Obsidian RidgeManaged ITDR
Token theft, inbox rules, OAuth grants, impossible travel. We watch Microsoft 365, Entra ID, and Google Workspace for identity attacks, then call when a real incident needs action. Included in every tier, starting with Ridge Core at $25 per person per month. ITDR is licensed per person, not per device.
What is ITDR?
Identity Threat Detection and Response (ITDR) is the set of detections and response actions focused on the identity layer of your business — sign-ins, session tokens, MFA events, OAuth consents, mailbox rules, and privileged-role changes — rather than the endpoint layer.
It exists because most modern attacks against small businesses never touch an endpoint at all. The attacker phishes a session token, replays it from a foreign IP, sets a mail rule to hide their tracks, and sends a fraudulent wire-instructions email from inside the victim's real mailbox. EDR cannot see any of that. ITDR can.
Managed ITDR adds the part that decides whether the service produces outcomes or just notifications: A 24/7 security team reviewing the alerts, plus a CISSP-led practitioner who coordinates the actual response.
TL;DR
We operate managed detection and response for the identity layer for you — the Huntress identity threat detection platform, deployed and tuned to your Microsoft 365 or Google Workspace tenant.
The security team reviews identity alerts around the clock. On a confirmed compromise it revokes the session on either platform — the stolen token stops working and the user is signed out. Obsidian Ridge picks up everything past that — response coordination, evidence capture, insurance notification, and the post-incident debrief — within one business day.
Disabling the account itself runs on a different clock per platform.
Either way the account gets disabled; on Workspace it waits for a person, and that person is us.
On Microsoft 365, how far the automatic disable reaches depends on how your tenant is built:
Every identity is monitored either way — what is configurable is the automatic action, so a break-glass admin you ask us to exclude is not signed out when it is the one compromised.
Managed ITDR is included in every tier, from Ridge Core at $25 per person per month. Ridge Plus and Ridge Reserve add training, email protection and the insurance controls on top of the same identity monitoring.
Stopping a single business-email-compromise attempt typically covers years of service.
What's included
Impossible travel, anonymous proxy and Tor sign-ins, foreign-IP logins to accounts that have no business outside one country. Detections come from the managed security platform we operate and are reviewed by an analyst before anything reaches you.
Modern phishing kits steal session tokens, not passwords, then replay them from a different country. MFA is already satisfied, so detection has to happen on session behaviour — and that runs on Microsoft 365 and Google Workspace alike. Catching the adversary-in-the-middle kit itself, before the replay, is Microsoft 365 only.
Auto-forwarding rules, rules that delete on receipt, rules that hide messages matching wire or ACH or invoice — these are the canonical staging step for business email compromise. A security team sees them around the clock, not at the next review.
Consent phishing is the quieter cousin of credential theft. A user grants a malicious app mailbox access, no password ever changes hands, and the attacker has a stable foothold. The SOC reviews new consents and risky app registrations.
Repeated push prompts, MFA method changes, fallback to weaker factors, and registration of attacker-controlled authenticators are all surfaced. We tell you when an account looks like it is being worn down.
If an identity is compromised, you are not left translating tool alerts into next steps. We coordinate session revocation, password and MFA reset, audit-log review, insurance notification, and the post-incident debrief.
We do not claim to have built the detection engine. Obsidian Ridge is a Huntress Partner, and the platform vendor builds and runs the detection engine and the 24/7 security team. We deploy it, tune the policies for your environment, handle the escalations the SOC raises, and own the analyst-side response — coordination, evidence capture, insurance notification, and the post-incident write-up.
Compare honestly
The question is rarely “which acronym is best.” It is “which one of these would have caught the attack that actually hit a business like yours last quarter?” This table is honest about where each one is blind.
| Attack pattern | Security software on its own | Computer protection | Computer protection + Work account protection |
|---|---|---|---|
| Phishing email lands, user clicks | Not seen — no endpoint malware | Not seen — endpoint-only scope | Sign-in anomaly + session events caught |
| Attacker replays stolen session token from abroad | Invisible — happens in the cloud | Invisible — happens in the cloud | Impossible-travel + risky sign-in flagged |
| Attacker creates auto-forward rule for ‘wire OR ACH’ | Not seen | Not seen | Inbox-rule alert, reviewed by a security team around the clock |
| Malicious OAuth app granted mailbox access | Not seen | Not seen | Security team flags consent alerts 24/7; we revoke the grant within one business day |
| Ransomware on a laptop | Caught — endpoint detection works | Caught + analyst response | Caught + analyst response |
| Best fit | Tech-mature teams that staff their own triage | Endpoint-heavy orgs without cloud identity risk | Any business running Microsoft 365 or Google Workspace |
If your business runs on Microsoft 365 or Google Workspace, identity is where the attacker is going. Buying endpoint-only detection in 2026 is buying a fence around the building while leaving the front door open.
Live test
On September 29, 2026 we staged a business email compromise against a test account in our own Google Workspace, with Huntress Managed ITDR watching. We signed in through a VPN server in Tokyo, created a Gmail rule that deletes any email about “invoice,” and waited. From the Tokyo sign-in to Huntress revoking the session took under five minutes. That is one test on one account, not a promised response time.
A test user signs in to Gmail through a commercial VPN server in Tokyo.
A Gmail filter sends anything with “invoice” in the subject straight to Trash. A test invoice email lands there a minute later, unseen.
The SOC ties the VPN sign-in to the finance-keyword filter, revokes every session on the account, and files a critical incident report.
On Google Workspace, Huntress signs the attacker out but leaves suspension to the administrator, because suspending a Google account cuts off more than email. That step is ours. The next sign-in attempt gets “Your account has been disabled.”
See the save
A short walkthrough of the kind of identity incident this service is built to catch. A composite built from public incident patterns, not a client engagement: the attack mechanics are real, and the response shows how the service works on Microsoft 365 — The 24/7 security team contains overnight, and we finish the rest within one business day.
Compliance mapping
Managed ITDR supports and produces evidence for the identity-side controls most frameworks now ask about. It does not make your organization compliant on its own — nothing does — but the detection logs, response records, and incident reports are the artifacts the auditors and underwriters keep asking for.
Where carriers and auditors used to accept an attestation checkbox, more of them now ask for the actual log review evidence. That is what ITDR produces continuously rather than as a one-time exercise.
Pricing
Identity monitoring starts at Ridge Core, so every tier watches the Microsoft 365 or Google Workspace accounts attackers go for. What the higher tiers add is training, email protection and the controls carriers ask about. We will tell you which one you actually need on the triage call.
Prices in USD · per person
Tier 01 · Ridge Core
A shared computer with no named user counts as one person.
Month-to-month · no minimum
Every computer and every email login watched by a 24/7 security team, with analysts reviewing alerts.
What's included
Replaces or complements
Tier 02 · Ridge Plus
Annual term · billed monthly
Adds Managed ITDR for Microsoft 365, Entra ID, and Google Workspace. This is the tier most identity incidents are stopped from.
Everything in Ridge Core, plus
Replaces or complements
Tier 03 · Ridge Reserve
Annual term · billed monthly
Ridge Plus, plus more of what carriers ask about: a written incident response plan with a yearly ransomware tabletop, quarterly admin-access reviews, and monthly patch reporting you can put on an application.
Everything in Ridge Plus, plus
Replaces or complements
Included in Ridge Reserve · Identity posture
Managed ITDR catches identity attacks that are happening right now. Managed Identity Security Posture Management (ISPM) reduces the conditions that make those attacks possible in the first place.
It is not a report you get handed. Huntress Managed ISPM applies Microsoft 365 security settings and keeps them applied. It compares your tenant against a recommended configuration, deploys settings on a schedule, and watches the Microsoft 365 unified audit log for changes to the settings it manages. When a managed setting is changed, Huntress either puts it back automatically or escalates it to us. At general availability Huntress extended the product beyond Entra ID to Microsoft Exchange, SharePoint and Teams.
Huntress documents the framework it enforces as spanning:
Huntress does not publish a setting-by-setting list, so neither do we. Ask and we will walk you through what is in the framework for your tenant before anything is deployed. One precondition is worth naming up front: the Conditional Access part of that framework needs Microsoft Entra ID P1 in your tenant, which Microsoft 365 Business Premium includes.
Microsoft 365 only. It does nothing for Google Workspace, where account hardening is work we do by hand, and it is not available on the GCC High onboarding path. Managed ITDR, by contrast, covers both platforms.
Included in Ridge Reserve. It is not an add-on and there is no separate ISPM line on a quote. A Ridge Plus client who wants their Microsoft 365 settings applied and kept in place moves to Ridge Reserve.
Both products improve identity security in Microsoft environments, but they answer different questions — and the right choice depends on team size and licensing.
| Capability | Managed ISPM | Microsoft Entra ID Governance |
|---|---|---|
| Primary purpose | Apply the Microsoft 365 settings that make account compromise harder, and put them back when they drift. | Govern the identity lifecycle — access reviews, entitlement management, lifecycle workflows. |
| Who operates it | Obsidian Ridge, end-to-end. We choose the rollout mode, read what Learning Mode says a policy will affect, and make the changes Huntress cannot apply automatically. | Customer IT team. Powerful tooling, but the configuration and review workflows are yours to run. |
| Licensing | Included in Ridge Reserve, with no separate Huntress charge. The Conditional Access policies in the framework need Microsoft Entra ID P1 in your tenant, which Microsoft 365 Business Premium includes. | Requires Entra ID Governance — a separate paid SKU on top of Entra ID P1/P2. |
| Deployment friction | Low. It uses the same Microsoft Graph connection as Managed ITDR; the first low-impact settings deploy on a schedule once the connection is live. | Higher. Access reviews, entitlement packages, and lifecycle workflows are designed for organizations with mature identity governance practices. |
| Best for | Practices that need the settings applied and kept applied without standing up a governance program or an internal change-control board. | Larger organizations running formal access certifications and joiner-mover- leaver automation. |
| Relationship to ITDR | Closes the configuration gaps that ITDR alerts on — fewer preventable incidents to chase. | Tightens who has access, but does not surface configuration risks ITDR cares about (legacy auth, OAuth consent, mailbox rules). |
For a small practice on Microsoft 365, hardening comes before governance. Entra ID Governance is excellent, and it is priced and scoped for an organization with a dedicated identity team to operate it. Applying the settings and keeping them applied is the part that pays for itself the first time it catches legacy authentication still enabled, or an admin account without phishing-resistant multi-factor authentication, before an attacker does. If you want to see what that looks like setting by setting, read the small business Microsoft 365 security review.
Sources: Huntress on Managed and Modified deployments (2026-09-24) · Huntress Managed ISPM general availability (2026-06-30) · Huntress ISPM documentation · Microsoft on Conditional Access licensing · Microsoft Entra ID Governance overview
Honest fit check
Managed ITDR is the right fit for most small and mid-market businesses running Microsoft 365 or Google Workspace and worried about account compromise, business email compromise, or wire-fraud staging. It is not the right fit if:
If any of those describe you, we will say so on the triage call. No hard feelings.
What happens after you reach out
A direct call with a senior analyst. We confirm fit, scope, and whether you actually need ITDR or whether the right next step is something simpler — turning on Conditional Access, blocking external auto-forwarding at the tenant level, fixing MFA hygiene. If you don't need us, we say so.
After the briefing, we scope a fixed-fee proposal with scope, term, onboarding fee, and timeline. The tenants we will connect to and the signals we will pull from each one are listed by name.
Managed ITDR deployment: tenant connection (Microsoft 365 / Entra ID / Google Workspace), detection policy baseline, sign-in risk thresholds, mail-rule and OAuth-consent policies, escalation paths, and tabletop walkthrough of the first incident-response runbook.
The SOC is watching from day one. You get a 30-day check-in, monthly identity reports, and someone you can call when a sign-in looks wrong — or when you simply want a second opinion on whether to grant an OAuth consent.
Choosing a service for your tenant? Compare managed ITDR for Microsoft 365 and Google Workspace, including who responds, terms and minimums.
Where this fits
ITDR is in every tier, starting with Ridge Core at $25 per person per month, alongside the MDR baseline. It watches the Microsoft 365 or Google Workspace tenant that MDR on the endpoint cannot see.
Pairs with Managed Detection & Response, Security Awareness Training, and Managed Email Security.
The office manager's mailbox is where payment-redirect and insurance-wire fraud start. ITDR catches the adversary-in-the-middle session-token theft and the hidden inbox rules that let a lab or insurance payment quietly walk out the door.
How this works for dentalClosing-wire fraud runs through a paralegal's compromised M365 session, not a cracked password. ITDR monitors sign-in anomalies, mailbox rules, and OAuth consent — the identity-layer signals that precede a rerouted settlement payment.
How this works for law firmsSeasonal contractors provisioned in February are the widest identity surface a CPA firm has. ITDR watches token replay, consent grants, and anomalous sign-ins across the tenant, and the account lifecycle that has to close on April 16.
How this works for accountingThe insurance wedge
Underwriters ask whether MFA covers every account and whether anyone watches for identity attacks that defeat it — adversary-in-the-middle, token replay, malicious OAuth consent. ITDR is the evidence that you monitor the identity layer, not just enforce a password policy.
From $1,500, delivered in 7 business days — final quote depends on scope, up to $3,500. Signed evidence pack mapped to your carrier's questionnaire — delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.
Obsidian Ridge is not an insurance producer, broker, or agent. We do not sell, place, or advise on insurance products.
Buyer guidance published . Updated . By Kfir Yair, CISSP.
Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. A security team monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States.
Obsidian Ridge monitors Google Workspace identities through Huntress ITDR. This is account monitoring, separate from the endpoint agent on a laptop. The current Microsoft 365 and Google Workspace comparison identifies the supported platforms and response responsibilities. The Google Workspace provider comparison focuses on Google identity coverage.
Google's administrative controls still need an owner: enforce MFA, separate administrator accounts, review third-party application access, and remove access when staff leave. ITDR adds detection and response around the accounts; it does not make every Microsoft-only identity product available in Google Workspace.
A small IT team needs a clear handoff, not another unassigned alert queue. A 24/7 security team provides round-the-clock monitoring and response on the platform. Obsidian Ridge handles CISSP-led follow-through within one business day; there is no personal emergency hotline.
Keep a named tenant administrator and agree who approves access changes, restores an account and communicates with staff. Read the pricing and operating responsibilities before choosing a licence-only product or a managed service.
FAQ
At Obsidian Ridge, we provide Huntress managed identity threat detection and response for Microsoft 365 and Google Workspace, included with endpoint MDR in Ridge Core at $25 per person per month.
A security team monitors and acts around the clock, while our CISSP-led practice handles setup, coordination and follow-through within one business day, alongside your IT team.
Yes. Obsidian Ridge uses Huntress ITDR for Google Workspace and Microsoft 365. Ridge Core includes ITDR and endpoint MDR. Google administration, supported response actions and third-party application access are scoped for the tenant; Microsoft-only features are not promised for Google Workspace.
A security team monitors and acts around the clock on the platform. Obsidian Ridge handles follow-through within one business day. Your onboarding scope identifies the tenant administrator, response permissions and communication owner; the service does not include a personal emergency hotline.
MDR (Managed Detection and Response) watches your endpoints, laptops, servers and workstations, and responds when they show signs of compromise.
ITDR (Identity Threat Detection and Response) watches the identity layer: Microsoft 365 sign-ins, Entra ID risk events, Google Workspace logins, OAuth consents, and mailbox rules. They are complementary, not competing.
Most modern attacks start in identity (a phished session token) and never touch an endpoint, so MDR alone leaves a real gap. ITDR closes that gap. Every Obsidian Ridge tier bundles both, starting with Ridge Core.
Yes. MFA blocks password-only attacks, but it does not stop adversary-in-the-middle (AiTM) phishing kits that capture the authenticated session itself.
Once an attacker holds a valid session token, they can replay it from anywhere and your tenant sees them as fully MFA-authenticated.
Major industry threat-reporting teams have repeatedly identified AiTM and token theft as a primary identity-compromise pattern against small and mid-market businesses.
No. The victim types the attacker's code into Microsoft's real sign-in page and passes their own MFA, so there is nothing for MFA to reject, and the attacker's waiting session receives the access and refresh tokens instead.
The prevention is a Conditional Access policy that blocks device code sign-in where your firm does not need it, starting in report-only mode and excluding break-glass accounts.
The detection is someone watching for the stolen session and revoking it, which is what Managed ITDR is for.
Our article “Device code phishing on Microsoft 365, explained” walks through Microsoft's documented steps, the Entra ID P1 license the policy needs, and what to do if someone has already entered a code.
Anything that happens entirely in the cloud.
A phished session token replayed from a foreign IP, an auto-forwarding rule created to hide invoice emails, a malicious OAuth app granted mailbox.read permissions, MFA-method changes that re-register the account to an attacker's authenticator, anonymous-proxy sign-ins — none of those touch the endpoint, so endpoint detection cannot see them.
ITDR is the layer that does.
Yes. Managed ITDR connects to both Microsoft 365 (Entra ID, Exchange Online, OneDrive, SharePoint) and Google Workspace (audit log, Gmail, Drive) and correlates identity events across both.
We deploy the connectors, tune the policies for your tenants, and the 24/7 security team reviews the alerts.
Obsidian Ridge operates the whole program end-to-end — escalation handling, response coordination, evidence capture, and the post-incident write-up.
Two clocks. The security team reviews sign-in risk and inbox-rule alerts around the clock and can revoke the session on a confirmed token theft to contain it, without waiting for business hours.
Everything after that is ours: password reset, MFA re-enrollment, and the audit-log review a cyber-insurance notification needs.
We pick that up within one business day — there is no out-of-hours line to call, and the revoked session holds until we do. Our published scenario walkthrough of a 3 a.m. ITDR save goes through the whole sequence in detail.
Managed ITDR is included in all three tiers, starting with Ridge Core at $25 per person per month. It is not sold as a standalone line item, because operating it without the surrounding MDR, training and reporting program leaves obvious gaps.
No. Entra ID Protection and Defender for Cloud Apps are Microsoft-native tools — useful, but you have to license, configure, tune, and staff them yourself, and they only see the Microsoft side of the world.
Managed ITDR is a purpose-built identity-threat platform that watches both Microsoft 365 and Google Workspace, comes with a 24/7 security team reviewing every alert, and is operated end-to-end by Obsidian Ridge.
The Microsoft tools produce signals. Obsidian Ridge produces decisions.
Yes, in two practical ways. First, it produces the kind of evidence underwriters now ask for — MFA coverage, identity monitoring, session controls, and incident-response capability — instead of a self-attested checklist.
Second, when an incident does happen, you have an audit-log record and a practitioner-written incident report to hand the carrier.
Related
For local coverage and how we work with a small office, read about our cybersecurity services in Raleigh, Durham and the Research Triangle.
Next step
See where you stand in a few minutes, or talk with us. Both are free and we tell you when you don't need us. 30 minutes, real answers, plain language, an analyst who returns your call within one business day.
Written before the pitch: what the control does, what it does not reach, and what it costs.