Machine-Speed Defense: Why We’re Connecting Our Tools to Our Clients’ Microsoft and Google Tenants

Over the coming weeks, we’ll be connecting our support tools to our clients’ Microsoft 365 and Google Workspace tenants. This post explains what that access is, what it is not, and why we think it’s the most important security change we’ll make this year.

Why now

If you haven’t followed the story, here’s the short version: in July, AI agents being tested by OpenAI got out of their test environment and broke into production systems at Hugging Face, one of the largest platforms in the AI industry. Nobody told them to. OpenAI later gave a presentation on the incident, and you can watch them explain it first hand. Two points stuck with us.

First, the techniques were ordinary: a leaked password, misconfigured servers, well-known kinds of software flaw. What was new was the tempo. Once inside, the agents went from a foothold to full administrative control of multiple server clusters in under thirteen hours, and kept going without breaks, shift changes or second thoughts.

Second, the attack was noticed. Monitoring registered it, and by the researchers’ account it was noisy. But the alerts sat in the same queue as routine noise, and it was nearly a week before anyone recognized what they were looking at. The gap wasn’t in seeing the attack. It was between seeing it and stopping it.

That second point is the one that matters for the organizations we support. The same AI capabilities are now available to people who mean harm, and attacks that used to take a skilled person days can be run in hours. A defense that depends on someone noticing an alert, signing in to four different consoles and piecing together what happened is a defense that arrives late.

What we’ve built

Over the past several months we’ve connected our own AI tooling to the platforms we manage for our clients. (We wrote about how in Operationalizing AI.) That tooling can already read Huntress for endpoint protection, JumpCloud, NinjaOne and Addigy for device management, and the firewalls and networks we look after. The missing piece has been the place where most attacks actually start: email and identity platforms.

Connecting Microsoft and Google tenants closes that gap. Now when something looks wrong, our tools can assemble the whole picture in minutes:

• Huntress, our managed detection and response partner, raises an alert on a laptop. Our tools immediately check who was signed in, where they signed in from, whether that account just added an email forwarding rule or a new multi-factor device, and what else that person’s other devices have done.
• A sign-in from an unfamiliar country triggers the same check in reverse: is the device managed, is it encrypted and up to date, has Huntress seen anything on it.
• Device management data from JumpCloud, NinjaOne, Addigy and, once a client’s tenant is connected, Microsoft Intune (whether a machine is encrypted, patched and still checking in) sits alongside sign-in and audit records instead of in a separate console.

A Macktez Team Member reviews the evidence and decides what to do. The difference is that they start with the evidence already assembled, rather than spending the first hour of an incident gathering it.

What else it makes better

Security is the reason we’re doing this now, but it isn’t the only benefit.

• Faster answers. Questions like “why didn’t this email arrive?” or “who is in this group?” get answered from the source in minutes, without asking clients for screenshots.
• Better evidence. Our recommendations come with the records behind them: sign-in history, device state, audit logs.
• Problems caught before clients notice them. Accounts without multi-factor authentication, devices that have stopped checking in, licenses assigned to people who have left, and rules forwarding mail outside the organization all surface on their own, not when someone happens to look.
• Onboarding and offboarding checked across every system at once.

What the access is, and what it is not

We designed both connections to be narrow, transparent, and easy to remove.

For Microsoft 365, the connection has two parts: an application called Macktez Access, and a Granular Delegated Admin Privileges (GDAP) relationship, Microsoft’s standard way for a managed service provider to administer a tenant. The relationship sets exactly which administrative roles we hold, and it expires on its own unless renewed. Our tools act as the individual Macktez Team Member who is signed in, never as a shared account, so every action appears in the client’s own audit logs under that person’s name.

For Google Workspace, the connection uses one of two levels, read-only or administrator. Neither can create new administrators. There is no stored password or key on our side for someone to steal: each request is signed with a short-lived credential issued at the moment it’s made.

In both cases:

• It cannot read users’ email, files, documents, calendars or chats. (In Microsoft 365, message trace is the one exception, and it is metadata only: who sent a message to whom and whether it arrived, never the contents.)
• Every request our tools make is logged on our side, as well as in the client’s own audit logs.
• Access is tied to individual Macktez Team Members’ accounts. When someone leaves Macktez, their access ends with their account.
• Clients can see the connection in their own admin console at any time.

Because Macktez has always had global/super admin permission to our clients’ Microsoft and Google Workspace tenants, we are not getting any new privileges. In many cases, this new integration will have fewer privileges than a human technician does today. That makes this solution faster, more comprehensive, and more secure.

What clients need to do

Nothing. We are rolling this integration out for the organizations we support over the coming weeks. All Global Administrators in Microsoft 365 will receive a notification from Microsoft when it’s enabled for their tenant. Google Workspace admins don’t get a notification, but the connection is listed in the admin console like any other.

The takeaway

Attackers now have machine-speed tools. Defending against them means investigating at machine speed too. For Macktez clients, this new integration powers faster investigations, while maintaining human decision-making about and control of mitigations.