MDO for MSPs
Every client's Intune tenant, from one sign-in
The same apps, standards and change history for each client, kept apart, with reports you can hand to the client.
Why MSPs use it
- Less time per client
- Apps, compliance, policy changes and restores for a client in one place, so you stop switching between portals and spreadsheets for each one.
- The same standard for every client
- The same tested apps, the same CIS or Essential Eight scoring and the same unassigned baselines, client after client.
- Proof of the work you do
- A compliance score with its CSV and printable view, and a change report for any period, to show a client what they pay you for.
- Safe delegation
- Four roles checked by the server, so a junior technician can deploy apps without being able to restore policies or manage users. When our staff help with a client, the client sees it in their Activity.
What you do for each client
- Deploy and maintain apps: 157 catalog apps, 152 of them tested on our lab VM, plus Winget, the Microsoft Store and your own installers. Edit, repackage, roll back or uninstall them later.
- Show a client where they stand against CIS v5 or the Essential Eight, with a CSV or a printable view for their auditor, and exceptions with an approver and expiry.
- See every change in the client's tenant and who made it, revert a bad one, and restore a deleted policy from that client's backups.
- Set alert rules once as defaults for every client, sent to your email or a Teams channel. Each client can change its own.
- Deploy baseline policies unassigned, then assign them on the client's schedule.
- See every client side by side on All tenants: what needs review, the compliance score, apps, the last sync and the last backup. Pick one to work in it.
Connecting a client
- Choose Connect another tenant in the tenant switcher and give the client a friendly name.
- An administrator in the client's tenant grants admin consent on Microsoft's page. There's no app registration to create in their tenant for this, and no secret to pass around.
- MDO runs the first collection straight away, then every night.
During the beta we set how many tenants your organisation can connect. Tell us how many clients you look after when you request access.
Kept apart per client
- Each client consents to MDO separately, and MDO's access to a client ends when that client withdraws consent.
- Inside MDO, Postgres row-level security keeps each tenant's rows apart, and every request is checked against the tenants the user may see.
- Each client's backups go to a storage account in that client's own Azure subscription.
Roles for your technicians
Owner, Admin, Deployer and Viewer, checked by the server on every request. A Deployer can ship and change apps for a client but can't restore policies, start backups or manage users. A Viewer can look and can't change anything.
Not built yet
- Comparing clients against one reference tenant.
Free during the private beta. Tell us how many client tenants you look after, and Aaron will get back to you.