ITDR (MDR for Microsoft 365)

Hey Everyone We would strongly recommend to put alerts in place when a Global Admin gets excluded from MFA. Our internal practice for this is good for change management, but unfortunately we several large co managed IT and have found repeatedly admin accounts get excluded from CA policies. Would like an alert if an admin is excluded, as well as another dashboard that tracks Admins without MFA specifically in addition to users. We feel like this is our biggest risk to tenant compromise so would like to get some hooks around it.

Add support for Google Workspace for MDR (similar to the O365 MDR).

So its great that Huntress can disable a user but the issue is that when it sync's back to the on prem server if that user is not locked will re-enable the users account and remove the block. This is an issue because we want the account to be locked until we can look into it but if its not locked on the server the user just has to wait until the sync and then they are re-enabled.

It seems that Huntress just wants this Entra Usage Location set so they can use it as a datapoint, setting it per user it tedious. MSP and IT also use JIT accounts which can create accounts on the fly. As an MSP, we are getting these alerts for every JIT account being created. For all our clients, we could simply just tell you (in settings) that USA is the only Usage Location, vs setting this on a per user basis. Above that, if there was a single user in say Japan, it would be better for us to set that usage location on their identity in Huntress, not in Entra.