Identityisthenewperimeter.Weprotecteverylayerofit.
Not just a backup. VentraID captures up to 33 Entra ID object types, ranks every configuration change by severity, restores down to a single attribute, and reverts an attacker’s changes with guardrails that never delete a Global Administrator or a registered break-glass account — then adds posture scoring and identity-threat response across your full MSP fleet. Four progressive tiers: Backup, Intelligence, Orchestration, Advanced.
Attackers target the identities that unlock the data.
Microsoft's Digital Defense Report 2025 found that more than 97% of identity attacks are password spray or brute-force attacks, and that modern multifactor authentication still reduces the risk of identity compromise by more than 99% (Microsoft Defender XDR and Entra ID Protection alerts, April to June 2025). Conditional Access drift, dormant service principals and abandoned guest accounts are the configuration gaps VentraID watches for.
Start with backup. Add intelligence, orchestration, and defence as your fleet grows.
Each tier builds on the one before it. Every customer gets the snapshot engine on day one; the higher tiers add drift, deployment, and detection layers, billed only on the tenants that consume them.
VentraID Backup
Configuration resilience for the entire identity layer.
Every policy, every role, every device, captured three times a day by default and as often as every four hours, kept for the retention you set, with a tamper-evident audit chain.
- ✓Scheduled backup of users, groups, conditional-access, named locations, service principals, directory roles, devices, and applications.
- ✓Three snapshots a day by default and six at the standard ceiling — every one a full capture of all 33 object types, hashed into the same tamper-evident chain. Sign-in and audit-log ingestion runs on its own four-hourly cycle.
- ✓Authentication-method policies and PIM role-management policies captured on every snapshot.
- ✓Point-in-time restore keeps IDs where it can: an object recovered from the recycle bin keeps its original ID, and one rebuilt from backup gets a new ID, which the same restore writes into the Conditional Access policies and role and PIM assignments it restores alongside it.
- ✓Hash-chained, tamper-evident snapshot history; sign-in and audit-log retention configurable up to 7 years for compliance. Sign-in log retention needs Microsoft Entra ID P1 or P2.
- ✓Soft-delete recovery from the recycle bin alongside a full recreate-from-backup mode.
VentraID Intelligence
Drift detection and multi-framework compliance scoring on every snapshot.
A field-level diff engine watches every change and grades each tenant against the frameworks your auditors actually audit against.
- ✓Field-level drift engine catches every config change between snapshots, severity-classified, ack-or-remediate workflow.
- ✓Compliance scoring against CIS, NIST 800-63, CISA SCuBA, SOC 2 and ISO 27001 with letter-grade results.
- ✓Cross-tenant comparison surfaces parity questions across your portfolio in one view.
- ✓Stale-account detection, MFA reporting, and a guarded revert of a drifted object’s changed fields to their earlier values.
- ✓Daily tenant-health composite (RPO / compliance / drift) with history trending.
- ✓Scheduled compliance reports delivered as PDF on a daily cadence.
VentraID Orchestration
Versioned identity baselines you author once and ship to your fleet.
Templates, bulk deployment, and Conditional-Access What-If, built for MSPs who manage tens or hundreds of tenants from one chair.
- ✓Versioned, publish-able security templates for conditional-access, named locations, role assignments, and app registrations.
- ✓Bulk cross-tenant deployment with a preview for every target tenant, and per-tenant rollback of a completed or failed deployment.
- ✓Conditional-Access What-If simulator powered by Microsoft Graph: test how a tenant’s live policies treat a given sign-in.
- ✓CA gap-analysis matrix scans sample users × platforms × client apps to surface unprotected scenarios.
- ✓Template propagation from an anchor tenant to your full portfolio in one operation.
VentraID Advanced
Identity threat detection, guarded recovery, and an AI compliance copilot.
Fourteen detectors watch the identity plane on your configured capture cadence, correlated across two engines. Hygiene, break-glass and guarded rollback handle the rest.
- ✓Fourteen identity-threat detectors: impossible-travel, brute force, token replay, mass deletion, federated-domain spoofing, credential spraying, privilege escalation, illicit OAuth consent, and more. Sign-in-based threat detectors need Microsoft Entra ID P1 or P2.
- ✓Cross-tenant threat correlation finds attacks that span multiple tenants in your fleet.
- ✓Cross-engine correlation: when the heuristic engine and the anomaly engine flag the same actor in the same window, confidence is raised rather than the alert being duplicated.
- ✓Guarded tenant recovery restores a tenant to a known-good point and can remove an attacker-created role assignment or policy, not only re-create what was deleted. Removal is refused until the tenant registers a break-glass account, and the last-Global-Administrator guard fails closed.
- ✓Hygiene engine surfaces orphaned apps, stale service principals, expired credentials and empty groups, with confirmation-gated, audited clean-up.
- ✓Break-glass account vault: monthly password rotation, sealed-credential retrieval, and full access logging.
- ✓Configuration-as-code export: any snapshot as JSON, with per-object change history.
- ✓Conversational compliance copilot answers tenant-admin questions from your latest snapshot, scores and findings.
One pane across every tenant. No spreadsheets, no swivel-chair audits.
Hover any cell to drill into that tenant's drift, threat, and compliance state. Click to open the full MSP-portfolio dashboard. Bulk-deploy a baseline to every B-grade tenant in one operation.
- ✓Cross-tenant policy comparison in one view
- ✓Threat correlation across your full portfolio
- ✓Per-tenant SLA + quarterly compliance scorecards
- ✓Bulk template deployment with per-tenant preview and rollback
Five frameworks. Letter grades on every tenant.
Stop quoting auditors generic "best practice" templates. Score against the frameworks they audit against.