Managed ISPM

When onboarding a client we could do with the ability to have a template of the controls that are not controlled by the managed onboarding. There are alot of the conditional access and higher risk ones that we are able to generally put on. So if we could have a template and when the template is selected you can add any exclusions in there before fully applying.

Would love to see support for GCC High tehants

It would be great if we can specify a group or users that are excluded from managed policies (CA). For example the CIPP user should be excluded internally (if you use CIPP) and also a Break Glass Admin Account which is excluded from all policies should also be an option to set.

Would it be possible to release all the controls necessary to comply with CIS's M365 benchmarks?

This may already be on the roadmap, but just like there are 'Huntress Managed' CA policies, it would be great to have Custom CA policies that we can create with our own settings and deploy as a baseline across multiple tenancies.

There is no way to satisfy "Block Exchange Forwarding" in ISPM while a single forwarded mail address exists in the organization. There are common and unavoidable business use cases for forwards though. For example, we have a support mail box ( help@ourdomain.com ) that forwards to an outside JIRA mailbox for ticketing. We should be able to enable the prevent-forwarding ISPM control in a way that allows this business process to continue to function. Ideally, there would be an admin-approved exception mechanism for allowing specific mailboxes to be forwarded, while preserving and enforcing the "block accounts from setting up forwarding" behavior.

We have encountered a problem with the [HUNTRESS] Block Device Code Flow and [HUNTRESS] Require Frequent Signin for Admins ISPM Conditional Access policy/security control where it prevents our support team from using Powershell to query Exchange Online calendar permissions. If we exclude the admin account we are still seeing the same problem. Please could these policies be reviewed by Huntress?

Hey Everyone We would strongly recommend to put alerts in place when a Global Admin gets excluded from MFA. Our internal practice for this is good for change management, but unfortunately we several large co managed IT and have found repeatedly admin accounts get excluded from CA policies. Would like an alert if an admin is excluded, as well as another dashboard that tracks Admins without MFA specifically in addition to users. We feel like this is our biggest risk to tenant compromise so would like to get some hooks around it.

Partner said: We have been using the filter, but it would be really nice to sort by those other fields rather than just Severity.

It would be nice to be able to flag the items that can only be manually remediated as accepted. For example "Ensure administrative accounts use licenses with a reduced application footprint". That would clear the Not Compliant and give us a record that we looked at it and made a decision.