In this article, you will learn:
- Why most MSPs are quietly giving away their most valuable security work for free
- The five-step path from, “We handle security,” to, “Security is our fastest-growing line item.”
- How to package standardization, drift monitoring and remediation as billable services instead of background labor
- How to naturally include upsell conversations in every QBR meeting
- Practical questions to ask your own team before your next planning cycle
The invisible workload
If you run an MSP that touches Microsoft 365, you’re likely doing more security work than you’re billing for. Most MSPs do. The problem is that much of the security work service providers do in Microsoft 365 is invisible.
- An engineer cleans up permissions.
- Someone fixes a risky forwarding rule.
- A technician adjusts an access policy.
- Another team member investigates a suspicious login or corrects a configuration that drifted from the client’s intended setup.
All of that work matters. But too often, it happens in the background, gets bundled into a flat fee and never shows up as a line item your client sees, or your sales team can talk about.
Providers are doing real security work every month, but they are not always packaging it, pricing it or communicating it in a way clients understand.
That invisible workload isn’t shrinking. In fact, it’s about to grow. Over the past year, Microsoft has been rolling enhanced Defender for Office 365 protections into lower-tier E3 plans, adding time-of-click URL scanning to Outlook and Office apps, folding Security Copilot into E5 by default, and expanding Intune’s management and privilege controls.
Most of these changes land on tenants automatically. For MSPs, that’s both an opportunity and a warning. Every new control Microsoft ships is another setting your team has to evaluate, configure and explain. This means the security workload inside Microsoft 365 environments is constantly growing. If you aren’t already billing for that work, you will end up doing even more of it for free.
Turning existing work into a clear, repeatable service line
The opportunity is not necessarily to add more work. As MSPs go through this evolution, here are five steps for them to follow:
1. Audit what you’re already doing for free
Before you can sell Microsoft 365 security as a service, understand how much security work your team already performs. Look at recent tickets and projects.
- How many involved identity, access, permissions, email security, configuration changes, policy updates or remediation?
- Which ones were billed separately?
- How many were simply absorbed into the monthly agreement?
Most MSPs find the same thing: a meaningful chunk of their engineering hours every month goes toward security work that’s never itemized. That’s not generosity, it’s a pricing model that hasn’t caught up to what you actually deliver.
It’s worth calling out one growing category on its own: work created by Microsoft, not your client. These roll out automatically, and someone on your team still has to evaluate and configure them. That’s billable work even if no one asked for it.
Action step: For one month, tag every Microsoft 365 ticket related to identity, access or configuration. At the end of the month, review the time spent and what was actually billed.
2. Standardize before you scale
It is hard to build a scalable service around inconsistent environments. If every client tenant is configured differently, every issue becomes a custom investigation. With this, the MSP has no clear way to explain what “good” looks like.
A documented security baseline changes that. A baseline gives your team a standard set of expectations for Microsoft 365 security. It may include MFA, administrator roles, email security settings, external sharing, mailbox permissions, conditional access and user access controls.
The details vary by client type, but the principle is the same. Define a healthy environment before trying to monitor or improve it. Once you know what “good” looks like everywhere, you can detect when something drifts from it automatically, instead of during an incident review.
Note that the baseline isn’t a one-time document. Microsoft changes default settings and rolls out new controls several times a year. So, a baseline that isn’t revisited on a regular cadence goes stale quietly while your clients assume it’s still being watched.
Standardization also creates leverage. Senior engineers can define the baseline once. Other team members can apply it consistently. Account managers can explain it clearly. Clients can understand what they are buying.
Action step: Pick your three most common client configurations and document a single baseline that would work for 80% of your book. That’s your starting point.
3. Make configuration drift visible to the client, not just to you
Microsoft 365 environments do not stay still. Users are added and removed, permissions and roles change, sharing settings shift, apps are connected and policies are updated. Sometimes this happens intentionally, sometimes accidentally, and sometimes introducing risk. That is why configuration drift can become a valuable service opportunity.
Some of that drift doesn’t even come from your client’s actions. When Microsoft turns on a new control or changes a default, a tenant’s posture can shift overnight without client interaction. That’s drift from the baseline. It still needs to be caught, explained and accounted for.
Clients won’t understand every technical detail, but they do understand that their environment can slowly move away from a secure state. MSPs that monitor important changes, identify deviations from the baseline, and remediate issues before they become incidents will prove their value on a regular basis. They can easily turn this into an ongoing security conversation.
You might be catching drift, blocking risky changes and quietly keeping clients out of trouble every single month. If your client can’t see it, they can’t value it. And if they can’t value it, the first competitor who shows up with a slicker report wins the account.
The key is to package this as a service, not background labor. Monitoring, review, prioritization and remediation all take time. They also reduce risk. That value should be visible.
Try this: Before your next round of QBRs, write down three things your team fixed or prevented for each client in the last quarter. Report it in plain language.
4. Package remediation as a service, not a favor
Once risk is visible, stop treating fixes as something you owe the client for free. Instead, treat them as a deliverable at a price. If a misconfiguration gets caught and corrected, that’s work. If you’re using effort estimates or complexity to gauge remediation time, you already have enough information to price it.
Shay Cohen
Have a tiered structure. Some things are covered under the retainer; others are billable projects. It’s important to be upfront with clients about which is which, and clearly define the rules. You’ll find that clients don’t object to paying for valuable work when they understand what is being done and why it matters.
Action step: Build a simple remediation menu for common Microsoft 365 security tasks (permission cleanup, license realignment, policy hardening). Include pricing, what is covered and what is not.
5. Use the QBR to connect security work to business value
Many MSPs treat the quarterly business review as a report card. But the best ones treat it as a sales meeting that happens to include a report card. If you’ve done steps one through four, you already have the material. Now, you must frame it around business impact:
- What has changed in the client’s environment?
- What risks were identified?
- What did your team fix or prevent?
- What remains unresolved?
- What did Microsoft change in the platform this quarter, and what did we do about it?
Next, ask, “What should we tackle next quarter and why?” That is the logical continuation of a conversation you’re already having, backed by data.
Framing the QBR around business impact turns the meeting into a natural place to recommend additional work, higher service tiers or focused remediation projects.
Action step: End every QBR with one specific Microsoft 365 security recommendation for the next 90 days. Make it clear, prioritized, and priced when appropriate.
The bottom line
Microsoft 365 security is no longer a side task. For many clients, it is one of the most important areas of operational risk. That creates a major opportunity for MSPs, but only if you structure the work correctly. Clients must understand it and MSPs have to be able to deliver profitably.
The MSPs that win will make their work visible, repeatable and valuable. That starts with a simple shift in mindset. Microsoft 365 security is not just support. It is a service line.
FAQs
Q: Do MSPs need a dedicated security team to offer Microsoft 365 security services?
Not always. Many MSPs can start by organizing the security work their existing teams already perform.
Q: What should be included in a Microsoft 365 security baseline?
Common areas include MFA, administrator roles, email security, external sharing, mailbox permissions, conditional access and user access controls.
Q: How should MSPs introduce new pricing to existing clients?
Start with transparency. Show the work being done, explain why it matters and clarify what will be included going forward. Remind clients that Microsoft keeps changing the platform, so without someone watching, they quietly become exposed.
Q: What is the best first step?
Review recent tickets and identify how much Microsoft 365 security work is already happening without being packaged or billed.
Q: What if we don’t have a consistent baseline across clients yet?
Start with your newest or smallest accounts. It’s far easier to standardize a fresh environment than to retrofit a legacy one. You will build the muscle before tackling your larger clients.
Q: How often should we run QBRs if we want them to double as sales conversations?
Quarterly is standard, but the cadence matters less than the content. A QBR with specific, priced recommendations will outperform a monthly check-in that’s purely informational.
Q: Why does this matter more now than it did a year ago?
Microsoft is actively expanding what ships by default in Microsoft 365, such as more Defender protections in E3, Security Copilot in E5 and broader Intune controls. Every rollout adds configuration and security work to every tenant automatically, so the amount of unbilled work MSPs are absorbing is growing, not staying flat.
Shay Cohen is CEO and co-founder of Optimize365, an innovative M365 security management platform built for MSPs. A veteran cybersecurity entrepreneur with 10+ years of experience spanning cloud security, compliance and automation, Cohen is dedicated to helping organizations fortify their Microsoft 365 ecosystems. Optimize365 was acquired by CyberFox in October 2026.
Featured image: dioandika — stock.adobe.com
