inforcer Product Roadmap: Q4 2026

Hello everyone. Welcome to our quarterly roadmap update. Thank you so much for joining. We do this every quarter, where we give a quick recap of all the things we've done with inforcer, give you a view of what's to come and what we're working on, and give you a chance to ask us questions. 

It's going to be a good session. There's a lot to talk about. We have an hour. We have two people here from the product team. I'm Matthé, Chief Product Officer, and we have George, Principal Product Manager. You probably know him from all the videos that we produce when we release new things. 

Today, we're going to cover a lot of different things. I would love to hear your feedback and your questions. Please use the chat and the Q&A at your disposal. We'd love to hear if you think it's a good idea, if it's a bad idea, and what else you're missing. We might not be able to get to all the questions today, but we would love to hear from you and make it a bit more interactive if possible. 

With that said, let's get started. There's so much to talk about. I'm really excited. We have been doing so much with the product team and the engineering team. It's been a fabulous year so far. For those of you who have been with us this year, I hope you enjoy all these releases and updates that we're doing. The product looks a lot different today than it looked at the beginning of the year. 

Of course, there are people out there who don't live their life around inforcer. Today, we'll give you an update on what you've missed. All jokes aside, I know everybody's very busy, and I want to make sure you also know what you missed if you don't think about inforcer every day like we do. 

To start off with, what are we trying to build? What is it that we are doing with the inforcer team? The way we see it is we're building this Microsoft 365 platform for you. One platform, so you don't need a lot of other point solutions in addition to Microsoft 365. 

For Microsoft 365, our mission is to secure every single layer and help you do that for all your customers. Secure the tenant, secure all the identities in that tenant, secure the devices, secure the data, and everything that resides in that tenant, which for many businesses is everything. Our job is to help you secure that and make sure that, in today's scary age, it's all handled perfectly. 

That includes things like policy management, but the outcome that we want is to help you secure it. We also want to help MSPs standardize on Microsoft 365. We see people buy Microsoft 365, but then a whole bunch of tools on top of that: endpoint management, endpoint security, email management, and many others. We think we can unlock the value of Microsoft in a different way, so you don't need all these other point solutions. 

Our job is also to help you launch new services. Copilot, data management, or other things: how do we unlock that for you so you can take that to your customers and manage it at scale? That's a pretty bold, big mission, but when you look at what we've done and what we're working on, we're definitely marching in that direction. 

Today, we'll start with how we are building out the inforcer platform. Then we'll move to how we help you secure the tenant, all the policy management and other things that we're doing there. Then we'll talk about how we help you manage and secure users, manage devices, the data side, reporting, and threat detection and response, TDR, our newest product. For each, we'll talk about things that we've done and things that are upcoming. We'll do a few demos today as well. 

We've done a lot of work on building out this platform in the last couple of months. Granular enterprise app permissions went out around September. Granular app permissions and workload identity federations are a way to secure or control what you ask for for each tenant that you manage. 

There are customers out there that might only get a part of your service. Perhaps you only do management for Intune or identities. You might not need to ask for everything else. We had a pretty far-reaching request previously, and now you can tailor that to your exact need. With the new enterprise app permission template, you can ask for whatever you want, see exactly what Graph and other permissions we're asking for, and tune it in a way that you're comfortable with. 

As part of this change, one of the things we've done is introduce secretless authentication called workload identity federation. This is a way for us to reduce the risk of a supply chain attack and do this in the most modern way possible. inforcer only holds an identity. We don't hold any of your secrets. We say, 'Here's inforcer. Can we get access to this tenant?' You grant us permission, and you can revoke that permission if you ever want to do that. 

There's no renewal required of the certificate or the secret. It's a very nice way of authenticating. Every single time you refresh a tenant right now, we suggest you move to that model. The secret-based model is still there and is going to work, but it's really good hygiene to move to that kind of model. 

For our US-centric customers, we're moving to the GCC High Cloud, which is the governmental cloud. There's going to be an inforcer for that, so you can also secure those high-security tenants in the secure enclave there. 

One of the most exciting things is how we open up the platform to other things that you need to do. The API strategy is a big part of that, and so is an MCP way of asking for the data. Model Context Protocol is a way of integrating inforcer into your AI agents, whatever you're doing. 

We are building an MCP capability sitting on top of our new REST API. We just launched our new API. With MCP, you can access any piece of data, the policies and the users, and you can control that and use it in Copilot, Claude, or anything else. It's really powerful. 

We are working towards an inforcer where you might not even use the UI anymore. Everything is going to be available in APIs. It's going to take us a bit of time, but when you look at how the world is moving, it could be a real reality that you do a lot of work in the next couple of years with agents and don't even log into our UI all the time. We would still want to be that secure access layer to all your data, and MCP is going to help you a lot with that. 

We released custom role-based access controls a couple of months ago. You can now fine-tune exactly what people are allowed to do and where in inforcer. It's a highly requested feature from many of our largest customers because it opens you up to adding a lot more people into inforcer. 

We recently launched V1 of the REST API. We had an API for a year, and we've now added a new API with a new authentication method, OAuth, which opens the door for us to do a lot more read-write in the API. One of the next upcoming things is being able to manage Entra ID users through the API. We want you to use the new, more secure OAuth method. 

We're also making our Partner Center Manager better. GDAP management is going to get a significant boost. GDAP management is complicated, managing roles and templates for all these tenants, and we're doing a significant upgrade there pretty soon. 

We kick off with something that I've been itching to do for a couple of years now, and that is auto-remediation of policies. When we first approached this problem, the technical scope of the challenge was a little too high. There's been some awesome work done on optimizing how we read and write policies to make this possible. 

For a policy that is already in a known good state, if it's aligned in your baseline or if you have an accepted deviation and it's in the state you want it to be in, you can click a lock button that captures exactly how that policy configuration is. We will then monitor it for changes. 

For a bunch of policies, especially Azure and Intune, we can directly read audit logs on the Microsoft side. Every 10 minutes, we'll be able to check if there is a policy change and revert it back. Some other policies are a little too taxing to keep polling through the audit log, so we'll be adding more policies into a more frequent check, but at least you'll have a daily reversion. 

Anything you might want to change from inforcer can also override the lock, so you don't have to find it, pause the lock, make a change in inforcer, and then re-enable the lock. This is a new end destination for inforcer: not just 100% alignment, but 100% aligned and policies locked in so they can't drift. 

Next up, we have plans to do a new layer of enterprise app management. In Microsoft 365, there are some really core objects. Users and groups we already do very well, and devices we'll mention again before the end of this webinar. Enterprise apps are such a key part of how the Microsoft 365 ecosystem works, especially when it comes to things like single sign-on. 

The number of enterprise app requests that come pouring in means it's about time you had a centralized way to review and understand what the impacts will be. The aim is to identify risky apps and handle them in a multi-tenant way. For example, the enterprise app for your OneDrive backup service should be something you can view holistically, see which tenants have it and which ones don't, and put it on your allow list. When an imitation enterprise app comes along pretending to be your backup tool, you can see that it is not the same publisher or the same enterprise app and prevent it. 

We've also improved similar policy calculations. If a policy is not the same, it now gets a much lower score. If it is the same, it gets a much higher score, and the whole UI is better. When you're trying to deploy a policy that requires a certain service principal, we can now sort that out for you. Tick a box and any missing service principals get deployed. We are also continuing to add policies and settings, including the agent identity blueprints control, where you can decide whether users can create agent blueprints by default. 

The holiday mode is a fine-tuned upgrade to temporary pauses on conditional access, and it adds a layer of security. We're not just making an exception. We are putting that user into an alternative conditional access policy. 

Let's take an example. We go over to a tenant and the users list. We've got a request that Annie is going off on a trip. We come up to scheduled exclusions and use holiday mode, this new advanced version. Annie's not going alone. Fred is also on the trip. They're off to Zambia for two weeks. 

Instead of the previous mode, which is still an option, where we would just exclude them from conditional access, we are now going in and creating a dedicated, temporary travel policy. We copy all of the existing conditional access that they would usually be subject to and add those new destination countries to the new named location. 

The engineers went one extra step to manage things like out of office. Maybe they're off on a sabbatical and we need Carol to pick up their emails. We'll forward emails to Carol. If the same settings apply, press the copy settings button, and Fred will also have the same out of office and email forwarding. 

You can see how much is being automated on your behalf. How often have you opened the door for someone to access for a short period of time upon their request and sat there thinking, 'Did I ever reclose that hole in our conditional access?' This should give you peace of mind and confidence. It has a comprehensive overview of what's happening as well. Check out the activity tab and you see each one of those steps happening in real time. If you cancel it, you get to see in real time as these steps get undone. 

We also did a bunch of other things around user management. We've got scheduled user onboarding and offboarding. We've got much more granular MFA controls now as well, especially if you ever need to create a temporary access pass, straight from inforcer. You don't have to hop around to different Entra portals. 

We are bringing Exchange actions into the central user management toolkit. There is also the need to handle both on-premises and cloud-first environments. We'll be doing an extra layer of detection to know whether it is a cloud source of authority or an Active Directory source of authority and make sure you don't accidentally try to make changes that will get reverted in a few hours or days. 

We've done a lot around Intune app management in collaboration with an awesome company called Devicey. You can upload IntuneWin files directly into inforcer and use inforcer as a central repository to push out apps to all your tenants. 

If you've got a standard set of MSP tools, things like your RMM, backup agents, or networking agents, this is free for everyone. Package those apps once, put them into a central repository, and push them out to all your customers' Intune environments. 

If you're looking to do a more end-to-end software management service, you're going to need apps for all of the standard software, Chrome, Java, and Adobe Reader. That becomes much easier with the affordable app-management add-on, which gives you a catalog. In the screenshot we say 1,000-plus apps, but I think we're getting closer to 2,000 apps already. They auto-update, they're straightforward, and that catalog will be expanding shortly. 

There is now an update existing installs option for the Devicey catalog apps. Instead of having to manage only apps that were deployed by Intune, you can run the vast majority of the catalog apps in this update existing mode, as well as install from fresh if you want to. It uses detection scripts to look around on a device to see if that app already exists, so it can update in place. It might have been installed by hand or by an RMM, but you want to let Intune keep that app up to date. 

MacOS apps are in the last stages of testing. We've got the packaging service so you can drop an executable or MSI into inforcer and get that wrapped up. We're also looking at a way to give you an extended test period with the catalog. 

We are also looking at the devices themselves. When people start using device compliance as part of conditional access, you can use inforcer to push out what a healthy device looks like, what updates it needs, and what configuration it needs. But when a device doesn't meet that compliance, they have to log into Intune, hunt down that device, and find out why it's not compliant. 

We want to get that into inforcer because having a central list of devices with the compliance status is an essential part of using conditional access with device compliance. There are also extra tools that are Intune's secret sauce: the ability to see and manage LAPS, manage BitLocker keys, and manage the enrollment process for Autopilot. 

Let's move on to how we help you with data and AI, which is likely the story of the year for many of you. The world is only talking about AI right now. In the last year, we've tried to help you in a number of different ways: Copilot readiness, Copilot adoption, Copilot AI, and now SharePoint. 

We started with Copilot readiness, then moved to adoption, where we can help you see or show your customers who's using what. Are they actually using the license we've given them? How mature are they with Copilot? This helps you turn AI into a service for them, like a new line item in addition to security that you might be offering. 

Shadow AI was part of that as well, where we're giving you visibility into what else people are using, all based on Defender for Cloud Apps data. It shows you exactly who is using other models or perhaps using a random model that you don't want. It gives customers clear visibility into what else is out there. They might say, 'We don't have any interest in AI.' Then, looking at the actual data from Shadow AI, you can say, 'Everybody uses it all the time, every day.' It might be an opportunity to do more. 

One of the things we've noticed in all the AI conversations is that it starts with data. That's the big risk. That's the thing people are worried about the most. That's why we're working on a module called SharePoint Manager. 

The problem is figuring out who has access to data. Is there oversharing going on? Do we have data out there that is outdated, so when someone asks Copilot to do something, it uses stale data? These things are very problematic. They've always been a problem, but now it's the topic for many MSPs. 

A lot of businesses have moved to the cloud and taken their on-premises file server and copied it to SharePoint, and now that seems to be a problem. We're working towards a solution for all of that. We're giving you multi-tenant insight, but then also, per tenant, what are the problems with SharePoint for this customer? How many SharePoint sites are there? How many links are out there where someone can edit with everyone permissions? How many links are still out there for accounts that are disabled or guests? Do you have SharePoint sites running out of space? 

You can start drilling in. One of the more interesting things is the per-user view, where you can see what a user has done, revoke links, or fix broken inheritance. You can also see what that user can access and which libraries they can see. That could really help you pinpoint problems. 

There's a lot of reporting that comes with this because many of these decisions about whether access is allowed reside with the end customer. It's very hard for you to determine if they should be able to access something, but we're going to give you all the tools you need. The team is working on SharePoint Manager, and we have it planned for this year, around December. 

We have long had a lot of data sources in inforcer that are occasionally useful, and some data sources have been frequently useful. But if we're honest, it's been a little bit of a quest to hunt around and work out what data you need to get from inforcer with the traditional reporting tool. 

We started from the ground up. We took the 30 or 40 reports we had and decided to restructure them into the stories that you actually want to tell. Each report should now make it much more obvious what you're going to get. We've given a preview of every report as well. 

Where previously there were a couple of Intune device reports and non-compliant device reports, that is now one big report that gives you all of your devices and has encryption, device inventory, and device settings as sections that you can optionally hide or show. 

Enterprise apps is a big new one as well. We're trying to pick out high-privileged apps and give you both the time urgency and the privilege level of given apps. Licensing and assignments is useful for understanding how those licenses are passed out, especially if they have been assigned by group membership or directly. 

Tenant alignment has now been upgraded into the new reporting engine. You'll need to pick what blueprint or baseline you want to compare the tenant to. Because there is more control that you might need, you can choose what type of policies show up and configure what tags show up. There is also the ability to do a split view, which is a useful way to go into the individual settings. 

We are working on multi-tenant assessments. This will also likely come with many fixes that you can apply directly from assessments. 

We are restructuring how assessments look and what you should expect of them. Until now, you've had a lot of assessments out of the box. You can build custom ones, run them on a prospect or customer one time, get the results, and download those results for reference. 

We're now allowing you to map which tenants ought to have a certain assessment run daily. You can choose that all tenants get the new recommendations assessment run every day, while some get the Copilot one every day as well. The result is that your checks page shows, from saved results of the last run, typically within the last 24 hours, how many tenants are passing or failing specific checks. 

This is a targeted way to go in and start addressing problems. For many checks, there's been a PowerShell guide on how to go through this or which portal to use. We're good at reading and writing policies, so where possible, we're going to include a fix button. It will highlight the difference between the expected value and the future value and give you a literal fix button inside inforcer. 

This is a targeted way to address security holes where perhaps you've not reached a certain stage of your baseline process and just want to make quick fixes for the most urgent issues. Ultimately, this gives a multi-tenant view of how customers are doing against security. 

We are also keen to get a whole new wave of framework assessments in. We've had a good amount of Essential Eight coverage, and we'll aim to keep up as Essential Eight evolves. There are many frameworks out there, including DORA and HIPAA. These tend to be country-specific, but they are typically derived from the same core principles of security. We will aim to build out everything in reference to CIS as well and give you more flexibility in how you present frameworks and the cybersecurity you're aiming for with tenants. 

The last section is around TDR, threat detection and response. We officially launched this in September. We had some early access before, and it's had great reception and uptake. We're heavily investing in this capability. 

Even though we are great at deploying all kinds of policies, if you have all the policies in the world, you might not be secure enough. Even well-secured tenants get compromised. The reality is that it's worse than ever before. AI made everything worse for users and businesses trying to protect themselves. Attackers have powerful tools at their disposal. It's easy to create phishing chains, create great landing pages, compromise sessions, attack networks, attack hundreds of networks at the same time, and use enterprise apps. 

Policies help a ton, but you still want to stay on top of what's really happening and respond quickly because the damage gets done quickly. We see a lot of token theft going on right now. People steal tokens, and MFA doesn't help against that. If a token gets lost, you're in. You can impersonate the user and have access to everything. We also see many different things happening around how apps get registered and access data. 

We built TDR to help you stay on top of that. It provides real-time detection based on Microsoft telemetry, with an intelligent engine built with rules and agentic capabilities. It helps you respond: revoke sessions, lock users, contain the threat, remove enterprise apps, and remove forwarding rules. 

We're working on the UX side. TDR gives you a lot of information in each threat, and it can sometimes be overwhelming. We're working towards simplifying what you can see in the threat, making it easier to understand what happened and what needs to be done. We're also doing daily updates behind the scenes to remove noise and duplicates where possible and make the information easy to understand. 

We're close to launching our threat simulator. This is especially useful if you want to show TDR to a customer and demonstrate what kind of service you're providing. TDR looks a lot more interesting if something happens. You see what attackers do in a storyline and you can report on that. If you want to sell this to a customer and nothing happens, your report doesn't look that exciting. 

We're giving you a few scenarios that you can pick from, including impossible travel and device code phishing. You can deploy those events and logs to a tenant, and then show and report on them. 

We're also improving what we do with phishing containment. You can remove emails for multiple users, and there's more functionality there. It goes hand in hand with some of the other things we're doing on the user management side. 

For prospect onboarding and reporting, we're going to make it possible for you to collect data. We go back six months in time and collect a lot of data to show what you might have missed. This is something we do for every tenant you onboard right now, but we're also going to allow you to do that for prospect tenants. It's not going to be charged. You can run the report and take that to your customer and say, 'It looks like TDR might be a good idea for you because there was an attacker in your tenant for months,' for example. 

The big one is TDR for endpoints. Many of you have said, 'I love TDR and what you do for identity, but we need the endpoints in there.' Many MSPs prefer our platform rather than adding a whole bunch of point solutions. You want fewer solutions that do the job for you.

inforcer is all about enabling Microsoft at scale. We're not building our own EDR agents. That's not our job. Our job is to help you get more out of Microsoft. We're unlocking Defender for Endpoint and Defender for Business, so everything that's in Business Premium and up, as part of TDR.

We're going to pull in all the telemetry from Defender for Endpoint. It's arguably the strongest EDR out there right now, but it's hard to operate at scale in a multi-tenant fashion. We're integrating all of that into TDR and building single timelines where we can correlate events. A user clicked a phishing email, something happened on the laptop, browser session cookies were stolen, and then the mailbox was accessed. We're connecting these dots.

If you have Microsoft Defender on a server, we're going to pick up those logs as well and give you new types of threats that are not tied to the identity. You will still have it all in the same console, with remediative actions and PSA integrations.

This is not an add-on. This is part of TDR. If you have Defender for Endpoint, we're going to be able to show you and integrate with that.

We covered so much. We started with how we are improving the inforcer platform. Check out the new granular app permissions and custom RBAC roles if you haven't seen them. The new API is exciting for those of you who work with APIs. 

We demonstrated the new policy auto-remediation. I think you're all going to enjoy the new similar policy calculation, holiday mode, and all the user management work that has gone out lately. We covered Intune app management with the new catalog, updating existing apps that are already in place, and securing your devices in a better way through Intune. 

We spoke about SharePoint Manager, all the new reporting work, the multi-tenant assessment that is happening pretty soon, TDR, and TDR for Endpoint. There's a lot. The team has been busy, and we're investing heavily in this product. 

We couldn't do it without you. We are always looking for your feedback and thoughts about how we can improve the service and the product, because we do it for you and with you. Any time you have feedback, report it through the feature request system accessible from within the product. Vote for the things that you want. We look at that quite a bit. 

We appreciate you being a partner of ours. Thank you so much for being here. Hopefully, you enjoyed it and took some things away from it. We'll see you next time because we're going to do this every single quarter. For now, have a great day. See you soon. Thanks so much, everyone. Great to see you.