Huntress answers a question the enterprise providers mostly ignore: what does an organisation with Business Premium, no security staff and a few hundred endpoints actually do? The answer they built is to operate the Microsoft licences you already hold rather than sell you a replacement for them, and to price it for a business that does not have a security budget line. That constraint has produced some of the most practical engineering in this series.
The clearest expression of the philosophy is what they do with Defender. Their managed endpoint service pairs with Microsoft Defender Antivirus, Defender for Business, or Defender for Endpoint, and they manage the Defender configuration as part of the service. You are not deploying a competing agent that fights with the built-in one. You are paying someone to configure, watch and act on the protection Microsoft already gave you. They hold Microsoft’s verified solution status for the small and mid-sized business segment, which is the formalisation of that relationship.
The hybrid account problem, solved properly
This is the detail that made me take the product seriously, and it is worth explaining because the failure mode it addresses has bitten a lot of people quietly.
When an account is compromised in a hybrid estate and someone disables it in Entra, directory synchronisation can bring it straight back. The cloud object is overwritten from on-premises, sometimes within seconds, and the responder who disabled the account watches it re-enable itself while the attacker’s session continues. It is the kind of thing that reads as an edge case in a design document and as a disaster at two in the morning.
Disabling a synced account in the cloud alone is not containment. It is a temporary inconvenience for the attacker.
Huntress engineered around it. Their agent, running on domain controllers, disables the account in on-premises Active Directory and in Entra simultaneously, so synchronisation has nothing to undo. The important operational caveat is that this requires their agent on the domain controller at a sufficiently recent version. Without it the service can still revoke active sessions but cannot durably disable the account, which is a materially weaker containment position. If you are evaluating them and you run hybrid identity, that agent placement is not an optional deployment detail. It is the difference between the containment story working and not.
The rest of the identity response set is what you would want: revoke sessions, disable the account in Microsoft 365 and Entra, delete malicious inbox rules and cut off forwarding, which between them cover the common shape of a business email compromise. Isolation is enabled by default across accounts with the ability to exclude specific identities or turn it off entirely, and accounts are re-enabled automatically once the incident resolves. Authority is on by default with an opt-out, which is a defensible position for the market they serve, where the alternative is nobody acting at all.
What they need from your tenant
Identity monitoring connects through Microsoft Graph and reads sign-ins, OAuth application consents, inbox rules and mailbox configuration. Their logging service ingests Microsoft 365, Entra, Defender and Purview events through Event Hub, with retention up to a year included alongside it.
Onboarding requires Global Administrator consent and places their service principal into the Exchange Administrator and Organization Branding Administrator roles. Accurate multifactor status reporting needs Entra ID P1 or P2 signal, and the tenant needs an Exchange licence for the identity service to function. None of that is unreasonable for what the service does, but it is a standing privileged principal in your directory and it deserves the same treatment as any other: documented, owned, reviewed. The same discipline applies here as to every provider in this series, even when the vendor is the friendly one.
Google Workspace is covered by the same identity service, which matters more than it might seem. Mixed estates are common in the segment they serve, and having one provider and one console across both is a genuine simplification.
What you do not get, and why that is honest
There is no formal service level and no breach warranty. Independent assessments are direct about the anti-fit cases: this is not the provider for an organisation that needs deep integration with an existing Splunk or Sentinel deployment, full raw log access for its own analysts, or contractual response commitments with remedies attached.
I find that clarity more useful than a service level nobody intends to enforce. A business with no security team and no in-house analysis capability gains very little from a contractual response time and a great deal from someone competent actually acting. Buying the wrong thing here is a buyer error rather than a vendor one, and the vendor is unusually clear about which thing they sell.
Pricing is per endpoint for the endpoint service, per identity for the identity service, and per data source for logging, with figures not published. The structure is at least legible, which is more than can be said for several competitors.
The comparison that actually matters
Because they ride your existing licences, the double-pay problem that dominates the enterprise profiles largely disappears. There is no duplicate endpoint agent and no parallel platform. That makes the real question a different one, and it has become sharper this year.
The comparison is Huntress on top of Business Premium against stepping your licensing up and buying Microsoft’s own managed service. That used to be an easy dismissal because the first-party service was assumed to require full E5. It does not; the documented floor is Entra ID P1 plus one Defender product in active mode. So the arithmetic is now genuinely live, and it turns on two things: how much identity depth you need, since meaningful identity coverage in the first-party service depends on Entra ID P2, and whether your estate includes the surfaces Microsoft’s service explicitly excludes.
Work that model rather than assuming. For a lot of organisations in this bracket the Huntress answer still wins on total cost and on getting a human who responds, but it should win on arithmetic rather than on the outdated belief that the alternative requires E5.
Posture, AI, and the limits of the model
Beyond detection they sell posture hardening on both endpoints and the Microsoft 365 identity configuration, which addresses misconfiguration before it becomes an incident. For an organisation with nobody reviewing tenant settings, that is arguably worth as much as the monitoring.
On artificial intelligence, applying the two tests I use throughout this series: there is no capability for governing your users’ use of generative AI, and I record that as an absence rather than implying otherwise. Recent additions around outbound email content inspection are phishing controls, not AI governance. On AI inside their own operations, the marketing language mentions AI-assisted hunting while the brand position is explicitly that they do not rely solely on automation. Little detailed mechanism is published either way, so I am not going to claim more than that. If they later assert an autonomous investigation capability, it needs a named mechanism before it earns any weight.
The structural limit is the same one that applies to every operate-your-stack provider: they are only as good as the telemetry you have licensed and enabled. On a Business Premium tenant with Defender running and audit logging on, they see plenty. On a tenant where half the security features were never switched on, they will see exactly as little as you configured, and no amount of analyst quality fixes signal that was never collected.
MDR
‹ Previous: [MDR 4] CrowdStrike Falcon Complete: The Second Stack, Fully Operated
Next: [MDR 6] Expel: Authority With Guardrails ›
