Third-Party Conditional Access Alternative for SMBs Priced Out of Microsoft Entra Premium
MSPs are loudly frustrated that Microsoft locks Conditional Access behind Entra ID P1/P2 ($6-9/user/month), forcing small businesses to choose between Security Defaults (inadequate, no granular MFA/location/device rules) or paying $22/user for Business Premium. A recent r/msp thread hit 349 upvotes with 153 comments in two days... MSPs want a third-party policy layer that sits on top of Entra Basic or Google Workspace and gives them CA-equivalent rules (block legacy auth, require compliant device, country-block, risk-based MFA prompts) for SMB price points. This is specifically an MSP channel play.
MSP channel play. Do not try to go direct-to-SMB... MSPs buy this and resell. Price per-tenant, not per-user, because that's how MSPs price. And you need a multi-tenant admin UX from day one or r/msp will eat you alive. The moat is the Entra sign-in log parser plus a conditional reverse-proxy or token-exchange hop, neither of which Microsoft documents well... which is also your defense.
landscape (6 existing solutions)
Every MSP-adjacent vendor is either a full IdP swap (huge migration), a detection layer (not preventive), or still selling on top of CA rather than replacing it. The white space is a policy enforcement shim that reads Entra sign-in logs, blocks/challenges at the session layer via a conditional token broker, and gives MSPs one pane for 50 tenants. Hard product... hot channel demand.