Managed ITDR for Microsoft 365 and Google Workspace compared

Obsidian Ridge's Ridge Core costs $25 per person per month, month-to-month, with no minimum; managed endpoint detection and response and Microsoft 365 or Google Workspace identity monitoring are included. Business onboarding is separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. 9

For identity security, the first buying question is whether the service actually covers your email and identity platform. The second is who can investigate and act. A tool that produces risk scores and a managed SOC service place different responsibilities on your team.

We publish this comparison as Obsidian Ridge, which appears in it and uses Huntress. This is a sourced comparison of buying models, not an independent performance ranking. Commercial details and product documentation were checked on October 1, 2026.

Microsoft 365 and Google Workspace coverage side by side

“Not published” means the cited page does not disclose that fact. Do not read it as no minimum, no contract, or no capability. The Microsoft and Push rows are self-run contrasts to the managed services. Scroll the table sideways to see each column when it is wider than the page, or focus it and use the arrow keys.

The coverage descriptions are deliberately narrower than a “yes” checkbox. Entra ID Protection covers Entra risk signals; the reviewed documentation does not describe native Google Workspace mail-rule monitoring. Our conclusion about that limitation follows from the documented scope, not from a test of every possible Microsoft integration. 5

Supporting both platforms does not mean feature parity

Ask for the detection and response matrix for the tenant you use. A Microsoft 365 screenshot does not prove the same mail, OAuth or session controls exist for Google Workspace. Likewise, a browser extension observes browser activity; that is a different collection point from a service monitoring tenant events.

Huntress's expansion announcement describes Microsoft 365 and Google Workspace coverage, but it is not a promise that every detection is identical. Blackpoint's Essentials datasheet lists both services. Push lists both integrations and browser controls. Those are useful shortlist criteria, followed by a technical scope check. 2 3 7

The managed ITDR service page separates the platform-specific features in our service. The endpoint MDR overview covers computers; neither should be used as evidence that every identity or application is automatically covered.

Decide who can act on an account takeover

Ask who investigates, who can revoke a session or disable an account, and who approves restoring access. Get the normal follow-through hours and the after-hours process in writing. A risk-based access policy is valuable, but it does not remove the need for an administrator to investigate an exception or recover an account.

Microsoft documents automated risk remediation and administrator-led investigation. Push describes configurable blocking and alert integrations. Huntress and Blackpoint describe managed SOC response. Our service adds deployment and CISSP-led follow-through to the managed platform, with the division of responsibilities published on pricing. 1 3 5 7 9

Compare the whole bill and the evidence

The Obsidian Ridge figure includes endpoint MDR as well as identity monitoring. Huntress's direct ITDR line is a separate product. An Entra P2 licence is a self-run software purchase. Comparing those prices as if each bought an identical response service would hide the work you still own.

For a renewal, ask what records you can export and who turns them into accurate questionnaire answers. The cyber-insurance questionnaire is a starting checklist, and the Readiness Sprint is a separately scoped evidence engagement. A detection feature is not a guarantee that an insurer accepts a control answer.

Sources

1. Huntress pricing: commercial values and direct-buyer responsibilities from the canonical Huntress facts module, last checked September 30, 2026.

2. Huntress Google Workspace ITDR announcement: platform coverage and managed response.

3. Blackpoint MDR Essentials datasheet: cloud coverage, active response, monthly terms and endpoint volume-pricing conditions. Confirm current partner scope in a quote.

4. Blackpoint pricing: rates are not publicly disclosed.

5. Microsoft: what is Entra ID Protection?: risk signals, automated policies and administrator investigation. Native Google Workspace tenant monitoring is not described in this scope.

6. Microsoft Entra plans and pricing: the live US page checked October 1 lists P2 at $10/user/month paid yearly. Older indexed snippets showed $9; the table uses the fetched pricing page. Confirm the licence and region in your quote.

7. Push Security pricing and FAQ: integrations, browser controls, response modes, monthly and annual rates. No minimum or staffed SOC service stated on the reviewed page.

8. Obsidian Ridge managed ITDR: supported tenants and the service scope.

9. Obsidian Ridge pricing: Ridge Core, included ITDR, onboarding, term, minimum and operating responsibilities.

Start with your actual tenant

Bring your platform, licences, headcount and the name of the person who owns account recovery to the first conversation. For Google Workspace, ask to see Google-specific detections and response actions. For Microsoft 365, separate the capabilities already in your licence from the service that will operate them. That is a clearer starting point than buying a broad “identity protection” label.