What can be shared
- Malicious IP addresses
- Domains and URLs
- File hashes
- Validated campaign context
For MSPs & MSSPs
Different security stacks. One coordinated Microsoft protection layer.
Your customers keep the endpoint security they run today. Whether a customer fits depends on its Microsoft tenant, not its endpoint brand.
Your customers keep their Microsoft tools, licences and approval rules.
Create your account and start your guided onboarding.
Actions depend on each customer's policy, permissions, connected controls and licensing.
- Built in Europe
- Available on Microsoft Marketplace
- Customer environments stay separate
- Approval rules per customer
The problem
More customers should not mean more repeat work.
A campaign reaches another customer. Your team has already investigated it. That work should be useful again.
Today: The same campaign is investigated again in every customer portal.
With UnifiedONE: One validated finding can inform other eligible customers where it is relevant.
Today: Senior analysts spend their day on repeat, low-level alerts.
With UnifiedONE: Analysts spend their time on the cases that need local judgement.
Today: Checking tenant health means opening separate customer views.
With UnifiedONE: Review customer tenant health and baseline scores in one MSP dashboard.
Today: Every new customer adds the same investigation work again.
With UnifiedONE: Reuse investigation work as your customer base grows.
How it works
Connect your customers. Build on each finding.
Your MSP account is reviewed before you connect customer tenants. Each customer keeps its own response rules.
- 1
Connect customer tenants
After MSP approval, connect customer tenants with Entra ID P1 or higher and Global Administrator consent.
- 2
Agree the rules
Set policy and agree who approves which actions, per customer.
- 3
Investigate once
A threat reaches one customer. Your team works it once, in one place.
- 4
Coordinate per customer
The validated finding reaches relevant customers under their own controls.
- 5
Show the result
Report what was applied, approved or missing for each customer.
Built around Microsoft. Designed to work alongside your existing security.
Keep your tools. Strengthen your Microsoft security.
Keep your existing security tools and the protection they already provide. UnifiedONE complements your investment by connecting validated threat intelligence and helping protect supported Microsoft identities, sign-ins and email. Customers using other endpoint security products can still connect eligible Microsoft tenants. No forced replacement.
Endpoint security your customers can keep
- Microsoft Defender
- CrowdStrike
- SentinelOne
- Bitdefender
- ESET
- Sophos
- Trend Micro
- and other security solutions
Keep the endpoint product
Your endpoint security keeps protecting devices as it does today.
Add cross-tenant intelligence
Validated threat intelligence can inform protection for other eligible tenants.
Protect identities and email
Supported actions run through Microsoft controls in each eligible tenant. Email protection depends on the tenant's Microsoft services and licences.
Microsoft Defender for Endpoint is integrated with UnifiedONE today: where it is licensed, configured and authorised, supported device actions can run through it. Integrations with the other endpoint vendors listed are planned as part of our multi-vendor roadmap; today UnifiedONE does not act through them. IT management and security platforms such as Kaseya and ConnectWise, and managed security services such as Arctic Wolf, stay in place too.
We replace nothing. We strengthen your security alongside what you already have.
The protection outcome
One finding. A different outcome per customer.
Select a customer to see why the same validated finding leads to a different result.
Customer A confirms a credential-phishing campaignIllustrative customers · not live activity
Select a customer
Outcome for this customerBlock appliedThe phishing domain is blocked automatically.
Customer B allows automatic action for validated phishing domains, and the email control is connected.
Outcomes depend on relevance, local policy, permissions, supported controls and licensing.
Business value
Put analyst time where it matters.
Built for providers who own the customer relationship and the service model.
Reuse analyst work
Bring a validated finding into the next eligible customer review instead of repeating the same investigation.
Investigate once, protect many
Validated threat intelligence can inform protection for other eligible tenants, where they have the required controls, licences and authorisation.
Protection-gap view
Once a tenant is connected, see where Microsoft licences and controls limit the available response.
Build an informed security service
Use tenant health and validated threat context to guide customer reviews and service recommendations.
Create your account and start your guided onboarding.
30-day free trial
Try UnifiedONE free for 30 days.
MSPs onboard up to 15 customers with an Access Code and use the live platform on their Microsoft tenants. Not an MSP? Ask us for a code.
Try UnifiedONE free for 30 days
After 30 days, your subscription starts automatically unless you cancel.
- 30 days free of charge
- MSPs: up to 15 customers
- Reminder emails before it ends
- Pay through Microsoft Marketplace or Stripe
Customer boundaries
Customers protect each other without seeing each other.
Different MSPs, different tools, one collective defence. Privacy-safe defensive knowledge follows participation rules; customer environments and response authority stay separate.
What stays with each customer
- Names and users
- Email content and files
- Policies and approvals
- Access to the environment
Separate environments
Each customer keeps its own tenant, policies and permissions.
Choice per customer
Decide per customer whether it receives and shares community intelligence.
Honest status
Pending approvals and missing controls are never reported as protection.
Do customer environments stay separate?
Yes. Each customer keeps its own environment, policies, permissions and approvals. Sharing defensive knowledge does not give another organisation, or another customer, access to that environment.
Can some customers allow automatic action while others approve each change?
Yes. Policy is set per customer. Pre-approved action types may run automatically only after relevance, permissions, connected controls and licences are checked. Another customer may require a named person to approve the same response.
Does UnifiedONE replace our existing security stack?
No. Your customers keep the security tools they run today, whatever the brand. UnifiedONE adds validated intelligence and coordinates supported protection in each eligible Microsoft tenant.
What happens when a customer lacks a control or licence?
The action cannot run through that control. The protection-gap view shows each connected customer where a control or licence is missing.
How is UnifiedONE priced for providers?
Plans are priced per user, per month, with flexible MSP packaging. See the pricing page, or talk to us about the model that fits your service.
Can we try UnifiedONE before we pay?
Yes. MSPs can onboard up to 15 customers free for 30 days with an Access Code. We email you before the trial ends; after 30 days, your subscription starts automatically unless you cancel.
Do we need the same security tools as other MSPs in the community?
No. MSPs and MSSPs can use different security tools and vendors. UnifiedONE draws on intelligence from different sources. Today, validated intelligence is applied to connected Microsoft tenants through supported Microsoft controls.
What if our customers use different endpoint products?
They keep them. Microsoft Defender for Endpoint is integrated today, so where a customer runs it, UnifiedONE can also coordinate supported device actions on onboarded devices. For customers on CrowdStrike, SentinelOne, Bitdefender, ESET, Sophos or another endpoint security product, UnifiedONE can still add supported Microsoft identity and email protection in each eligible tenant, depending on its Microsoft licences, configuration, permissions and authorisation. Integrations with other endpoint vendors are planned as part of our multi-vendor roadmap.
For providers
Make one investigation work for eligible customers.
Join the Community and activate your Access Code to try UnifiedONE with up to 15 customers, free for 30 days.
Create your account and start your guided onboarding.