I’m currently in the process of evaluating a major migration strategy for the MSP I work for, and I wanted to share my thought process and get some advice on potential gaps I might be overlooking. Any input or suggestions would be greatly appreciated as this is something I want to get right!

Current Setup:

We currently manage around 300 Microsoft 365 tenants. Each client typically pays for Microsoft 365 licenses per user (usually Business Basic or Standard), along with NinjaOne RMM for device management, BitDefender for endpoint protection, and some opt for Phish Titan for email filtering.

Our current setup involves:

NinjaOne RMM: Used for remote device management and client support.BitDefender: For antivirus/endpoint protection.Phish Titan: For email filtering, spam protection, and phishing simulation.

The Plan: Migrate to Microsoft Intune and Defender

The strategy I am considering involves transitioning our clients devices to Microsoft Intune for device management and Defender for Endpoint for security. Many of the devices we manage are already AzureAD joined. Currently we AzureAD join all the devices in the tenant to the 365 Admin which we control. 

Intune: Will allow us to manage all devices from a single platform, with granular policies for compliance, software updates, and app management.Defender for Endpoint: Threat protection, antivirus, and EDR features that can replace BitDefender,. Also for those clients who currently opt form email filtering, its email protection features could potentially replace Phish Titan’s filtering and simulation with the addition of Defender for 365.

Licensing Concerns and Confusion:

This is where I’ve run into several licensing questions and concerns:

365 Admin with E5 License:

In my current plan, each client tenant would have a single 365 admin account with an E5 license to manage the devices and benefit from Defender’s full suite of features (including threat intelligence, EDR, attack surface reduction, etc.).All devices in the tenant would be Azure AD-joined to this E5-admin account. My assumption is that since the devices are Azure AD-joined to an account with E5, they would benefit from the full capabilities of Defender for Endpoint, regardless of the license assigned to the end user (who might only have a Microsoft 365 Business Basic or Standard license).

However, I’m not 100% certain if the user logged into the device would be limited in any way (e.g., does Defender’s full suite apply only to the device, or does the end-user’s license also need to include premium features like Defender for Endpoint?). 

Entra ID Premium (P1 or P2):

My goal is to also enforce MFA across all tenants automatically for new users. I understand that for this, we would need Entra ID Premium P1 or P2. The challenge is whether I can apply a tenant-wide P1/P2 license or if I need to assign the P1/P2 license to each individual user.If I assign the P1 license to the 365 admin, will I be able to enforce MFA for all new users in the tenant, or do I need to assign P1 licenses to each user to make this work?

BitDefender Replacement:

My understanding is that Defender for Endpoint (through the 365 E5 license) provides advanced features that can completely replace BitDefender in terms of security, threat protection, and response. Does anyone have feedback on how Defender compares to BitDefender, particularly around ease of management, efficacy, and any potential gaps in coverage?

Email Filtering and Phishing Simulation:

Defender for Office 365 (included with 365 E5) offers email protection, phishing simulation, and spam filtering. If we switch from Phish Titan to Defender, will we be missing any significant functionality, or is this a strong enough alternative?

Windows Autopilot Considerations:

I also want to incorporate Windows Autopilot into our deployment strategy. While we’re not overly concerned about achieving zero-touch deployment, I believe we can still leverage Autopilot to streamline the device provisioning process and ensure that devices are correctly configured for our clients from the outset.

Azure AD Join: My assumption is that for devices to fully utilize Autopilot features, they would need to be Azure AD-joined to the end user. I’m considering how to implement this for end-user devices and whether we can still maintain efficiency if users log into the devices with different Microsoft 365 licenses (Basic or Standard).End-User Experience: I want to ensure that even if users are logging in with lower-tier licenses, they still have a seamless onboarding experience, with essential policies and security measures applied from the get-go (Installed apps, Networking settings, etc)

Has anyone here gone through a similar migration, or do you have any insights into the potential pitfalls of this approach? Am I missing any important considerations? Any advice would be appreciated.

​I’m currently in the process of evaluating a major migration strategy for the MSP I work for, and I wanted to share my thought process and get some advice on potential gaps I might be overlooking. Any input or suggestions would be greatly appreciated as this is something I want to get right!Current Setup:We currently manage around 300 Microsoft 365 tenants. Each client typically pays for Microsoft 365 licenses per user (usually Business Basic or Standard), along with NinjaOne RMM for device management, BitDefender for endpoint protection, and some opt for Phish Titan for email filtering.Our current setup involves:NinjaOne RMM: Used for remote device management and client support.BitDefender: For antivirus/endpoint protection.Phish Titan: For email filtering, spam protection, and phishing simulation.The Plan: Migrate to Microsoft Intune and DefenderThe strategy I am considering involves transitioning our clients devices to Microsoft Intune for device management and Defender for Endpoint for security. Many of the devices we manage are already AzureAD joined. Currently we AzureAD join all the devices in the tenant to the 365 Admin which we control. Intune: Will allow us to manage all devices from a single platform, with granular policies for compliance, software updates, and app management.Defender for Endpoint: Threat protection, antivirus, and EDR features that can replace BitDefender,. Also for those clients who currently opt form email filtering, its email protection features could potentially replace Phish Titan’s filtering and simulation with the addition of Defender for 365.Licensing Concerns and Confusion:This is where I’ve run into several licensing questions and concerns:365 Admin with E5 License:In my current plan, each client tenant would have a single 365 admin account with an E5 license to manage the devices and benefit from Defender’s full suite of features (including threat intelligence, EDR, attack surface reduction, etc.).All devices in the tenant would be Azure AD-joined to this E5-admin account. My assumption is that since the devices are Azure AD-joined to an account with E5, they would benefit from the full capabilities of Defender for Endpoint, regardless of the license assigned to the end user (who might only have a Microsoft 365 Business Basic or Standard license).However, I’m not 100% certain if the user logged into the device would be limited in any way (e.g., does Defender’s full suite apply only to the device, or does the end-user’s license also need to include premium features like Defender for Endpoint?). Entra ID Premium (P1 or P2):My goal is to also enforce MFA across all tenants automatically for new users. I understand that for this, we would need Entra ID Premium P1 or P2. The challenge is whether I can apply a tenant-wide P1/P2 license or if I need to assign the P1/P2 license to each individual user.If I assign the P1 license to the 365 admin, will I be able to enforce MFA for all new users in the tenant, or do I need to assign P1 licenses to each user to make this work?BitDefender Replacement:My understanding is that Defender for Endpoint (through the 365 E5 license) provides advanced features that can completely replace BitDefender in terms of security, threat protection, and response. Does anyone have feedback on how Defender compares to BitDefender, particularly around ease of management, efficacy, and any potential gaps in coverage?Email Filtering and Phishing Simulation:Defender for Office 365 (included with 365 E5) offers email protection, phishing simulation, and spam filtering. If we switch from Phish Titan to Defender, will we be missing any significant functionality, or is this a strong enough alternative?Windows Autopilot Considerations:I also want to incorporate Windows Autopilot into our deployment strategy. While we’re not overly concerned about achieving zero-touch deployment, I believe we can still leverage Autopilot to streamline the device provisioning process and ensure that devices are correctly configured for our clients from the outset.Azure AD Join: My assumption is that for devices to fully utilize Autopilot features, they would need to be Azure AD-joined to the end user. I’m considering how to implement this for end-user devices and whether we can still maintain efficiency if users log into the devices with different Microsoft 365 licenses (Basic or Standard).End-User Experience: I want to ensure that even if users are logging in with lower-tier licenses, they still have a seamless onboarding experience, with essential policies and security measures applied from the get-go (Installed apps, Networking settings, etc)Has anyone here gone through a similar migration, or do you have any insights into the potential pitfalls of this approach? Am I missing any important considerations? Any advice would be appreciated.  Read More

​