Microsoft Ignite: Advanced Threat Analytics and How They Help MSPs

By Ericka Chickowski 1

This week Microsoft (MSFT) unveiled a host of new updates to Windows, Office and Office 365, and the Azure Stack that will open up a ton of new opportunities for IT service providers. Specifically in regard to security, though, the highlight of the new releases at the Ignite Conference in Chicago was the release of Microsoft Advanced Threat Analytics (ATA) to help better spot anomalous user behavior even in a mobile environment, as well as improved controls over Office 365 documents as they are shared within and outside an organization.

MSPmentor spoke with Brad Anderson, corporate vice president at Microsoft, to get his take on some of the new capabilities and the potential they hold for MSPs to improve their secure offerings.

MSPmentor: Can you tell us a little bit about the impetus behind the new capabilities introduced this week?

Anderson: Our view as we look at this world of mobility is that organizations should have a defense in depth approach, where they're protecting on as many different layers on these mobile devices as they can. And at the same time they're assuming that they've been breached. Because we know that more than 75 percent of all these breaches and cyber attacks we're reading about ultimately come from either weak or stolen user credentials.

So as we talk to the industry about how we believe organizations should be thinking about enterprise mobility, we believe it all starts with delivering the user the most  empowering environment possible–striking the right balance between empowerment and security. And then from a security perspective, making sure that you're protecting at the device, app, file and identity layers.

Specifically some of the new innovations we talked about is, one, on that file level protection, we actually have the ability for a user who has shared a document to actually go look at a site that shows them  all the documents they've shared, and who has tried to access those documents–where they've been, when that happened. For first time now, individuals can actually get that complete end-to-end view of how those documents they've shared have been used or attempted to be used. That will be generally available,  in the preview of what we call Azure Rights Management Services Document Tracking.

The other significant announcement we made was around what we call the Microsoft Advanced Threat Analytics. What that allows us to do is we can actually get a view now of the on premises resources that are being accessed by users from which devices. So you get this graph of the relationships between resources, devices and users. And then using machine learning we can bring to the attention of IT anything that is out of the ordinary. Anything that is suspicious that may point to the fact that you've got an identity that's been compromised.

MSPmentor: What does this ultimately mean for MSPs?

Anderson: Organizations are going to look to them as this trusted partner or guide in helping them deliver this value to their end users and their mobile devices, that appropriately balances  empowerment and security.  

What we're delivering from Microsoft is we're integrating Office 365 and the Enterprise Mobility Suite to deliver exactly that.  You're getting that incredibly rich, unmistakably 'Office' experience on all of your devices with the kind of security  that is also needed.
We're able to bring awareness in examples like tracking your documents and your identity that no one can do.

MSPmentor: How will this help MSPs make money?

Anderson: We actually have a program for managed service providers for syndicating Office 365 and the Enterprise Mobility Suite.

What we do is we essentially do a revenue share as they resell these services from Microsoft. So they literally get into an annuity model where on a monthly basis we basically share the revenue that comes in from Office 365 from the Enterprise Mobility Suite. I was talking with one partner the other day who said 'I'm putting my kids through college by selling them the Enterprise Mobility Suite.'

The beauty of that is that once organizations are using these services, these MSPs can add value on top of that. But every month as the number of users and the number of organizations that are using these Microsoft services increases, the annuity the managed service provider is now getting increases as the usage increases.