Waypoint sets your Microsoft 365 security baseline, checks the live tenant against it for drift, corrects what changes, and keeps current evidence of what is actually enforced.
Direct to law, accounting, healthcare and government-contracting firms. Or under your own brand, if you are an MSP.
For MSPsSet it. Hold it. Prove it.
WaypointX is a defined Microsoft 365 configuration and the discipline that holds it in place, across identity, devices, data, and email and collaboration. It runs on the Microsoft capabilities in your existing licensing. No agent to roll out, and no second console for your team: the controls stay where your IT people already work.
Three levels. Each adds responsibility, not features. If your controls are already largely in place, WaypointX can start by changing nothing and only reporting where the tenant differs from the baseline.
Set the configuration: risk-based conditional access, Intune compliance and encryption across Windows, macOS, iOS and Android, DLP, sharing controls and labels, mail protection. Built against CIS and NIST CSF, documented as issued.
Hold it. Automated checks compare the live tenant against the baseline. What moved is restored, or logged as an exception with an owner and a review date. An engineer reviews and reports monthly.
Prove it, and own it. A named security executive holds the risk register, runs the program, faces auditors and insurers, and answers to your board.
| Control | Status | Owner | Last checked | Evidence |
|---|---|---|---|---|
| Conditional Access | Controlled | Waypoint | Today | Available |
| External Sharing | Review | Client + Waypoint | Aug 29 | Open |
| MFA Coverage | Controlled | Waypoint | Today | Available |
| Device Compliance | Controlled | Waypoint | Today | Available |
| Risk Register | Current | CISO | Aug 28 | Available |
People join and leave. Devices enroll. Someone turns on sharing for one project and it stays on afterwards. Licensing changes and new controls arrive switched off. The industry calls this drift. What it means is that the configuration you signed off six months ago has quietly stopped being the one you are running.
Meanwhile the people asking about your security have stopped accepting a description. Insurers ask what you attested to. Clients send questionnaires before they sign. Auditors ask for the artifact. The question is what is switched on right now, and who says so.
An alert is not a control.
A dashboard is not a program.
A score is not an answer.
Companies that watch.
Companies that answer.
Monitoring produces awareness. A program requires judgment, correction, verification, evidence and an owner. Waypoint is built to finish the sequence.
Microsoft 365 records what changed and who changed it. It will not tell you whether the change was a mistake, put it back, or capture why anyone chose to live with it. Waypoint operates that span.
Business Premium and E3/E5 include identity, device, data and threat controls that were licensed and never fully switched on. Waypoint starts there rather than with another vendor, another agent and another console. Fewer moving parts, and a baseline that gets upgraded as your licensing changes instead of re-architected.
We ask clients to keep current proof of their own controls. It would be strange to ask that and not publish ours. Waypoint runs the same baseline on its own tenant, and posts the state of those controls rather than describing them.
It also lists what has not been earned. Waypoint holds no SOC 2 or ISO 27001 today; both are on the roadmap and will appear when they are real. Everything we do claim links to the issuing authority.
Same baseline. Same checks. Same standard we hold you to.
The product is the same in both. What changes is whose name is on the invoice and whose relationship the client belongs to.
A client questionnaire is holding up a signature. An insurer wants to know what you attested to. An auditor wants the artifact, not the policy. Waypoint gets the tenant right, keeps it right, and keeps the proof current, so those requests stop being fire drills.
Building this practice in-house means specialist hiring, engineering time, monitoring, reporting and permanent maintenance. WaypointX is the same operating model at wholesale, under your brand, standardized across every tenant you run. Waypoint operates the security layer. The client stays yours.
WaypointX reports the technical state of a tenant. It cannot supply the judgment that state requires: which exceptions are acceptable and for how long, how risk gets described to a board, what an auditor is given, which vendor dependency is a real problem.
That is what the Govern tier buys. Not consulting hours. A named executive who owns the risk register, runs the program on a cadence, and sits opposite the auditor and the insurer.
Software can report risk. It cannot accept it.
Structure shown. Entries are generic, not client records.
Published so the economics are settled before anyone spends a meeting on them. Per Microsoft 365 tenant. Baseline is a one-time fee. Monitor and Govern are monthly.
The tenant configured correctly and documented as issued. A starting position, not a finished program: this level does not watch what happens next.
Where the configuration has to stay correct after week one, and the proof has to be current whenever somebody asks for it.
Where somebody has to sign. A named executive answering to a board, an auditor, a regulator or a major client.
These are direct rates. MSPs buy at wholesale through the partner program and set their own client pricing.
Notes on where this market is wrong, and why controls fail in practice rather than in theory. Claims in these notes are cited to primary sources. Where a source could not be verified, the claim was cut rather than softened.
We publish what we can defend.
Read Waypoint ResearchFive parties, five different questions, one underlying requirement: show what is actually true, and show it now. Proof should not begin when the questionnaire arrives.
An engineer reads the tenant before anyone sells you anything: where your controls stand against the baseline, which gaps matter first, where proof is missing, and what we would do in the first thirty days. If you are in reasonable shape, we will tell you that.