Fence
Identity threat detection and response for Microsoft 365. Fence watches the tenant of every client you manage, tells a real account takeover from an employee on a business trip, and locks the attacker out automatically, then shows you how they got in, what they touched and what was done about it.
Incidents
Auto-contain onRemediateWhy Fence is sure
Response
A managed platform run by Tech911. Contact us for pricing and availability for your clients’ tenants.
Catch the account takeover, not the business trip
Attackers now sign in through home internet connections in the victim’s own city, so rules based on location miss them and bury you in false alarms. Fence judges what a session does after it signs in, and raises the alarm only when the evidence says an attacker is in.
Account takeover detection
Stolen session cookies replayed from a second network, sign-ins from hosting providers and proxies, device code phishing, password spray and MFA fatigue, each judged against that user’s own history.
Persistence found and removed
Hidden inbox rules, forwarding to outside addresses, rogue app consents, and the MFA methods and devices an attacker registers so they can come back after a password reset.
Automatic containment
On a confirmed compromise, Fence revokes the sessions, blocks the sign-in and disables what the attacker set up, verifies each step, and blocks the account again if directory sync turns it back on.
One-click remediation
Everything else is one click from the incident: reset the password, pull the phishing email out of every mailbox it reached, restore mail the attacker deleted and remove malicious app access.
The full story of every incident
A timeline from the phishing email to the last action taken, the signals behind the verdict, and what the attacker read, sent or deleted, written up in plain English you can share with the client.
Six months of history on day one
Connecting a client starts a scan of the last 180 days, so an attacker who got in before you arrived, and the rules and apps they left behind, are found rather than inherited.
No agents, no appliances, watching from the first day
Connect the tenant
A client administrator approves the Fence app in Microsoft 365. Fence turns on the audit logging it needs and checks which detections the client’s licenses support.
Look back, then learn
Fence reads six months of history for anything already wrong, then learns each user’s normal sign-ins, devices and office addresses. While it learns, only confirmed attacks interrupt you.
Detect, contain, report
When an attacker gets in, Fence decides from the evidence, contains the account if you have switched that on, alerts your on-call technician and opens the ticket, then writes up the incident.
What’s included
- Monitoring of sign-in, mailbox, SharePoint, OneDrive and Teams activity in every client’s Microsoft 365 tenant
- Detection of account takeover, token theft, malicious app consents, hidden inbox rules and forwarding, attacker-added MFA methods and devices, password spray, MFA fatigue, and tenant tampering such as new inbound connectors and transport rules
- Works on Business Basic, Standard and Premium as well as E3 and E5, with extra signals where the license provides them
- Automatic containment for confirmed compromises, switched on per client, with a simulate mode, protected break-glass accounts, approval for VIPs and an undo for every reversible action
- One-click password reset, phishing retraction, recovery of deleted mail, and removal of malicious app access, inbound connectors and transport rules
- A six-month historical scan when each client is connected
- Alerts by email, Microsoft Teams, Slack, text message, phone call down an on-call list and webhook, plus tickets in ConnectWise, Autotask and HaloPSA
- Incident, monthly and scan reports as PDFs, with an AI-written incident summary in plain English
- Metadata only: Fence never stores the body of anyone’s email
- Hosted and run by Tech911
For the MSP running this
- Multi-tenant throughout: every client’s tenant in one console, kept apart all the way down to the database, with roles from responder to read-only and access limited to the clients each technician looks after.
- An attack on one client protects the rest: the addresses, phishing senders and malicious apps from any confirmed incident count against them at every other client, shared as indicators only, never as client data.
- Reporting you can hand over: an incident report showing what the attacker read, sent or deleted, and what they never touched, plus a monthly report for every client.
- A scan that opens doors: run the six-month scan on a prospect’s tenant and walk them through what it finds.
- Monthly, per user: no minimum count, no annual commitment, and no repricing once your clients are onboarded.
- We do the onboarding: we connect each tenant with you and start it in simulate mode, so you see what Fence would have done before it acts on its own.
- Your data stays yours: incident history and reports are exportable if you leave, and disconnecting a client deletes its data, with instructions for removing the app from the tenant.
Where it fits
eWall stops phishing before it reaches the mailbox, ThreatKeeper keeps unknown code off the endpoint, and OfficeSafe brings back what was lost. Fence covers the attacker who signs in anyway, with a stolen password or session. Each runs on its own.
What it costs you per user
An attacker inside a client’s mailbox is the incident every MSP dreads, and Microsoft’s own automatic detection and disruption of account takeover needs higher-tier licenses than most small businesses buy. That gap is why account takeover protection has become a line item MSPs sell rather than absorb. Fence is monthly per user at a fraction of the established ITDR platforms, so the margin on that line stays with you.
Put a fence around every tenant you manage
Tell us about your clients’ Microsoft 365 tenants and we will get their accounts protected.