Operations you can read, on a schedule you can plan around.

Microsoft 365, Azure, identity, endpoint, and security run as a service — with a transparent SLA, a published engagement cadence, and a shift board that's the same artefact your team sees as ours. No black box.

Request a service review Customer stories

Managed · live shift

On shift

24 × 7

India delivery · paged

P1 · 15m

P2 · 1h

P3 · 4h

P4 · 1d

service.posture.ts

What's under management

1 export const managedSurfaces = {

2 identity: ['Entra ID', 'Conditional Access', 'PIM'],

3 collab: ['Exchange Online', 'Teams', 'SharePoint'],

4 endpoint: ['Intune', 'Defender for Endpoint', 'Sophos'],

5 cloud: ['Azure governance', 'cost guardrails', 'monitor'],

6 signal: ['Sentinel', 'Defender XDR', 'service health'],

7 }

What we keep seeing

The MSP only shows up when something's on fire.

Four patterns we see in tenants moving off an opaque MSP — or running unmanaged and feeling the strain.

01
Opaque queue, opaque response
Tickets go in. Replies come out. Nobody internally knows what's open, who's working it, or when an answer is due. Status updates are an act of asking.
02
SLA in the MSA, not in the day
The contract names response times. The day doesn't reflect them. Sev 2 incidents wait a day; Sev 3s wait a week. Targets are aspirational.
03
No rhythm beyond the incident
The only time the MSP is visible is during an outage. There's no weekly review, no monthly report, no quarterly business review. The relationship is reactive.
04
Tribal knowledge inside the MSP
The MSP knows the tenant. The customer doesn't. If the MSP relationship ends, the runbooks, configs, and decisions leave with them.

Live state

The board your team sees is the board we work from.

A snapshot of an active shift. Same columns, same fields, same severity language as the live console. Illustrative here; in your tenant it refreshes in real time and your IT lead has the same login as our shift lead.

Snapshot · illustrative · production board refreshes every 30 s

Shift Lead

Asha N.

IST 09:00–18:00

L2 Engineer

Vikram S.

IST 09:00–18:00

L2 Engineer

Priya R.

IST 14:00–23:00

On-call (Sev 1)

Rohan M.

IST 22:00–07:00

ID	Subject	Sev	State	Owner	Age
INC-2447	Conditional Access regression hitting finance OU	Sev 2	in-progress	Foetron · Asha N.	00:14
INC-2446	Intune device sync failing for 14 macOS endpoints	Sev 3	ack	Foetron · Vikram S.	01:22
INC-2443	Exchange Online quarantine review backlog (43 items)	Sev 3	in-progress	Foetron · Priya R.	02:05
REQ-1881	New starter onboarding — 6 users · marketing team	Sev 4	open	Foetron · queue	00:42
INC-2441	Awaiting customer change-board approval for FW rule	Sev 3	blocked	Customer · CAB	1d 03:11
REQ-1879	Defender XDR alert review — non-actionable, archiving	Sev 4	ack	Foetron · Vikram S.	00:08

Blocked items are visible. Owners are named. Ages run in real time. There's nowhere for a ticket to hide.

Response rhythm

Four severities. Four commitments. Both sides agree.

Severity is assigned by impact, not by panic. Each tier has a response target, an update cadence, and an escalation path. These are the same numbers your portal measures us against.

Severity

Definition

Response

Updates

Escalation

Sev 1

Definition

Production outage affecting all users of a critical service · ransomware or active security incident · identity provider compromise.

Response

≤ 15 min · 24×7

Updates

Every 30 min until path to resolution agreed

Escalation

Auto-page exec sponsor at 60 min if unresolved

Sev 2

Definition

Significant degradation for a subset of users · workaround exists but is painful · time-sensitive regulatory or financial deadline at risk.

Response

≤ 1 h · business hours; ≤ 4 h out-of-hours

Updates

Every 2 h during business hours

Escalation

Manual escalation to senior engineer at 4 h

Sev 3

Definition

Standard incident · single-user or non-critical service · workaround available · no immediate business impact.

Response

≤ 4 business h

Updates

Daily until closed

Escalation

Surfaced in weekly review if open > 5 business days

Sev 4

Definition

Standard request · onboarding, access change, planned configuration update, alert review.

Response

≤ 1 business day

Updates

On state change

Escalation

Reviewed in monthly report if SLA breached

Severity is a conversation, not a verdict. If we disagree on assignment, the customer call wins; we document the rationale.

What we don't do

We don't run an MSP black box. The board is shared, the SLA is measurable, and the rhythm is published before the quarter starts.

If you can't see what we're working on, we've already failed the relationship.

Engagement motion

Calendar over inbox. Rhythm over reaction.

Four cadences — daily, weekly, monthly, quarterly. Each has a purpose, the same attendees each time, and an artefact that lives outside the meeting.

Daily

Ops standup

Attendees

Foetron shift lead · Customer IT lead (optional)

Purpose

Walk the active queue, agree priorities for the day, surface anything blocked on customer input.

Artefact

Standup notes posted to shared channel within 30 min

Weekly

Service review

Attendees

Foetron account lead · Customer IT lead · L2 representative

Purpose

Review the week's incidents, SLA adherence, change-board items, and upcoming work. Decide what slips, what holds.

Artefact

Weekly review summary + updated forward plan

Monthly

Service report

Attendees

Foetron account lead · Customer IT director

Purpose

Quantified report: ticket volumes, SLA performance, change-window adherence, capacity headroom, security posture deltas.

Artefact

Monthly service report (PDF + portal dashboard)

Quarterly

Business review

Attendees

Foetron account lead + delivery lead · Customer exec sponsor + IT director

Purpose

Strategic review: posture vs roadmap, planned investments, risk register, contract performance, mutual feedback.

Artefact

QBR deck + signed-off action list with owners

Skipped beats are reported, not hidden. Cancellations require an exec-sponsor note.

Recent managed services work

Off an opaque MSP, onto a shared board, inside one quarter.

One representative engagement. Customer name held back; outcomes signed off by their CIO.

Mid-market professional services · India

Cut Sev 2 average response from 7 h to 38 min — by changing the operating model, not by adding bodies.

Customer was on a fixed-price MSP contract with no shared visibility. We took over the Microsoft estate in a structured 60-day transition: published the shift board, agreed the response-rhythm tiers with their IT director, calendared the engagement motion 12 months out. Within one quarter the customer's IT team had real-time visibility into every ticket, knew exactly when each ceremony was, and started treating us as an extension of their team rather than a vendor.

Sev 2 average response: 7 h → 38 min in 90 days
SLA adherence: 64% → 97% over 2 quarters
Customer-perceived 'no surprises' score: 4 → 9 (out of 10)
Zero missed weekly reviews or monthly reports across the engagement
Customer renewed at 12 months without going to market

Next step

Request a service review.

We'll spend a session reading your current support model, mapping it to a transparent SLA and engagement motion, and proposing a 60-day transition plan. No deck, no lock-in language.

Book the review Read customer stories