Managed ITDR

Trusted device suppression would be very useful for location alerts, but I don't want to suppress alerts from unknown VPNs on managed devices. This varies from multiple clients and granular control would be an improvement.

Hi Huntress Team, We use Huntress heavily across our own environment and dozens of client M365/Azure tenants. I’d like to request native support for context bomb canaries. Quick basics Context bombs are short text strings planted in decoy resources (Key Vault secrets, Entra app secrets, Intune profiles, AVD env vars, etc.). When a malicious AI agent reads them, the string trips the LLM’s safety guardrails and frequently causes the agent to stop or refuse to continue. You still get the canary alert. Tracebit’s recent tests showed this cut AI agent success rates dramatically (admin access from ~57% down to 5%, full compromise from 36% to 1%). Good overview of how it works: https://www.csoonline.com/article/4198524/context-bombing-heralds-a-new-ai-era-of-deceptive-defense.html Full research + placement details: https://agentic.tracebit.com/context-bombs/ Why it matters AI agents can now escalate and persist in cloud environments in minutes. Traditional canaries only alert — context bombs both detect and actively disrupt the attack. That extra stop/slow-down is huge when the kill chain is this fast. For Azure/M365 specifically, the highest-value spots are: • Azure Key Vault secrets • Entra ID app registration secrets • Intune/AVD environment variables and configs • Other decoy secrets/docs agents tend to enumerate This would be a strong differentiator for Huntress MDR/ITDR and something we could immediately offer our clients (especially regulated ones). Would you be open to logging this as a feature request and letting me know if it’s already on the radar? Happy to jump on a quick call or share the research/links if helpful.

It seems that Huntress just wants this Entra Usage Location set so they can use it as a datapoint, setting it per user it tedious. MSP and IT also use JIT accounts which can create accounts on the fly. As an MSP, we are getting these alerts for every JIT account being created. For all our clients, we could simply just tell you (in settings) that USA is the only Usage Location, vs setting this on a per user basis. Above that, if there was a single user in say Japan, it would be better for us to set that usage location on their identity in Huntress, not in Entra.

## Problem Bringing a new M365 tenant under Managed ITDR is the first step of every partner-client relationship. Partners need that process to be fast, predictable, and visible — they need to see exactly where each tenant is in onboarding, get an accurate signal when something requires their attention, and minimize the time they spend manually walking each tenant through setup. Partners running ITDR across dozens or hundreds of tenants also need a single place to monitor onboarding progress without checking each integration individually. As Huntress expands Identity protection beyond ITDR, partners also need a simple path to add additional Identity products to a tenant they've already authorized — without restarting onboarding from scratch. ## What We're Doing About It We've rebuilt the ITDR onboarding flow with the partner experience at the center. Partners see clear status as each tenant moves through onboarding. Common errors are automatically corrected, and when partner action is required, we send a specific, actionable notification. The new onboarding flow also supports adding additional Identity products to an existing tenant as a one-click action. ## Impact The manual steps a partner walks through to onboard a tenant take roughly two minutes; the remaining onboarding work completes in the background. Real-time visibility into the status of every tenant being onboarded. Common onboarding errors are auto-resolved; the rest come with a clear, action-specific notification. Additional Identity products can be added without re-authorizing the entire tenant.

Work to bring the GWS ITDR integration to capability-level parity with M365 for Unwanted Access and Shadow Workflows. This includes credential theft detection, token theft detection, and enhanced inbox rule detection for Google Workspace.

We need the ability to apply ITDR unwanted access location rules to M365 security groups. Currently, we can only apply policies to individual users or the entire organization, which creates excessive noise and alerts. This requires additional administrative effort to manually review each alert. Implementing this feature would streamline our process, especially for staff traveling overseas, allowing them to log in from low-risk countries and be removed from the group upon return.

It would be great to get escalations anytime a new Global Admin is created, or an existing user is elevated to global admin, allowing us to mark these as expected or not. For orgs using PIM, while UserA may not always have GA permissions, if they often do/or can, you could add them as an expected rule. We already create a weekly report of these using Huntress SIEM, but its a bad solution for a very common issue. Seems like this could be a low lift to implement.

Add the ability to add access rules per device type. For example, we use MAM policies in Intune so users can access Outlook via personal mobiles. One user uses a personal VPN on his phone. However, he doesn't and isn't allowed to use this VPN on his work laptop. To stop Huntress from flagging the escalation of the VPN detection on his personal phone, I've had to an access rule for his whole account for the VPN he uses.

Often the same phishing email is sent to multiple individual recipients at the same organization. Once adversary activity is detected on one account and an incident is triggered, it would be phenomenal if Huntress would proactively find and remove (soft delete automatically with an option to push a button to hard delete) these emails from all other mailboxes. It would cutdown on additional work required to secure the environment after the first user is successfully phished. MSPs and their partners would really benefit from a feature like this.