Managed AI Moves Upstream
Before the first fact, a disclosure. Many of the companies in this episode sponsor this show or have in the past. I own Small Biz Thoughts and IT Service Provider University, which compete with GTIA for MSPs’ community and education. I do better when MSPs rely on independent sources instead of vendor-led ones, and this episode leans that way. I also know Rob Rae, who chairs the alliance you’re about to hear about, and GTIA’s CEO, Dan Wensley, personally. So I’m reporting on a market I compete in. Discount my conclusion if you like; the facts are sourced and linked. As always, our sponsors and my financial disclosures are at businessof.tech.
The pieces of managed AI are being assembled, and most of them sit upstream of the MSP.
Start with Pax8. At its Beyond EMEA conference in Copenhagen, the distributor launched 8os, which it describes as an operating system for IT providers to govern the AI agents running inside their customers’ businesses. It’s built on the marketplace more than 47,000 IT providers already use to sell to around 800,000 small businesses. Partner and client identities carry over from that marketplace. Agents and models from different vendors are managed together as one workforce, and the partner sets the rules client by client. Usage and spending are metered per user and per customer, with hard caps that cut consumption off. The partner sets the price, and billing runs through the Pax8 account it already has. Alongside it comes 8bot, a managed AI coworker that partners deploy and supervise through 8os. Limited early access is open, with general availability planned for early 2027.
Now look at who is writing the rules for that kind of service. GTIA, the channel trade association, launched the Managed Intelligence Alliance to build standards, open specifications and accreditation for managed AI. Pax8 is its charter member. GTIA’s CEO, Dan Wensley, told CRN the idea came from Pax8. In his words, “Pax8 brought it to us, and we stood it up.” It’s chaired by Rob Rae, Pax8’s corporate vice president of community and ecosystems, who also sits on GTIA’s board.
It isn’t only distributors. GoTo added an open-beta Model Context Protocol connector to LogMeIn Resolve, its remote support platform for MSPs. It lets a technician query Resolve and take supported actions through Anthropic’s Claude without opening the console. GoTo says existing account permissions stay in force, activity is logged, and changes can require confirmation.
In plain terms, the identity, the rules, the meter and the bill for client AI are all being built into platforms the MSP subscribes to. The standard that will define what good looks like is being chaired from inside one of them.
That’s where the control point is going. The question is what it’s made of.
One Vendor Key, 173 Tenants
Kaseya’s own survey of more than 1,100 MSPs and IT professionals found that 68 percent rank human error as the biggest threat to their organizations. The incident at the center of this episode didn’t need anyone at an MSP or a client to make a mistake. It needed one credential.
ConnectWise Cloud Backup, formerly SkyKick, backs up clients’ Microsoft 365 data for MSPs. To do that job, it’s consented into every tenant where it’s installed, with broad access to mailboxes, OneDrive, SharePoint, Teams and the directory. The credential behind that consent lives with ConnectWise, not with the MSP or the client. It’s a master key to every client’s office, kept at the locksmith’s shop. Huntress found that credential used to sign in to 173 tenants in a little over two hours, moving through them in sorted order, seconds apart. That’s a script working from a list. Microsoft called it an active supply chain attack on a trusted app.
That’s the first property of upstream control: consent is given once, and the access stands. It also sits outside the controls MSPs watch. Todyl found that revoking user sessions doesn’t end it, and Huntress noted that some directory reads leave no audit trail.
The second property is that one key can make others. In at least one partner tenant, Huntress found a second ConnectWise app gave itself Global Administrator. It then added new secrets to an MSP management app and to Huntress’s own security app. MSP management apps are often consented into the MSP’s client tenants too, so access to the MSP’s tenant is a path to the rest. Guardz, which sponsors this show and sells identity threat detection, counts seven privileged ConnectWise apps in Microsoft 365, so the exposure isn’t limited to the credential that leaked. It also warns that Entra log retention can be as short as seven days.
The third property is that the off switch belongs to the vendor too. ConnectWise shut off Cloud Backup, its SaaS security and its cloud management services while it investigates, and says it has found no evidence that partner backup data was compromised. Every partner’s service stopped together. As of October 18, it was still down: clients couldn’t back up, open their archives or restore. Any tenant where the app stays enabled stays exposed until ConnectWise rotates the credential.
In plain terms, a platform that holds standing access in every tenant doesn’t fail one client at a time. It fails all at once, and from the top.
And the number of identities like that is set to grow.
AI Agents Multiply the Keys
For an MSP, this lands on every client you put AI in front of. Each agent is another identity holding standing access, and someone has to answer for it.
Start with what organizations can see. JumpCloud, which sells identity management, surveyed 250 IT leaders in the US and UK. Fifty-nine percent of organizations using AI agents haven’t fully brought them under their identity and access policies. Seventy-two percent report a significant gap between what their AI systems are permitted to access and what they can verify those systems actually accessed. And 36 percent had investigated an AI-related concern and couldn’t determine what the AI had touched. Those are organizations with IT leaders. The small businesses MSPs serve mostly have the MSP.
Now look at where the keys end up. OpenCode, an AI coding tool, disclosed unauthorized access to a legacy system it was already preparing to shut down. Third-party keys that users had stored in their workspaces, including keys for OpenAI and Anthropic, may have been exposed. Its instruction to affected users was to revoke and replace each key at each provider. The keys belonged to the users, and so did the cleanup.
Put those together and the consequence is plain. Managed AI adds a privileged identity to every client tenant you deploy it in, and the credential for that identity lives somewhere other than the tenant. When it goes wrong, the client won’t call the platform. They’ll call you, and they’ll ask what the agent accessed. You may not have the logs to answer.
So here’s the choice. Treat any upstream AI governance layer as what it is: a privileged vendor identity in every client tenant. Before the first agent runs, get its consent scope and who holds the credential in writing, turn on the logs that show it acting, and make sure you can disable it in each tenant yourself, without waiting on the vendor. Or adopt it as a marketplace feature, and accept that every client’s AI control point sits with a vendor whose breach becomes yours, everywhere, on the same morning.
Before you make that choice, the platform deserves its best argument.
Because the strongest objection is a fair one: a distributor’s platform has a security team your ten-person shop will never have, and centralizing governance is how small MSPs get controls they couldn’t build. ConnectWise had a security team too. What failed was standing consent that nobody downstream could watch, and that only the vendor could fix, because the credential lived with the vendor. Use the platform if it’s better, but know which of your tenants it’s in, keep the logs, and make sure you can switch it off in every one of them yourself.
What to Consider
- Inventory consented apps, starting with your own tenant. List every enterprise app with standing access in each tenant: who published it, what it’s permitted to touch, and whether anyone still uses it. Do your own tenant first, because your management tools reach every client from there. The MSPs who moved fastest on ConnectWise were the ones who already knew which tenants had which apps.
- Turn on the logs and keep them past the default. Enable service-principal sign-in and Graph activity logging in each tenant, and export it somewhere you control. Entra retention can be as short as seven days. Without your own copy, “what did the app access” is a question only the vendor can answer.
- Rehearse the brake before you need it. Script the per-tenant disable for every privileged vendor app, and confirm you hold the admin role to run it in each client. Microsoft’s automatic location and risk blocking doesn’t cover third-party multi-tenant apps, and already-issued tokens outlive a disable by up to 90 minutes,
so this brake is manual and has to be fast. Disabling an app also doesn’t remove credentials an attacker already added, so check every app’s credentials, not just the vendor’s. - Ask any AI governance platform the same three things in writing before you deploy it: what it’s consented to per tenant, whose tenant holds its credential, and how you’ll be told when that credential rotates.
If this trend continues: Distributor-run AI governance reaches general availability in early 2027, with the alliance’s standards close behind. My bet is that the MSPs keeping their own per-tenant brake on those platforms will be the ones clients still trust after the next vendor incident. If partners adopt without it and nothing breaks, I’m wrong, and the first place I’ll find out is in where MSPs choose to spend their community and education time.