Managed ISPM

It would be great if we can specify a group or users that are excluded from managed policies (CA). For example the CIPP user should be excluded internally (if you use CIPP) and also a Break Glass Admin Account which is excluded from all policies should also be an option to set.

Ability to ignore, hide, disable escalations from security controls in ISPM.

Some tenants manage many domains and may wish to accept a risk for a specific domain rather than for the full tenant.

The control currently treats any Conditional Access exclusion as non-compliant. However, exclusions for Privileged Identity Management (PIM) eligible administrators are required for PIM to function correctly. Conditional Access evaluates active role assignments, not eligible assignments. An administrator with an eligible role is treated as a standard user until they activate the role through PIM. If the Azure Portal and Entra Admin Center are blocked, those users cannot access the location where elevation occurs, creating a catch-22 where they cannot elevate because they are not already elevated. Consider allowing exclusions for PIM-eligible administrator groups without marking the control as non-compliant.

We use Avanan for spam/phishing filtering. Avanan creates rules that Huntress does not like and triggers the following two alerts. Transport Rules Should Not Bypass Security Controls Connection Filter Should Not Bypass Spam Filtering For the connection filter, I can accept the risk. I cannot do that for transport rules. I'm not sure that "accept risk" is the best solution to this anyway. If we could review and approve the current config, but monitor for changes, maybe? Or Huntress might recognize the tenant is configured for Avanan (and other popular plug-in filters)?

When onboarding a client we could do with the ability to have a template of the controls that are not controlled by the managed onboarding. There are alot of the conditional access and higher risk ones that we are able to generally put on. So if we could have a template and when the template is selected you can add any exclusions in there before fully applying.

Currently, we have some legacy equipment that we allow to bypass conditional access as long as it is from within our network, and we will apply those exceptions to those policies. They are extremely limited in scope, and would make the client compliant in my opinion. We should be able to mark some of these controls as risk accepted, in progress, or complete with an asterisk, instead of it just auto-detecting based on the policy.

DEM account has Intune license and it's detecting like the license includes apps or email.

A column showing the Low/Medium/High values for the Impact values, similar to the existing "Severity" column. You must go into each Control to see those values.

Some controls require a P1 or other license to implement. Although we have visibility once we go into a control details, it would be nice if there was a column to know if any specific licensing is needed for that control at the macro level.