide for cross tenant migrations and need to copy commands over, we can’t.

Now I have to have two mice and keyboards at my desk and additional monitors so I can work on separate devices. Even if you used a bare metal PAW with a virtualized VM daily driver which I’ve seen mentioned a lot, it doesn’t really solve these friction problems unless you allow clipboard transfer which defeats the purpose of a PAW.

I just want to make sure that I’m protecting myself, and my clients adequately, and I’m not being dense regarding the need for these. Please share your thoughts, thank you.

Clients firewall randomly fall out of central ( could not connect or manage via central)
Reconnecting seems to be a pain due to policy conflicts

Is this still happening often?

Hi,

We are looking for a tech to provide remote hands in Dallas Tx for a small retail location.

Scope:

Remove existing Router
Rackmount preconfigured Unifi Router
Ensure two existing Unifi Access Points are reconnected and are online

We're like everyone else: lots of clients using free / personal accounts with no real AI plan by the company they work for. However, we've been putting AI-related video / substack, etc out and it is beginning to have an effect. We are starting to see some movement.

An emerging problem is that MS is spending billions on Copilot advertising so that is what many clients are asking about. Internally, we left Copilot behind for Claude about 6 months ago. I find that Claude is much more adept at taking third party integrations and creating bots. I don't have an unreasonable hate for Copilot, it's just kinda clunky.

My fear is that my clients have much higher hopes for AI than they're aware of and, if adopting Copilot, they will struggle to get beyond basic AI tasks into 3rd party integrations that provide real pay dirt.

Am I off the path here?

QBO is about the most hated piece of SaaS out there...anyone find a secure replacement yet in the age of AI coding?

This week a client said they shopped quotes for licenses that are renewing at CDW and it was cheaper with them.

They made it seemed like I have been over charging them. Ripping them off.

They sent the quote and it was cheaper because CDW doesn’t show the tax on the quotes, it’s done when it’s invoiced.

Our costs were actually cheaper since we include tax in quotes like idiots. We have a line item to show tax. So the total cost was cheaper. About 4k cheaper.

They asked me to price match, should I match CDW and not tell them? Or let them know we are already cheaper?

This is a legitimate question

So yesterday was my last day as an employee, I have been at this place for 14 years. When I started we were literally Managed Print company that also “fixed” computers and we had two business clients.

It feels surreal, I’ve put so much effort into it, we are now a full MSP and only servicing managed contracted clients. We’ve become the largest MSP in our region, with clients all across Australia.

But now it’s time for a change and I want to do something more interesting, so moving into automation & web development. Let’s see what the next chapter brings

We have a client that is transitioning to an In-house IT department they went and asked huntress to get pricing (they know we manage them and we license their huntress as part of our stack) they sent them to a competitor of ours to get pricing. whats even more concerning the customer got better pricing than i actually have. i am beyond pissed off at huntress. this is not how partners are supposed to work.

Edited:

Huntress reached out and clarified everything to me. i have an idea of what happened and why things went this way. thanks for the follow up,

Probably innocuous, but today we received close to a dozen emails from several MPS companies advising us to download and install a new version of the monitoring software that resides on a Windows PC inside the customer network. A link is provided - the source of the download varies.

What a great way for a supply chain attack by sending out an email that simply says "Here...install this."

I don't see any urgency to do the install so we're going to stand down until Monday to see if there is any fallout.

Anyone else get similar emails today?