Systemagic, a UK MSP serving SMBs across hospitality, media production, education, healthcare and charities, used inforcer to standardize Microsoft 365 security across more than 160 tenants. Before inforcer, the business had no baseline, so every tenant could be configured differently depending on the engineer involved. Systemagic piloted an NCSC-recommended baseline on a small group of customers, confirmed it held up, then rolled it out across its full base. The takeaway: a small pilot group is the lowest-risk way to prove a baseline before a full rollout.
Systemagic
Offices in UK
To ensure that the Microsoft 365 environments they manage are fully secure, Systemagic was seeking greater visibility into its customers’ security posture. Before inforcer, they did not have a baseline in place, meaning security was not standardized across their customer base. Every tenant could have been set up differently depending on the engineer who configured it, leading to potential security vulnerabilities or mishaps. It was challenging to keep up with the latest security needs, especially as new features were added to Microsoft 365.
Systemagic was looking for a better way to manage their Microsoft 365 tenants at scale, while reducing support tickets and incidents by proactively pushing out security policies
Technical Lead
inforcer enabled Systemagic to manage all tenants from a single, centralized platform. Through NCSC-recommended baselines, they created standardised configurations to ensure every customer aligned with their optimal security standards, while still allowing for controlled deviations where needed. The process of configuring Microsoft 365 tenants became much faster.
After initially trialling inforcer with a small group, Systemagic quickly recognised the need for full visibility and standardisation across all tenants. With a smooth onboarding experience and immediate impact from multi-tenant management, they rapidly expanded adoption across their entire customer base.
Following successful implementation, Systemagic ran an opt-out campaign for their customers via email, explaining the benefits Systemagic can bring to their security posture using inforcer. They saw an extremely positive reaction from their customer base which reaffirmed their decision to roll out inforcer across over 160 tenants. Committed to delivering the best security for their customers, Systemagic used inforcer to gain greater visibility and control across Microsoft 365 environments.
Technical Lead
Systemagic now have far greater control over their customers’ security. They can easily configure and apply baselines to their customers’ tenants at scale, without having to log in to multiple portals, or expend time on repetitive manual tasks. This is especially useful when they need to review and apply changes, as they can edit their baseline once and rollout across their customers.
Inforcer’s reporting function allows Systemagic to clearly demonstrate how they are looking after customers’ tenants. Reports show customers the policies applied via the baseline as well as any deviations, allowing them to review any exceptions and see if they are still needed.
Systemagic's confidence in inforcer's capabilities and the benefits the platform brings to internal staff and end-user customers saw them roll out the solution across their customers after starting with just a small number. As they continue to onboard more customers, they are using inforcer to manage their tenants by default.
Systemagic is a UK-based MSP, specializing in supporting SMBs, with diverse client base, ranging from the hospitality sector, media production, education, healthcare, and charities. They are a Microsoft Modern Work Solutions Partner and were the Channel Partners MSP 501 2025 Winner.
We help MSPs turn Microsoft 365 policy management into a scalable security service.
Microsoft is always updating its security controls, policies, and features. Just because a tenant was configured correctly last month doesn’t mean it's secure today.
We make it easy to catch and correct potential drift across all of your clients before it becomes a security or compliance liability.
For Systemagic, inforcer covered NCSC-recommended baseline configuration and deployment across more than 160 Microsoft 365 tenants, with controlled deviations where a customer needs them. The page describes the baseline generically and does not name individual Microsoft workloads. The tenant count and the pilot-then-scale rollout are specific to Systemagic and not guaranteed elsewhere.
Systemagic has rolled inforcer out across more than 160 Microsoft 365 tenants. The UK MSP, which supports SMBs in hospitality, media production, education, healthcare and charities, started by testing the baseline on a small group of customers before extending it to every tenant it manages.
Systemagic had no baseline in place, so every customer tenant could be configured differently depending on which engineer set it up, creating inconsistent security and blind spots in visibility. Keeping pace with new Microsoft 365 features across every customer added to the problem, alongside staff repeating manual tasks across multiple portals.
Systemagic standardizes its customer tenants against NCSC-recommended baselines in inforcer, while still allowing controlled deviations where a customer genuinely needs them. That gives every tenant the same starting security posture instead of leaving configuration to whichever engineer happened to set it up, closing the gaps that inconsistent setups had created.
Technical Lead Jon Candy says Systemagic began with a selection of customers to confirm the solution genuinely delivered on its promise to keep them secure. Once implementation proved straightforward and customers understood its value, extending the same protection across every Microsoft 365 tenant the MSP manages became, in his words, a no-brainer.
No. Before inforcer, Systemagic had to log in to multiple portals and repeat the same manual configuration tasks for each tenant. inforcer gave the MSP one centralized platform to configure and apply baselines across its full customer base, removing the repetitive per-portal work that came with securing each tenant individually.