The Partner Opportunity For Microsoft Security, Compliance, And Identity And Access Management Solutions

Total Opportunity Overview

• The trends discussed above resulted in the growth in partner opportunities across all solution areas (i.e., workloads) and across all partner services — deployment, advisory, solutions development, and managed services — in the 2022 fiscal year. This was true for both total revenues, which reflects an increase in what partners are offering, and attached revenues, which is an indication of increased customer interest. The total expected revenue opportunity (with attach rates applied) grew by 21% for a new enterprise customer with a mix of information and frontline workers beginning a three-year journey. Overall, the opportunity was approximately 40% for Microsoft 365 Security, with the remainder spread evenly across the workloads.

• Deployment opportunities grew by 34%.

  The large increase in deployment opportunities was largely driven by the increased scope associated with the E5 solutions and expansion into new workloads. The largest growth was in Multicloud Security as many more customers need to secure their cloud environments. An increase in competitive takeaways as part of post-COVID-19-rush vendor consolidation also contributed to the increase in deployment opportunities.

• Advisory services grew by 28%.

  Advisory services became more important as complexity has increased. These services include upfront strategy and planning work as well as adoption and change management (ACM)-related services. Partners are increasingly making it a requirement to include some advisory services, especially around ACM, to ensure successful rollouts and ongoing usage.

• Solutions development grew by 14%.

  The largest driver of the increase in solutions development was related to the increased security information and event management (SIEM) and security operations center (SOC) opportunities. Partners have created a lot of their own IP to drive efficiencies in their service offerings as well as to sell these solutions to customers. There is also a large advanced-integration opportunity to scoop up as much telemetry as possible for extended detection and response (XDR) services.

• Managed services grew by 18%.

  An overwhelming majority of interviewed partners are most interested in managed services. Many of the deployment and solutions development services are designed to ultimately result in a managed services contract. Microsoft Sentinel provides many partners with the foundation and framework upon which to build their own managed services. Partners have also created managed services around evergreen support across all workloads, support/help desk, and specialty compliance offerings such as eDiscovery-as-a-service.

  Forrester discussed with partners the likelihood of customers buying any given offering; this is referred to as the attach rate. For existing services and solutions, attach rates have improved. Newer services attach at lower rates as delivery lags services development and sales, but attach rates are increasing quickly. Specialized partners, such as those focused on legal compliance, may have higher attach rates than the more generalized attach rates included in this study. Partners should take their areas of specialization and existing attach rates into consideration when thinking about their opportunities.

Microsoft 365 Security

Microsoft 365 Security is about activating and managing Microsoft 365 workloads securely. The opportunities for partners have increased proportionally with all of the additional capabilities that Microsoft has added to both the E3 and E5 SKUs, although the move to E5 is the biggest driver.

• Core deployment services consist of E3 to E5 migrations and standing up the range of Microsoft 365 Security solutions.

  An increasing number of these opportunities are beginning with one or more workshops, and Microsoft often funds these. A complete deployment journey can be 100 times the value of upfront workshops and pilots. Competitive takeaways in this space can range from $50,000 to $250,000. A full Sentinel deployment and associated services are typically around $200,000.

• Advisory services have increased and generally equate to a 15% to 30% uplift on deployment revenues.

  The upfront strategy and planning piece has increased because of the added complexity associated with more solutions and supporting hybrid work. There is also more effort going into defining a proper change management and governance plan and then rolling that out. Partners are emphasizing this more and often requiring customers to take at least a light version of these offerings, which has resulted in a 70% attach rate.

• Resalable IP is the largest component of solutions development, but there are also custom development and integration opportunities.

  Most of the IP that partners are building now is designed to ingest signals from disparate systems for SIEM and SOC offerings along with management, monitoring, and remediation tools. Partners are selling these solutions to customers for internal use (what is quantified in this subsection) as well as for their own use in managed services. There are also one-off integration projects tied to ingesting and analyzing telemetry. Custom development can be up to 30% more than what is spent on core development services.

• Managed services has grown in depth and breadth as companies struggle to staff in-house security teams.

  Sentinel continues to enable partners’ creation and delivery of managed services. Customers have an increased interest in SIEM and SOC services, especially those that are fully on the Microsoft stack. Detection and remediation services are packaged separately so that a customer can buy only what they need. More traditional outsourced managed services around ensuring a proper security posture using the E5 security solutions, ongoing audits and planning, and various levels of user support continue to grow.

Multicloud Security

Multicloud Security includes the services and solutions partners offer around Azure and other public clouds running Microsoft solutions. Most of the interviewed Microsoft 365 Security partners are in the process of or planning to move into this area because there are so many opportunities to attach services. This includes security services around data, virtual server, networking, and applications. There are also opportunities around advanced workloads, such as AI and machine learning.

• Deployment services cover all aspects of Azure as well as support of multicloud security.

  All of the partners Forrester interviewed with a cloud security practice had an emphasis on Azure. However, they support their customers across public clouds and their multicloud customers represent some of their largest opportunities. Partners provided many examples of cloud-related deployments, including server migrations, application migrations, and general efforts around standing up and configuring the full Azure stack with proper security. Partners reported that Microsoft Defender For Cloud has become a very important enabler of the deployment and follow-on work they are doing.

• Secure cloud migrations require significant upfront strategy and planning advisory services.

  Due to the newness of cloud security at many companies and a corresponding lack of in-house skills, partners are doing sizeable strategy and detailed planning work, typically 20% on top of other deployment work. There is also other work being done around governance and training for IT and end users. There is an intersection point between cloud security and compliance because of hosting information in the cloud complicating privacy.

• Partners are creating a lot of solutions around migrating and operating securely in the cloud.

  Partners can use these tools either in the delivery of managed services or sold to customers in a SaaS model. Partners also reported large integration and development opportunities, especially in hybrid and multicloud scenarios. As customers increasingly move to cloud-based applications, partners expect these opportunities to become much larger.

• Managed services is the largest opportunity and where partners are focusing most of their attention.

  Consistent with the other workloads, partners said that their customers increasingly want to get out of managing IT. This is especially true for cloud because they traditionally do not have strength in this area or a deep bench of resources from which to draw. Examples of partner offerings include cloud SOC services (tied into cloud network operations center [NOC] services); evergreen support of Azure to ensure new capabilities are implemented and kept secure; maintaining and updating cloud applications; and fully outsourced security management of all levels of a cloud-based infrastructure.

Compliance

Security partners are continuing to move into the compliance space as Microsoft’s investment in compliance solutions makes it easier to credibly speak about and provide services. Entry points for these partners tend to be around information protection, communications governance, and insider risk, which are natural extensions of security practices. More specialized partners continue to be the ones with the necessary skills around advanced eDiscovery/legal hold and records management.

• Deployment work often begins with workshops leveraging Microsoft Compliance Manager.

  Deployment projects in areas such as information protection are typically around 10 times the upfront spend on workshops and pilots. Partners with mature compliance offerings are seeing an increase in very large information protection deployment opportunities that can last a year or longer and cost up to $1 million. These opportunities can involve the migration of more than a petabyte of data and complex integrations.

• Governance advisory services are central to the successful adoption of Microsoft compliance solutions.

  To a large extent, compliance is all about governance for both the IT organization and the thousands of business users at an enterprise customer. Partners are doing a lot of upfront work around defining governance models and, in many cases, managing them for customers. There is also a large educational component so that business users understand the importance of governance and have the training and knowledge necessary to help ensure compliance.

• Partners are wrapping their own IP around Microsoft’s solutions at an increasing rate.

  Although this is still largely confined to specialized compliance partners, the more general security partners are starting to look at this area. Some examples include off-the-shelf connectors, advanced eDiscovery tools, unstructured-data compliance tools, and evergreen compliance capabilities. Partners are starting to list some of these in the Azure Marketplace. There can also be extensive integration opportunities to connect disparate information repositories for an enterprisewide compliance initiative.

• Compliance-related managed services is the newest and fastest-growing area for most partners.

  The more generalist partner has been investing in compliance-related managed services over the past two years. Their investments are paying off with a 44% YoY growth. For these partners, information protection and data loss prevention are the biggest opportunities area, and prices at around $2.40 per user per month. They are also doing more around ensuring basic compliance of Microsoft 365. More advanced partners have managed service offerings for outsourced administration of eDiscovery, ongoing audits, and packaged hours for legal hold. There is a general trend to replicate SOC-type models as a compliance-as-a-service model, although only a couple of partners were far enough along to have offerings for sale.

Identity And Access Management

Identity And Access Management is both a distinct workload and a foundational component of the three other workloads: Microsoft 365 Security, Multicloud Security, and Compliance. As such, partners increasingly think of it in terms of the previously described opportunities. That said, IdAM is still a major driver of all partner security-related opportunities because of the near ubiquitous adoption of Microsoft Active Directory or Azure AD. The Zero Trust narrative is also important for partners and Microsoft in creating multiyear IdAM journeys covering solutions such as multifactor authentication (MFA), single sign-on (SSO), and passwordless authentication.

• IdAM journeys can be multiyear and cost millions of dollars as part of a move to a Zero Trust approach.

  Increasingly, these are including the rollout of full digital identities for frontline workers. One partner described doing a B2C identity migrations for a customer’s 40 million external customers. If this becomes common, it could be a big opportunity for partners. With regards to the more tactical competitive takeaways, their cost varied based on factors such as how many applications required SSO integration and if they were web apps. These projects often grew to be $250,000.

• IdAM is central to every user, so advisory services are very important in terms of properly defining the program and providing enough ACM support, including hands-on training.

  Partners estimated that to be truly successful, advisory services can be 20% to 30% on top of the deployment effort. These services are attaching at higher rates in part because partners are making it compulsory and because customers have been burned by past failures due to a lack of ACM.

• Solutions development can consist of off-the-shelf IP, such as connectors and management tools, as well as some advanced integration work to try disparate systems together into a common IdAM approach.

  Application migrations are an area where partners are doing a lot of custom development work and making a lot of money. Hybrid and multicloud environments play into the size of these opportunities. Partners are also creating IP to make the managed services more profitable. The costs for this final category are usually imbedded into the managed services contract cost.

• IdAM-related managed services are often merged with the broader user-support managed services contracts.

  There are also more specific managed services around managing the IdAM infrastructure and ensuring that capabilities such as SSO do not break when a vendor makes a change to an integrated application. Some managed service providers (MSPs) and managed security service providers (MSSPs) are doing the upfront deployment and advisory work at no charge, instead imbedding those costs into a multiyear IdAM managed services contract. In those cases. The services contract kicks in on the first day of the project rather than after going live.