AI for MSPs: Managed AI’s Control Point Moves Upstream

[00:00:02] On October 15th, one credential signed in to 173 Microsoft 365 tenants in a little over two hours, moving through them in sorted order, seconds apart. It didn't belong to an employee or a client, it belonged to a backup vendor. This is the Business of Tech, I'm Dave Sobel. Before the first fact, a disclosure. Many of the companies in this episode sponsored this show or have in the past.

[00:00:32] I own Small Biz Thoughts and IT Service Provider University, which compete with GTIA for MSPs community and education. I do better when MSPs rely on independent sources instead of vendor-led ones, and this episode leans that way. I also know Rob Ray, who chairs the alliance you're about to hear about, and GTIA CEO Dan Wensley personally. So I'm reporting on a market I compete in. Discount my conclusion if you like.

[00:00:57] The facts are sourced and linked. As always, our sponsors and my financial disclosures are at businessof.tech. The pieces of managed AI are being assembled and most of them sit upstream of the MSP. Start with PAX 8. At its Beyond EMEA conference in Copenhagen, the distributor launched 8OS, which it describes as an operating system for IT providers to govern the AI agents running inside their customers' businesses.

[00:01:26] It's built on the marketplace more than 47,000 IT providers already use to sell to around 800,000 small businesses. Partner and client identities carry over from that marketplace. Agents and models from different vendors are managed together as one workforce, and the partner sets the rules client by client. Usage and spending are metered per user and per customer with hard caps that cut consumption off.

[00:01:55] The partner sets the price, and billing runs through the PAX 8 account it already has. Alongside it comes 8Bot, a managed AI coworker that partners deploy and supervise through 8OS. Limited early access is open, with general availability planned for early 2027. Now look at who is writing the rules for that kind of service.

[00:02:18] GTIA, the Channel Trade Association, launched the Managed Intelligence Alliance to build standards, open specifications, and accreditation for managed AI. PAX 8 is its charter member. GTIA's CEO, Dan Wensley, told CRN the idea came from PAX 8. In his words, PAX 8 brought it to us, and we stood it up.

[00:02:41] It's chaired by Rob Ray, PAX 8's Corporate Vice President of Community and Ecosystems, who also sits on GTIA's board. It isn't only distributors. GoTo added an open beta model context protocol connector to LogMeIn Resolve, its remote support platform for MSPs. It lets a technician query Resolve and take supported actions through Anthropic Claude without opening the console.

[00:03:08] GoTo says existing account permissions stay in force, activity is logged, and changes can require confirmation. In plain terms, the identity, the rules, the meter, and the bill for client AI are all being built into platforms the MSP subscribes to. The standard that will define what good looks like is being chaired from inside one of them. That's where the control point is going. The question is what it's made of.

[00:03:37] If you're listening to this and haven't hit follow yet, on Apple Podcasts search Business of Tech. It takes five seconds, and you'll get the next episode automatically. Are you and your clients tired of the time-consuming ticket tennis of coordinating meetings and help desk calls? Wouldn't it be better to automate this process with a tool that connects directly to ConnectWise Manage or Autotask?

[00:04:01] TimeZest offers scheduling automation that gives you complete control of your schedule and eliminates the hassle of calendar ping pong. As the only service designed specifically for MSPs, it integrates into your workflow and makes scheduling appointments easy on you and your clients. Plus, you can try TimeZest for free.

[00:04:22] Visit TimeZest.com slash MSPRadio and use the code MSPRadio to get 10% off your first year of TimeZest. Kaseya's own survey of more than 1,100 MSPs and IT professionals found that 68% rank human error as the biggest threat to their organizations. The incident at the center of this episode didn't need anyone in an MSP or a client to make a mistake. It needed one credential.

[00:04:51] ConnectWise Cloud Backup, formerly Skykick, backs up clients' Microsoft 365 data for MSPs. To do that job, it's consented into every tenant where it's installed with broad access to mailboxes, OneDrive, SharePoint, Teams, and the directory. The credential behind that consent lives with ConnectWise, not with the MSP or the client. It's a master key to every client's office kept at the locksmith shop.

[00:05:19] Huntress found that the credential used to sign in to 173 tenants in a little over two hours, moving through them in sorted order, seconds apart. That's a script working from a list. Microsoft called it an active supply chain attack on a trusted app. That's the first property of upstream control. Consent is given once and the access stands. It also sits outside the controls MSPs watch.

[00:05:47] Total found that revoking user sessions didn't end it, and Huntress noted that some directory reads leave no audit trail. The second property is that one key can make others. In at least one partner tenant, Huntress found a second ConnectWise app gave itself Global Administrator. It then added new secrets to an MSP management app and to Huntress' own security app.

[00:06:15] MSP management apps are often consented into the MSP's client tenants too, so access to the MSP's tenant is a path to the rest. Guards, which sponsors this show and sells identity threat detection, counts seven privileged ConnectWise apps in Microsoft 365, so the exposure isn't limited to the credential that leaked. It also warrants that intralog retention can be as short as seven days.

[00:06:43] The third property is that the off switch belongs to the vendor too. ConnectWise shut off cloud backup, its SaaS security and its cloud management services while it investigates, and it says it has found no evidence that partner backup data was compromised. Every partner's service stopped together. As of October 18th, it was still down. Clients couldn't back up, open their archives or restore.

[00:07:09] Any tenant where the app stays enabled stays exposed until ConnectWise rotates the credential. In plain terms, a platform that holds standing access in every tenant doesn't fail one client at a time. It fails all at once and from the top. And the number of identities like that is set to grow. For an MSP, this lands on every client you put AI in front of.

[00:07:35] Each agent is another identity holding standing access, and someone has to answer for it. Start with what organizations can see. JumpCloud, which sells identity management, surveyed 250 IT leaders in the US and UK. 59% of organizations using AI agents haven't fully brought them under identity and access policies.

[00:07:58] 72% report a significant gap between what their AI systems are permitted to access and what they can verify those systems actually accessed. And 36% had investigated an AI-related concern and couldn't determine what the AI had touched. Those are organizations with IT leaders. The small businesses MSPs serve mostly have the MSP. Now look at where the keys end up.

[00:08:25] OpenCode, an AI coding tool, disclosed unauthorized access to a legacy system it was already preparing to shut down. Third-party keys that users had stored in their workspaces, including keys for OpenAI and Anthropic, may have been exposed. Its instruction to affected users was to revoke and replace each key at each provider. The keys belonged to the users, and so did the cleanup. Put those together and the consequences play.

[00:08:53] Managed AI adds a privileged identity to every client-tenant you deployed in, and the credential for that identity lives somewhere other than the tenant. When it goes wrong, the client won't call the platform. They'll call you, and they'll ask what the agent accessed. You may not have the logs to answer. So here's the choice. Treat any upstream AI governance layer as what it is.

[00:09:20] A privileged vendor identity in every client-tenant. Before the first agent runs, get its consent scope and who holds the credential in writing. Turn on the logs that show it acting, and make sure you can disable it in each tenant yourself, without waiting on the vendor. Or, adopt it as a marketplace feature and accept that every client's AI control point

[00:09:46] sits with a vendor whose breach becomes yours everywhere on the same morning. Before you make that choice, the platform deserves its best argument. Cloud-minted winners. Security-minted winners. AIs? Next. Next. But not for the MSP with the most tools, for the ones who turn intelligence into a business. PAX-8 calls it managed intelligence.

[00:10:13] A new kind of provider, built on the PAX8 marketplace, for the shift almost nobody's built for yet. 47,000 partners are already there. Join them. PAX8.com That's P-A-X, the number 8, dot com. In events, from Ninja One, a free on-demand webinar on turning hygiene reporting into client retention. Link is in the show notes.

[00:10:43] Why do we care? Because the strongest objection is a fair one. A distributor's platform has a security team your 10-person shop will never have. And centralizing governance is how small MSPs get controls they couldn't build. ConnectWise had a security team too. What failed was standing consent that nobody downstream could watch, and that only the vendor could fix, because the credential lived with the vendor.

[00:11:09] Use the platform if it's better, but know which of your tenants it's in, keep the logs, and make sure you can switch it off in every one of them yourself. So what to consider? Inventory consented apps, starting with your own tenant. List every enterprise app with standing access in each tenant, who published it, what it's permitted to touch, and whether anyone still uses it. Do your own tenant first, because your management tools reach every client from there.

[00:11:39] The MSPs who moved fastest on ConnectWise were the ones who already knew which tenants had which apps. Turn on the logs and keep them past the default. Every service principal sign-in and graph activity logged in each tenant, and exported somewhere you control. Entro retention can be as short as 7 days. Without your own copy, what did the app access is a question only the vendor can answer.

[00:12:07] Rehearse the break before you need it. Script the per-tenant disable for every privileged vendor app, and confirm you hold the admin role to run it in each client. Microsoft's automatic location and risk blocking doesn't cover third-party multi-tenant apps, and already issued tokens outlive a disable by up to 90 minutes. So this break is manual and has to be fast. Disabling an app also doesn't remove credentials an attacker already added,

[00:12:37] so check every app's credentials, not just the vendor's. Ask any AI governance platform the same three things in writing before you deploy it. What it's consented to per tenant, whose tenant holds its credential, and how you'll be told when that credential rotates. If this trend continues, distributor-run AI governance reaches general availability in early 2027, with the Alliance's standards close behind.

[00:13:06] My bet is that the MSPs keeping their own per-tenant break on those platforms will be the ones clients still trust after the next vendor incident. If partners adopt it without it and nothing breaks, I'm wrong. And the first place I'll find out is in where MSPs choose to spend their community and education time. This is the business of tech. Want to go deeper than the news?

[00:13:34] The Small Biz Thoughts community is where MSP owners and operators work on the business, not just in it. Member meetings, a deep resource library, and courses through IT Service Provider University. Everything you need to run the practice you actually want. Join us at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage. The Business of Tech is written and produced by me, Dave Sobel,

[00:14:02] under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode. Part of the MSP Radio Network.