If you're an MSP running annual or quarterly security audits for your clients, you're missing the majority of configuration changes that put them at risk. Here's why — and what to do about it.
The Problem with Point-in-Time Audits
A Microsoft 365 tenant's security configuration changes constantly. Admins add users, modify Conditional Access policies, adjust sharing settings, and enable new services. Each change can introduce security gaps.
Microsoft 365 tenants change constantly: admins adjust Conditional Access, new apps are consented, sharing settings are loosened for one project and never tightened again, and Microsoft itself changes defaults. An annual audit captures one snapshot and misses everything that changes in between.
What Is Configuration Drift?
Configuration drift occurs when a previously secure setting reverts to an insecure state. Common examples include:
- A Conditional Access policy gets temporarily disabled for troubleshooting and never re-enabled
- A new admin account is created without MFA enforcement
- SharePoint external sharing gets loosened for a vendor project and stays that way
- A mail transport rule is deleted during a migration
Without continuous monitoring, these changes go undetected until the next audit — or until a breach.
The Business Case for MSPs
Continuous monitoring isn't just better security — it's better business:
1. Higher Client Retention
Clients who receive monthly security reports and timely drift comparisons see the value of your service every month, not once a year when the audit PDF arrives. That visibility is what makes a managed security service easy to renew.
2. Recurring Revenue
Continuous monitoring creates a predictable monthly revenue stream, as opposed to project-based audit engagements.
3. Reduced Incident Response Costs
Catching a misconfiguration when it happens (via drift detection) costs a fraction of investigating a breach caused by weeks of exposure.
4. Compliance Evidence
Frameworks like SOC 2, ISO 27001, and CIS require ongoing monitoring controls. Continuous M365 scanning provides the evidence your clients' auditors need.
How TenantVigil Enables This
TenantVigil's partner console gives you fleet-wide visibility across the customers you manage:
- Scheduled scans run on a schedule and evaluate 90+ security checks.
- Drift comparisons show settings that moved away from a customer baseline, and each diff is reviewed before deployment. See Review desired state and drift.
- Customer fleet view shows the tenants you may reach, their scan status and open work. See Connect a customer tenant.
- Branded recurring service reports carry your logo for customer-facing deliverables.
Ready to move beyond annual audits? Start free to see the console for one tenant. The Free plan covers one Microsoft 365 tenant and requires a Microsoft work-account sign-in and administrator consent.