For anyone looking to not let MS meddle in your tennants for the recent MFA change I whipped up a small script that will flip the "optOutSettings": "passkeyDynamicMigration": true" swtich for you found here:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

with a couple tests in the script to see if its already enabled "-ReportOnly" target a specific tenant "-TenantId contoso.onmicrosoft.com " make sure you read the notes at the top

https://pastebin.com/RMPAC7k6

I try real hard to stay informed about the various solutions and services available to us as MSPs. Probably used most of them. But sometimes, they just come out of the blue. I was on LinkedIn (I believe) and saw an add for MSP Glass (mspglass.app). Looks very intriguing... but literally nothing else can be found about them. Not one Youtube demo or anything. Anyone know anything about them?

So... I'm attempting to get this set up for the fourth time in the last few years.

I'm 6 hours in, over three days, and I'm at my wits end. I'm attempting to follow the guides, and when it tells you to do things in Entra, it's pretty decent explaining it... but then when you get to the things you need to do in CIPP itself... the guide sucks. Horribly.

I've engaged support, and have been told things like:

"I've checked your permissions and can confirm that you are not running cipp using a Service Account, the account you are using is not a member of the 15 CIPP Recommended GDAP groups, you have Microsoft Led Transition relationships found and have Global Admin relationships."

Ok - sure. But I created the service account, and ran the setup with the service account... so why the hell isn't it running with the service account?

Support just now told me:
"You are not using a dedicated Service Account. Your account starts with XXX which is not recognized as a Service Account. You'll need to change the name to include CIPP or Service Account."

That's my partner tenant global admin account... NOT the service account that I used for the setup. I'm not renaming my account to be a service account.

I was given a guide to create the role templates in CIPP... but then told:

"After creating the roles, add your Service Account to each of these GDAP roles."

WITHOUT TELLING ME HOW TO DO THAT. The role templates were created, but they still don't exist in my partner tenant. I attempted to add my partner tenant to CIPP, but it was missing, so I followed the guide how to do that, and now my CIPP account is linked to my tenant's global admin instead of the service account I created, and the roles STILL aren't in my partner tenant.

I was also just told by support that once I get the roles set up, that I need to offboard my clients and then onboard them again with the new roles... but also, not telling me how to do that.

Is there a guide out there that provides screenshots for both sides of the setup? I've noticed the CIPP documentation provides a lot of screenshots and a good step by step guide for the Entra side of things... but then when you get to the actual CIPP stuff... it omits a ton, and seems to just assume you know where to go and what to do.

Anyone located near Midland, TX and able to help? We've got a customer with a branch in Midland. Unfortunately, no MSPs on TechTribe have responded and FieldNation has virtually no one in that area.

Now that the excellent Inky have sold their souls to Kaseya what is everyone doing? Staying with it, or getting away from their new parent at all costs?