AI and Web Data Security | M-Tech Sales Playbooks

/ The pitch in brief

One standard for every client. Step up only where the client needs it.

Clients rarely ask for "DLP" or "DNS filtering". They say they don't know which AI tools staff use, that someone typed a password into a fake page, or that client files are ending up in the wrong places. This guide starts from those problems and fits each product to the job it does best. If any of the terms are new, read Start here first.

The M-Tech standard: Huntress SAT, Keeper and a web filter, on top of Business Premium. Huntress trains staff and runs phishing simulations, Keeper holds the passwords, and the web filter blocks dangerous and unwanted sites for every app on the device.

The web filter is still being decided. Entra Internet Access at £3.99 keeps everything in Microsoft and filters whole phones. DefensX Core at £1.49 is cheaper, catches fake login pages, and works for Google users and on shared desktops. The stack section sets out when each fits. Never sell both as filters.

Add DefensX Core+ when staff use AI tools. It controls what is pasted, typed and uploaded into AI tools and websites in the browser, which neither filter does on its own. £1.48 more than Core, or £2.97 alongside Entra Internet Access with its own filtering switched off. Premium and Premium+ follow for the roles that need isolation, prompt records or private access to office systems.

Use Microsoft's tunnel for Microsoft 365 sign ins, whichever filter is chosen. The Global Secure Access client, running only the Microsoft traffic profile, is included in Business Premium. It lets Conditional Access insist that sign ins come through the client's own tunnel, so a password or session stolen by a fake login page doesn't work from an attacker's machine. Alongside DefensX it still needs proving in the pilot.

Know where the browser stops. The ChatGPT, Claude and Notion desktop and phone apps don't run in a browser, so DefensX can block them but not see inside them yet. Its newly announced AI Guard One aims to close that gap; today, only Microsoft's Purview route can look inside desktop apps. On phones, Intune app protection in Business Premium already stops company data being copied into AI apps.

The standard adds £10.90 per user with Entra Internet Access, or £8.40 with DefensX Core (Huntress £1.86, Keeper £5.05). With DefensX Core+ in place of Core it is £9.88.

/ Start here

The ideas in plain English

You don't need to be technical to sell this, but you do need to explain it simply. Each card says what the thing is, gives an everyday comparison, and offers a line you can use with a client. The rest of the guide builds on these.

The basics

DNS filtering

Before a computer opens a website it looks up the site's name, such as bbc.co.uk, to find where it lives. A DNS filter checks that lookup against lists of dangerous or banned sites and refuses to answer for the bad ones, so the page never loads.

Think of it as a receptionist who won't put calls through to known scammers. Quick and cheap, but they only hear the name, not the conversation.

Say it like this "We stop staff reaching dangerous or inappropriate sites before the page even loads."

The basics

Web filtering and secure web gateways

A step beyond DNS filtering. All of a device's internet traffic goes through a checkpoint in the cloud, which applies rules per person or team. Microsoft's is Entra Internet Access. With extra setup it can see full web addresses and some content.

Think of it as all post going through the company post room, where some parcels are turned away.

Say it like this "Your internet traffic is checked against your company rules, wherever staff are working."

DefensX

A browser security extension: DefensX

A small add-in inside Chrome, Edge or Firefox, plus a light agent on the computer. Because it sits inside the browser, it sees what happens on the page: the login box, the upload button, what is pasted into an AI chat. It can allow, warn or block each action. The agent also does DNS filtering for the whole device.

Think of it as a supervisor sitting at the desk beside you, rather than a guard at the front door.

Say it like this "Staff can use the web and AI tools freely, but company passwords and client data can't be handed to the wrong site."

The problem

Shadow AI

AI tools staff use without the business approving them, often on personal accounts: ChatGPT, Claude, Gemini, free summarising sites. Anything pasted into them leaves the business's control, and some use it to train their models.

Think of it as staff taking work home in a carrier bag, with nobody knowing what was in it.

Say it like this "Do you know which AI tools your staff use, and what they put into them? Very few businesses do."

The basics

DLP, data loss prevention

Rules that recognise sensitive information, such as card numbers, National Insurance numbers, client lists or documents marked Confidential, and warn or block when someone tries to send, upload or paste it somewhere it shouldn't go.

Think of it as the airport security scanner, but for data leaving the business.

Say it like this "If someone tries to paste client details into ChatGPT, they're stopped or warned first."

Microsoft

Purview

Microsoft's family of data protection and compliance tools: sensitivity labels on documents, DLP rules, retention, eDiscovery and reports on AI use. Business Premium has the basics for email, SharePoint, OneDrive and Teams. The Purview Suite extends the rules to devices, desktop apps and other websites, including AI tools.

Think of it as the company rule book and records office, applied by Microsoft across its products.

Say it like this "Purview decides what counts as sensitive and where it's allowed to go."

Microsoft

Defender for Cloud Apps

Microsoft's catalogue of over 31,000 cloud apps, each with a risk score. It finds out which apps staff use, lets you mark each one approved or banned, and can watch what happens inside the approved ones, such as blocking downloads on a personal laptop. Sometimes shortened to DfCA or MDCA.

Think of it as a guest list with a background check on every guest.

Say it like this "We can see every cloud app in use, how risky it is, and switch off the ones you don't want."

Microsoft

Defender for Business

The antivirus and threat detection on each device, included in Business Premium. It spots and stops malware, records what happened for investigation, and blocks known dangerous websites. Defender for Endpoint is the enterprise version of the same thing.

Think of it as the burglar alarm and CCTV on each computer.

Say it like this "Every device already has Microsoft's antivirus and detection; this sits alongside it."

Microsoft

Intune app protection

Rules that live inside company apps such as Outlook, Teams and OneDrive on phones. They can stop company data being copied, pasted or saved into personal apps like the ChatGPT app, even on a personal phone the business doesn't manage. Included in Business Premium.

Think of it as a locked briefcase on the phone: work stays in the briefcase.

Say it like this "Staff can use their own phones for email without company data leaking into their personal apps."

Technical, but it comes up

TLS inspection

Almost all web traffic is encrypted. To look inside it, a web gateway has to decrypt it, check it and encrypt it again, which needs a company certificate installed on every device. Some apps refuse to work when this happens and have to be left uninspected. DefensX avoids this by working inside the browser.

Think of it as the post room opening sealed envelopes to check them, then resealing them.

Say it like this "To look inside encrypted traffic, Microsoft's route needs extra setup on every device; DefensX doesn't."

The problem

Credential phishing and passkeys

Credential phishing is a fake login page, often a copy of the Microsoft sign in, built to steal passwords. New ones appear hourly and aren't on any blocklist yet. A passkey is a sign in method tied to the device and the real website, so it can't be typed into a fake page.

Think of it as a fake bank branch, and a key that only fits the real bank's door.

Say it like this "With passkeys and the right browser protection, even a convincing fake login page can't get a usable company password."

Microsoft

Conditional Access and the compliant network check

Conditional Access is Business Premium's rule book for signing in: who can sign in, from what device, and with what checks, such as MFA. The compliant network check adds one more rule: Microsoft 365 sign ins must come through the client's own Global Secure Access tunnel. A password or session stolen by a fake login page then fails when an attacker tries to use it from their own computer. It needs only the Microsoft traffic profile, which Business Premium includes.

Think of it as a key card that only works when you come in through the staff entrance.

Say it like this "Even if someone's login is stolen, it won't work from anywhere but your own devices."

People

Security awareness training

Short, regular training so staff recognise scams, plus phishing simulations: realistic fake emails, sent by Huntress on M-Tech's behalf, to see who clicks, followed by quick coaching. Huntress runs this for M-Tech clients and reports results.

Think of it as a fire drill for email.

Say it like this "Your people become a defence rather than the weak spot, and you have the reports to prove it."

People

Password manager: Keeper

A secure vault for every password, shared safely within teams, filled in automatically only on the genuine website it belongs to. Staff open it with their Microsoft sign in, and leavers lose access automatically.

Think of it as a key safe that only opens at the right door.

Say it like this "No more passwords in spreadsheets or on sticky notes, and nothing walks out when someone leaves."

DefensX step ups

Remote browser isolation

Opening a risky website in a browser that runs in the cloud, so only a picture of the page reaches the user's computer. Anything harmful on the site never touches the device. In DefensX Premium.

Think of it as handling a suspicious parcel through a glove box.

Say it like this "Finance can open the odd unknown link safely without risking the whole network."

DefensX step ups

Private access to office systems

Letting someone reach a specific internal system, such as an office file share or accounts server, after checking who they are, without connecting them to the whole office network like a VPN does. The industry files this under ZTNA, zero trust network access; DefensX sells it as ZTNA or ZTBA in Premium+, and Microsoft's version is Entra Private Access. How DefensX private access works.

Think of it as a key to one room rather than to the whole building.

Say it like this "Staff and contractors get exactly what they need from home, and nothing else, without a VPN."

The big idea

Zero trust

A way of designing security, not a product. Nobody is trusted just because they're on the office network or signed in once. Every request is checked against who the person is, what device they're on and what they're trying to reach; people get only the access they need; and the checks keep going, on the assumption that something may already be compromised.

Think of it as a building where every door checks your badge, not just the front entrance.

Say it like this "Zero trust isn't something you buy in one box. We build it in at every layer: sign in, devices, the web, your data and remote access."

In the M-Tech stack: Conditional Access and MFA check every sign in; the compliant network check ties sessions to the client's devices; Intune checks device health and protects data in phone apps; DefensX checks every web page, upload and AI prompt; private access replaces network-wide VPNs with access per system.

/ The stack

Three layers, sold in order

Every conversation builds from the bottom up. The base is already there for managed clients. The M-Tech standard is what we recommend for everyone: training, a password manager and a web filter. The top layer is added only where a client's people, devices or data call for it.

The standard's web filter: two options

M-Tech hasn't settled which web filter goes in the standard. Both do the core job: blocking dangerous and unwanted sites for every app on the device, with different rules for different teams. Until it's decided, pick the one that fits the client using the guidance below, and never sell both as filters.

Option A · £3.99

Entra Internet Access

One Microsoft console. Rules are set per user and group through Conditional Access, alongside the rest of Business Premium.
Filters every app on company phones through the Defender app, as well as Windows and Mac.
Shows every app in use, with a filter for AI apps, from any program on the device.
The foundation of the Microsoft data route. Purview's checks on AI prompts and uploads run through it, so clients heading that way need it anyway.
Traffic goes through Microsoft. The client tunnels the device's internet traffic to Microsoft's cloud, where it is checked and sent on. That is what lets it inspect content later, but websites see a Microsoft address rather than the office's.

Needs Entra joined Windows devices, secure DNS switched off in browsers, and doesn't run on shared hosted desktops. Microsoft identities only.

Option B · £1.49

DefensX Core

Cheaper, and it catches fake login pages. DNS filtering for the whole device, plus detection of brand new phishing pages and stopping company passwords being typed into them.
Fewer prerequisites. No Entra joined devices or certificates, works on shared hosted desktops and for staff who sign in with Google.
A short step to AI controls. Core+ is £1.48 more and adds the paste, prompt and upload controls in the browser, in the same product.
Grows by group. Premium and Premium+ can be added just for the people who need isolation, prompt records or private access to office systems.
Traffic goes direct. Only the lookup of each site's name is checked by DefensX; the browsing itself goes straight from the device to the website, with the extension acting inside the browser. Nothing is tunnelled unless Premium's isolation or Premium+'s private access is in use.

Phones are filtered only inside DefensX's own secure browser. Safari gets DNS protection only. A smaller vendor, and a separate console.

Why the tunnel matters

Location and IP address. With Entra Internet Access, websites see Microsoft's edge rather than the client's own connection. Sites that check location, or that only allow the office's IP address, such as some banking, supplier and government portals, may need exceptions. Microsoft can restore the real address for Microsoft sign ins only.
Speed and outages. Tunnelled traffic takes a detour through Microsoft, usually unnoticeable, and depends on that service being up. If it can't connect, the client either falls back to going direct or blocks, depending on how it's set. DefensX Core's browsing doesn't depend on a tunnel.
What it buys you. Because everything passes through Microsoft, Entra Internet Access can inspect content, apply Conditional Access to internet traffic and feed Purview. DefensX gets its depth from the browser extension instead, so it doesn't need the tunnel for the same controls in the browser.
Stronger Conditional Access. Sign ins can be required to come through the client's own tunnel (the compliant network check), so a password or session token stolen by a phishing page fails when used from an attacker's machine. The tunnel can also stop staff signing in to other organisations' or personal Microsoft accounts, and Entra still sees the user's real address for location rules.
But that part comes with Business Premium. Microsoft lists the compliant network check, tenant restrictions and source IP restoration under the Microsoft traffic profile, which needs only Entra ID P1. A client can run the Global Secure Access client for Microsoft traffic alone and get them, whichever web filter is chosen. The £3.99 licence adds the general internet traffic.

In plain English

Entra Internet Access is like routing all the company's post through a central sorting office: it can look at everything, but every letter takes the detour and arrives postmarked from the sorting office. DefensX Core is like a receptionist checking the address on each letter before it goes straight out, with a supervisor at the desk watching what's written in the browser.

Lean towards Entra Internet Access when

Company phones are used heavily and need every app filtered.
The client is moving onto Microsoft's Purview and Defender suites.
Everyone is on Microsoft sign in and Entra joined Windows or Mac devices.

Lean towards DefensX Core when

Staff use AI tools, so Core+ is likely soon: one product does both jobs.
Some staff sign in with Google, or the client runs shared hosted desktops.
Price matters, or devices aren't all Entra joined.
Staff rely on portals that check location or only allow the office's IP address.

What the base and the standard cover

Dangerous and unwanted sites, for every app. Whichever filter is chosen, with different rules for different teams.
Which AI tools are in use. Entra Internet Access's app discovery shows every AI app reached; with DefensX Core, its DNS logs show which AI sites are visited, and the per person shadow AI report comes with Core+. Either is the opening for the AI conversation.
Stolen sign ins. The Global Secure Access client's Microsoft traffic profile, included in Business Premium, lets Conditional Access refuse Microsoft 365 sign ins that don't come through the client's own tunnel.
People and passwords. Huntress teaches staff to spot fakes and proves it with simulations; Keeper only fills passwords on the genuine site. DefensX Core adds fake login page detection if it is the chosen filter.
An approved AI. Microsoft 365 Copilot Chat comes with Business Premium and protects work data when staff sign in with their work account.
Company data on phones. Intune app protection stops copy, paste and save from Outlook, Teams and OneDrive into personal apps such as the ChatGPT app.

What needs a step up

What goes into AI tools and websites. Neither filter sees what is pasted, typed or uploaded. That is DefensX Core+, or Purview on the Microsoft route.
Data going into desktop AI apps. Today only the Microsoft data route can look inside them; DefensX can block them, and AI Guard One may change that.
Roles that open risky links, or must keep AI records. DefensX Premium.
Contractors and personal laptops, or replacing the VPN. DefensX Premium+, or Entra Private Access for Microsoft-only clients.
Files already overshared. No web tool touches files sitting in SharePoint or Google Drive. That's a tidy up, or Purview and Cloud Apps.

Filter the site at the door. Control the data where people type it.

/ Client problems

Start with what the client says

Each card is a problem clients actually describe, what is really going on, what to lead with, and where that answer falls short. Use the shortfall honestly; it is usually the reason for the next conversation.

Shadow AI

We've no idea which AI tools our staff are using.

What is going on: Staff use ChatGPT, Claude, Gemini, Notion AI and free AI sites, often on personal accounts, alongside or instead of Copilot.
Lead with: The standard's web filter: Entra Internet Access's app discovery report filtered to AI apps, or DefensX Core's DNS logs. Then agree an approved list, starting with Copilot Chat, and block what the client doesn't want. DefensX Core+ adds the per person shadow AI report, the option to warn rather than block, and control over what goes into each tool.
Where it falls down: Personal phones and home computers are invisible to everything here. Seeing the problem isn't the same as controlling it.

AI data leakage

Staff are pasting client details into ChatGPT.

What is going on: Contracts, spreadsheets and client emails are pasted into public AI tools to summarise or redraft, on accounts the business doesn't control.
Lead with: An approved AI first: Copilot Chat, or Microsoft 365 Copilot at £16.91. Then DefensX Core+, set to warn or block sensitive pastes and uploads by team. If DefensX Core is the client's filter, it's a £1.48 step up.
Where it falls down: The desktop and phone apps. If staff live in the ChatGPT desktop app, block it so they use the web version, or look at the Microsoft data route. Nothing stops someone retyping data or photographing a screen.

Credential phishing

Someone typed their password into a fake Microsoft page.

What is going on: Phishing pages are often only hours old, so they aren't on any blocklist yet, and some pass the MFA prompt straight through to steal the session.
Lead with: Huntress so people spot it, with simulations to prove it. Keeper, which won't fill a password on a look-alike site. Passkeys or Windows Hello, which Business Premium supports. DefensX, from Core upwards, recognises fake login pages and stops company passwords being typed into unapproved sites; a strong reason to choose it as the filter for clients who have been caught out. Add the compliant network check, so a stolen session can't be used from outside the client's devices.
Where it falls down: Training fades without repetition. Passwords typed by hand on personal devices are outside everything here except Entra's sign in checks.

Web and DNS filtering

We need to block dangerous and inappropriate sites.

What is going on: Usually an insurer's question, a safeguarding need or a past malware incident. Some teams, such as finance or apprentices, need different rules.
Lead with: The standard's web filter, Entra Internet Access or DefensX Core, with rules per team. Business Premium's own Defender filtering allows only one policy for the whole organisation.
Where it falls down: Entra Internet Access needs Entra joined devices and doesn't run on shared hosted desktops. DefensX filters phones only inside its own secure browser, and Safari gets DNS protection only.

Personal devices

Contractors and some staff use their own laptops and phones.

What is going on: Company data is reached from machines M-Tech doesn't manage, where none of the device based tools are installed.
Lead with: Business Premium first: Conditional Access to limit what unmanaged devices can reach, and Intune app protection on phones. For laptops, DefensX Premium+ gives controlled browser access to company apps from unmanaged devices, and private access to office systems in place of the VPN.
Where it falls down: Full desktop apps on a personal PC are outside everyone's control. The honest answer is web only access for those users.

Mixed estate

Our data is in Microsoft, Google and a dozen other apps.

What is going on: One team on Google Workspace, another on SharePoint and OneDrive, finance in several SaaS apps, and more than one AI tool.
Lead with: DefensX: Core as the filter and Core+ for the AI and upload controls apply one set of rules whatever sits behind the browser, with Microsoft, Google or Okta sign in. Pair it with a tidy up of sharing in each platform. See mixed estates.
Where it falls down: Files already shared publicly, sync apps such as Google Drive for desktop, and Chromebooks. Check ChromeOS support before quoting a Google shop.

Proving it

Our insurer, or our biggest customer, wants to know how we control AI and data.

Lead with: Evidence from the tools already in place. Microsoft Secure Score shows how the tenant's settings compare with Microsoft's recommendations. Huntress reports training completion and phishing results. The web filter reports blocked sites and AI use. DefensX adds resilience reports, and staff risk reports in Premium. Put them in the quarterly review with a short written AI use policy, which M-Tech can help draft.

/ Coverage map

Every route data can take, and who can see it

Data leaves a business by many routes: a website, a desktop app, a phone, an email. This map shows which layer can see each route. Each column shows what that product does by itself; the two filter options for the standard sit side by side, with Core+ where it adds something. Purview and Cloud Apps need Entra Internet Access for their web checks. Select a row for a plain explanation and what to sell. Scroll sideways on smaller screens.

Covers it Partly Block or allow only Not covered

Show all explanations

Route	Business Premium£17.75 · the base	Entra Internet Access£3.99 · filter option A	DefensXCore £1.49, filter option B; Core+ £2.97 where shown	Purview and Cloud AppsPurview Suite £9.24; Cloud Apps needs the Defender Suite; both £13.80

/ Outside the browser

Where browser tools fall down: desktop and phone apps

ChatGPT, Claude, Notion and Copilot all have desktop and phone apps as well as websites. An app talks to the internet directly, not through the browser, so a browser extension can't see what is typed into it. DefensX can still block the app's web address. This is the part of the conversation where Microsoft has more to offer today, at a price.

In the browserchatgpt.com, claude.ai, notion.so in Edge, Chrome or Firefox

DefensX Core+sees and controls the prompt, the paste and the upload
Purview with Entra Internet Accesssees it once TLS inspection is set up; parts in preview
Purview endpoint DLPchecks pastes and uploads into browsers
Either web filter alonethe site name only: allow or block

Desktop appChatGPT, Claude or Notion app on Windows or Mac

DefensX agentblocks the app's web addresses; the web version can stay allowed
Entra Internet Accessblocks the app's web addresses for every program
Purview with Entra Internet Accesscan inspect prompts and files from apps, unless the app refuses inspection
Purview endpoint DLPstops the app opening sensitive files, and blocks copying from them
Defender for Cloud Appsbans the app on each device, or warns
Intune App Controlstops an unapproved app running at all

Phone appChatGPT, Claude or Notion app on iPhone or Android

Intune app protectionstops copy, paste and save from Outlook, Teams and OneDrive into the app; included in Business Premium
Entra Internet Accessthrough the Defender app: allow or block
DefensXits secure mobile browser covers only itself

Sees what is sentSees some of itSees the destination onlyCan't see it

The three honest options for desktop AI apps

Block the app, allow the website. Block the desktop app in the web filter, or stop it running with Intune App Control. Staff use the web version, where DefensX Core+ controls what goes in. Cheapest and simplest.
Approve the app on a business account. ChatGPT, Claude and Notion all sell business plans with admin controls and terms that keep work data out of model training. Approve that one and block the rest; the protection then comes from the contract and the account settings.
Inspect it with Microsoft. Purview with Entra Internet Access can check prompts and files sent from apps as well as browsers. It needs Purview Suite licences, a security certificate on every device and testing app by app. Treat it as a project, not a switch.

Things to know before promising anything

Some apps refuse inspection. Apps that only trust their own certificates (called certificate pinning) break under TLS inspection and have to be left alone, which means they aren't checked. Dropbox, WhatsApp and Zoom are on Microsoft's built-in exceptions list.
Endpoint DLP blocks the copy, not the paste. It can stop text being copied from a sensitive file, and stop named apps opening sensitive files. It can't allow copying generally but block pasting into one desktop app; that kind of check only works in browsers.
Blocking an app is all or nothing. It stops the whole app, and sometimes the website too if both use the same addresses. Test before announcing.
Copilot is Microsoft's own. Copilot's apps are protected by the work account and Purview, not by any of the web tools here.

/ Coming next: DefensX AI Guard One

DefensX announced AI Guard One at Pax8 Beyond EMEA in October 2026. It is designed to take DefensX's AI visibility, data protection and policy controls beyond the browser to Office add-ins, native applications and autonomous AI agents, from one console. If it covers the ChatGPT and Claude desktop apps, it closes the main gap where the Microsoft route currently wins.

Don't sell it yet. DefensX hasn't published pricing, availability, which tier it belongs to, or which desktop apps it covers. Mention it as where DefensX is heading, and check the details on the confirm list before quoting.

/ How Defender for Endpoint and Defender for Cloud Apps work together

Spot the app on the device, ban it from the catalogue

In plain English: Microsoft's antivirus on each computer notices every cloud service the computer talks to. Defender for Cloud Apps looks those up in its catalogue, tells you what they are and how risky, and lets you ban the ones you don't want. The ban is then sent back to every computer. It needs the Defender Suite, and it's what clients mean when they ask "can't Microsoft block ChatGPT?"

The device reportsDefender on each Windows or Mac device records which cloud services every program connects to, browsers and desktop apps alike.Defender for Business
Cloud Apps names itThose connections become a report, matched against a catalogue of over 31,000 apps with risk scores, users and devices.Defender for Cloud Apps
You decideMark an app Sanctioned (approved), Monitored (allowed with a warning) or Unsanctioned (banned), by hand or with a rule such as "ban AI apps below a risk score".Defender portal
The ban is sent outThe banned app's web addresses go out to Defender on every device, or to chosen groups of devices.Up to 3 hours
The device enforcesDefender blocks any program reaching those addresses, or shows a warning with a link to the company's AI policy for monitored apps.Network protection

What it brings

Discovery from every device, wherever it is. Every program's cloud connections are seen at home, in the office or on hotel Wi-Fi, desktop apps included. Without the integration, discovery relies on uploading firewall logs, which only covers traffic through the office.
One-click blocking on the device. Mark an app Unsanctioned and Defender blocks it for every program, with no proxy or certificates.
Warn instead of block. Monitored apps show a warning with a link to the company's AI or IT policy, which suits "we'd rather you used Copilot".
Automatic rules. Ban any generative AI app below a chosen risk score, or any newly discovered file sharing service, without anyone lifting a finger.
Scoped by device group. Block personal AI tools for finance's devices but not for the development team's.
One place to investigate. App risk and device alerts sit in the same Defender portal, so an analyst can move from a risky app to the device and the person.

Which bundles include it

The device half is already in Business Premium. Microsoft lists Defender for Business as meeting the requirement, as well as Defender for Endpoint Plan 2. Defender for Endpoint P2 is not needed for the integration; the Defender Suite brings it, but buy that for P2's longer device history and deeper investigation, not for this.
The Cloud Apps half isn't. Business Premium's Entra ID P1 brings only Cloud App Discovery: the same catalogue and risk scores, fed by uploaded firewall logs, with no Defender integration and no blocking.
The full Defender for Cloud Apps licence comes in: the Defender Suite for Business Premium (about £9.24), the combined Defender and Purview Suites (about £13.80), Microsoft 365 E5 and EMS E5, or standalone. It is not in the Purview Suite for Business Premium; Microsoft's service description lists it in the enterprise Purview Suite, which is a different product.
So for a Business Premium client, it means the Defender Suite, which brings Defender for Endpoint P2 with it whether the integration needs it or not. It isn't worth buying for this alone, as the standard's web filter already discovers and blocks apps; it comes as part of a suite bought for wider reasons.

Suite prices from a UK distributor's list; confirm M-Tech's own before quoting.

What it needs to work

A Defender for Cloud Apps licence for the users, from one of the bundles above.
Devices onboarded to Defender, Windows 10 or 11, or Mac with network protection switched on.
A few settings switched on: network protection in block mode, cloud protection, Microsoft's browser protection extension in non-Microsoft browsers, and custom network indicators.

What it can't do

See what is sent. It allows, warns or bans an app. It can't let staff use ChatGPT while stopping a client list being pasted in; that is DefensX or Purview.
Act instantly. Allow up to three hours from banning an app to the ban reaching devices.
Cover what Defender isn't on. Personal devices, and phones without the Defender app, aren't covered.
Be the only place apps are blocked. Microsoft's guidance is to pick one main place to enforce blocking. For M-Tech clients that is the standard's web filter, whichever it is, with Cloud Apps adding the catalogue and risk scores once a suite is bought.

/ The sales point

On the M-Tech standard, the web filter already shows which apps are in use and can block them. Defender for Cloud Apps becomes worth selling when the client buys the Defender Suite for wider reasons: risk scored discovery of every app on the device, automatic banning rules, a Google Workspace connector, and session controls that block downloads or copying in approved apps on unmanaged devices.

/ Mixed estates

When the data lives everywhere

Plenty of clients aren't purely Microsoft. One team works in Google Workspace, another in SharePoint and OneDrive, finance lives in a dozen SaaS apps, and staff use Copilot, Gemini, ChatGPT and whatever AI tool they found last week. Controls built into one vendor's platform only see that vendor's part of the picture, and Microsoft's Entra Internet Access only covers people with a Microsoft identity on an Entra joined device. This is where DefensX is at its strongest.

Why DefensX fits a mixed estate

The controls sit where everything meets. Every one of these platforms is used through the browser, so the same upload, paste and AI rules apply whether the destination is Google Drive, SharePoint, Dropbox or ChatGPT.
It works with either identity. DefensX connects to Entra ID, Google or Okta, so policy follows the person even when some staff sign in with Google and others with Microsoft.
One rule book for every AI. Approve Copilot and Gemini, warn on ChatGPT, block unknown AI sites, and stop sensitive data being pasted into any of them, from one console.
No platform prerequisites. No Entra joined devices, TLS inspection certificates or Microsoft licences for staff who live in Google.

What it doesn't cover

Data already shared. Old public links and external shares in Google Drive or SharePoint are set inside each platform. Tidy them in each admin centre, or use Defender for Cloud Apps' Google Workspace connector if the client has the Defender Suite.
Sync clients and apps. Google Drive for desktop, OneDrive sync and the Gmail and Outlook phone apps move data outside the browser.
Chromebooks. DefensX lists Windows and macOS; ChromeOS isn't on its supported list, and Google shops often use Chromebooks.
Email itself. Gmail and Exchange each need their own phishing and attachment protection.

Can the Microsoft route do it?

Partly. Entra Internet Access sees all internet traffic from its client, so its filtering and Purview's network rules can cover uploads to Google Drive and messages in Gmail, and Defender for Cloud Apps can connect to Google Workspace to review stored files. But every person needs a Microsoft identity with Entra licences and an Entra joined device. Staff who live only in Google would need Microsoft licences just to be covered, which turns a security purchase into a platform decision.

Questions to ask the client

Why are there two suites, and does either need to stay? Consolidating may be the bigger win.
Which identity do people sign in with, and could one become the master?
Which devices: Windows, Mac, Chromebook, personal?
Which AI tools are approved, and which are actually used?
Where is the sensitive data, and who does it get shared with outside the business?

If the client wants Google's own DLP

Some Google clients will ask why they can't just switch on Google's own data protection. They can, but not on the plan most small businesses are on. Google's DLP comes with the Enterprise editions of Workspace, and controlling what goes into AI sites in the browser is a separate Chrome product on top.

What each Google plan includes

Business Starter, Standard and Plus: no DLP. £5.90, £11.80 and £18.40 per user on Google's UK list, on an annual plan. Plus adds Vault for retention and eDiscovery and advanced endpoint management, but Google lists data loss prevention only under Enterprise.
Enterprise Standard or Enterprise Plus: DLP for Workspace. Rules that find sensitive content and warn, block or alert on sharing it in Drive, Gmail, Chat and Calendar, and in Gemini. They also add context-aware access, which limits access by device and location. Enterprise is priced by quote rather than on Google's public list, so get a figure from a Google reseller.
Chrome Enterprise Premium: DLP in the browser. Block, warn or audit rules for uploads, downloads, paste, print and access to websites, including unsanctioned AI tools, plus deeper malware scanning. Google lists it at $6 per user per month in US dollars, sold separately from Workspace. Chrome Enterprise Core, the free management layer, has no DLP.

How it compares for the client

It is a platform upgrade, not an add-on. Moving a Business Standard client to Enterprise changes the price for every user, before Chrome Enterprise Premium is added on top.
It only covers Google's side, and Chrome. Workspace DLP protects Drive, Gmail and Chat, not SharePoint, Dropbox or ChatGPT. Chrome Enterprise Premium only works in Chrome, so Edge and Firefox users are outside it.
Where it wins. Workspace DLP checks files already stored in Drive and email sent from Gmail, inside Google itself. Nothing else here does that, apart from Defender for Cloud Apps' Google connector for clients with the Defender Suite. For a client that is staying mostly on Google, Enterprise plus DefensX or Chrome Enterprise Premium is the complete answer.
Where DefensX wins. In a genuinely mixed estate, DefensX Core+ at £2.97 covers the browser for Google and Microsoft users alike, in Chrome, Edge or Firefox, with no Workspace upgrade.

/ The sales point

In a mixed estate, DefensX is usually the simplest single control layer. It doesn't care which suite, SaaS app or AI tool sits behind the browser, and Core+ at £2.97 covers all of them at once. The Microsoft data route only becomes the better answer if the client is consolidating onto Microsoft anyway.

Sell it with hygiene, not instead of it. Pair DefensX with a tidy up of sharing in Google and Microsoft, one identity provider, and a decision on whether both suites really need to stay. That turns a tool sale into a proper engagement.

/ Who owns what

One owner for each job

Several of these products can do the same job. Selling two of them for one job costs the client twice and gives M-Tech two consoles to keep in step. This is the default owner at M-Tech; the notes say when a client on the Microsoft route is different.

Job	Owner at M-Tech	Also does it, so don't sell twice	Notes
Antivirus and device detection	Defender for BusinessBusiness Premium	–	DefensX isn't an antivirus. It sits alongside Defender, never instead of it.
Email links and attachments	Defender for Office 365 P1Business Premium	DefensX, for clicks once they reach the browser	Plan 2 in the Defender Suite adds investigation tools and Microsoft's attack simulation.
DNS and web filtering	The standard's web filterEntra Internet Access or DefensX Core	The other one; Defender for Business web filtering	One filter per client, never both. If a client on Entra Internet Access adds DefensX Core+ for AI controls, switch off DefensX's DNS layer.
Training and phishing simulations	Huntress Managed SAT	DefensX Premium training; attack simulation in the Defender Suite	Don't justify DefensX Premium with training; sell it for isolation, prompt records or 90 day logs.
Storing and sharing passwords	Keeper Enterprise	Passwords saved in browsers	Turn off browser password saving through Intune once Keeper is rolled out.
Stopping passwords typed into fake sites	DefensXfrom Core upwards	Keeper autofill only on the saved site; passkeys	These work together rather than overlap. Passkeys remove the password altogether for Microsoft sign in.
Stolen sign ins and session tokens	Conditional Access compliant network checkBusiness Premium, Microsoft traffic profile	Entra ID P2 risk policies in the Defender Suite	Included whichever filter is chosen. DefensX stops the password being handed over; the tunnel stops a stolen session being reused.
Shadow AI discovery	The standard's web filter	DefensX Core+; Defender for Cloud Apps	Entra Internet Access sees every app on the device. With DefensX Core as the filter, the per person shadow AI report needs Core+.
Approved AI	Copilot Chat, or Microsoft 365 Copilot£16.91	Business plans of ChatGPT, Claude or Gemini	Give people an approved tool before blocking the rest.
AI and upload controls in the browser	DefensX Core+	Purview with Entra Internet Access	The step up for any client whose staff use AI tools. Purview only for clients on the Microsoft route.
AI and data controls in desktop apps	Block the app in the web filteror the Microsoft route	Defender for Cloud Apps, block only	See the three options in outside the browser. Watch AI Guard One.
Company data on phones	Intune app protectionBusiness Premium	–	Works on personal phones without enrolling them.
Web filtering across the whole phone	Entra Internet Access	DefensX secure mobile browser, inside itself only	A reason to choose Entra Internet Access as the filter for clients with heavily used company phones.
Opening risky links safely	DefensX Premiumremote browser isolation	–	Microsoft has retired its own equivalent, Application Guard.
Remote access to office systems	DefensX Premium+ private accessDefensX calls it ZTNA; or Entra Private Access	An existing VPN	Private Access at £3.80 suits clients on the Microsoft route. DefensX also covers contractors on unmanaged devices.
Files already overshared	SharePoint and Google admin, Purview	Defender for Cloud Apps connectors	None of the web tools touch stored files. Tidy sharing before rolling out Copilot.

/ The products

What each one is, and what it costs

A short brief on each product, its job in the stack and where it overlaps. Prices are M-Tech's sell prices where we have them, and list prices otherwise.

The base

Microsoft 365 Business Premium

Defender for Business on devices, Defender for Office 365 Plan 1 on email, Entra ID P1 for MFA and Conditional Access, Intune for devices and phone apps, and Purview DLP for Exchange, SharePoint, OneDrive and Teams.

Overlaps: its single web filtering policy is superseded by the standard's web filter.
Gaps: nothing looks inside other websites, AI tools or uploads to them.

£17.75 per user. Copilot Chat included; Microsoft 365 Copilot £16.91.

Standard filter option B, and AI controls

DefensX

A browser extension and light agent. The agent filters DNS for the whole device; the extension sees the login form, the paste, the upload and the AI chat box inside the page, and can allow, warn, block, open read only or isolate, per team. Works with Entra ID, Google or Okta sign in.

Core is the filter option: DNS filtering, fake login page detection and password protection. Core+ adds the AI and upload controls.
Gaps: phones filtered only in its own browser; desktop apps can only be blocked for now; no Safari; ChromeOS not listed.

Core £1.49, Core+ £2.97 per user. Billed on active use, no minimum term.

M-Tech standard

Huntress Managed SAT

Security awareness training run by Huntress. Short, story-led episodes, phishing simulations based on real attacks, coaching for people who fall for one, compliance modules such as GDPR and ISO 27001, and reports on completion and compromise rates. Huntress builds and schedules the programme, so M-Tech doesn't.

Overlaps: DefensX Premium training and Microsoft's attack simulation in the Defender Suite.
Sell with: Keeper and passkeys, as the people side of phishing defence.

£1.86 per user.

M-Tech standard

Keeper Enterprise

A business password manager. Each user gets an encrypted vault, teams share folders, and admins enforce policies and see reports. Enterprise adds single sign on with Entra, automatic account creation and removal through SCIM, role based administration and stronger MFA options. Autofill only offers a password on the site it was saved for.

Add-ons: dark web monitoring, advanced reporting and alerts, and compliance reports.
Works with: DefensX password protection, which stops company passwords being typed into unapproved sites.

£5.05 per user.

Standard filter option A

Entra Internet Access

Microsoft's secure web gateway. A small client on each device sends its internet traffic through Microsoft's cloud, where web categories, site rules and threat intelligence are applied per user and group. It discovers the apps in use, including AI apps, and is the route Purview uses to check prompts and uploads on the Microsoft data route.

Needs: Entra joined Windows devices, or the Mac or phone client; secure DNS off in browsers; TLS inspection for anything beyond site names.
Strengths: filters every app on a phone through the Defender app; one Microsoft console; the base for the Microsoft data route.

£3.99 per user. Needs Entra ID P1, which Business Premium includes.

Microsoft data route

Purview and Defender suites

The Purview Suite brings endpoint DLP, DLP for AI prompts and uploads through Entra Internet Access, AI activity reporting and insider risk. The Defender Suite brings Defender for Endpoint P2, Entra ID P2, Defender for Office 365 P2 and Defender for Identity. Defender for Cloud Apps is in the Defender Suite only, not the Purview Suite for Business Premium.

Strength: reaches desktop apps and Microsoft's own data, one vendor, one identity.
Cost: heavier to set up and run, Microsoft identities only, some features in preview.

Purview Suite £9.24, Defender Suite £9.24, both £13.80 per user, from a UK distributor's list.

DefensX tiers

Each tier includes the one before it, and tiers can be mixed by user group: Core or Core+ for everyone, Premium for finance, Premium+ for contractors.

Standard filter option B Core £1.49 per user Phishing resistant browsing

DNS protection for the whole device
AI visual phishing detection
Zero trust password protection
Resilience reporting, 30 day logs
RMM and PSA integration

Lead step up Core+ £2.97 per user AI and data protection

Upload and download control by site and group
AI prompt protection
Shadow AI protection
AI data leak protection
Corporate time tracking

For specific roles Premium £4.09 per user Isolation and records

Remote browser isolation
LLM prompt logging
End user risk reporting
90 day log retention
Training (Huntress does this)

For unmanaged devices Premium+ £10.40 per user Private and unmanaged access

Unmanaged device and BYOD access
Private access to web and on site apps (ZTNA)
VPN and VDI replacement
Application control

Private access (ZTNA on the price list) is also sold as an add-on at £5.20 per user. Nexi AI, DefensX's reporting assistant, is a separate £48.29 seat aimed at owners and directors. AI Guard One, announced October 2026, has no published price or tier yet. The full DefensX feature detail is in the DefensX sales playbook.

How DefensX private access works (DefensX calls it ZTNA or ZTBA)

Private access replaces the office VPN. A VPN puts a remote laptop onto the whole office network. Private access never does; it gives each person access only to the specific systems they're allowed to use, and everything else in the office stays invisible to them. DefensX sells it as ZTNA (zero trust network access), now renamed ZTBA (zero trust business access). That follows industry convention, where ZTNA means access to private applications, and Microsoft's Entra Private Access sits in the same category. But zero trust itself is a much broader idea than this one feature; see the caution below.

How it works

The DefensX agent on the user's laptop. The same agent that does DNS filtering. It sets up an encrypted tunnel when the user needs an office system.
A connector in the office. The DefensX agent on any machine that can see the office systems, often the server itself, with the Connector role switched on in the console. No extra appliance, firewall changes or open ports.
Policies by user group. Define the services, such as remote desktop to the accounts server or the shared drive, and which groups can use each one: finance gets accounts, everyone gets the file share, contractors get one folder.
How it connects. Per group: always on once the user is signed in, started by the user, or only after signing in each time. Traffic is encrypted from the laptop to the connector; DefensX's cloud only sees enough to route it. Any TCP or UDP service can be carried, with remote desktop and file sharing DefensX's own examples.

Selling it

It retires the VPN. No VPN client to support and no port open to the internet for attackers to find, which is a strong story for insurers and Cyber Essentials.
Access per person, not per network. A stolen password or infected laptop reaches only what that person was allowed, not the whole office.
One product. Same agent and console as the web filtering and AI controls for a client already on DefensX.
Price only the people who need it. In Premium+ at £10.40, which also brings unmanaged device access, or as a £5.20 add-on. Tiers mix by group, so it's usually just remote workers and contractors. Microsoft's equivalent, Entra Private Access at £3.80, suits all-Microsoft clients with Entra joined devices.

Listen for: "the VPN keeps dropping", "we have a server in the office", "contractors need access to one system", or an insurer asking about remote access.

/ Caution: it isn't "zero trust" on its own

Sell it as a VPN replacement, not as zero trust. Zero trust is a set of principles that applies to everything: sign ins, devices, the web, SaaS apps, data and office systems. DefensX's ZTNA applies those principles to one part of the picture, reaching office systems. Telling a client they've "got zero trust" because they bought Premium+ or Entra Private Access overclaims, and that kind of claim tends to come back in an audit or after an incident.

Its documented checks are also narrower than the label suggests. DefensX describes policy by user group and an optional sign in before the tunnel starts. It doesn't yet document device health checks, enforced MFA or continuous re-checking during a session, which a zero trust product would normally include; those are on the confirm list. If a client asks whether they're zero trust, point to the whole stack, as set out in Start here, rather than one feature.

The filter options and step ups, priced

Per user per month on top of Business Premium. Huntress and Keeper (£6.91 together) are the same whichever filter is chosen, so they aren't shown. Entra Suite is Microsoft's UK list price; the rest are M-Tech or distributor prices.

/ Solution finder

What does this client need?

Tick what you've heard in the meeting. The panel suggests which web filter fits the client while the standard is undecided, adds only what the client needs, and flags anything to check.

What did the client tell you?

/ Recommendation

/ Bundle builder

Price the add-ons for a client

Start from a preset, then adjust the number of users on each line and the prices. Pick one web filter for the standard. Users moving up a DefensX tier come off the lower tier's line, as each tier includes the one below. Everything is per user per month, ex VAT.

/ Sales training

Talking about it with clients

More terms that come up once a conversation gets technical, the questions clients ask, and scenarios to test yourself against. The everyday terms are explained in Start here.

Jargon buster

Agent: A small program installed on each computer. DefensX's agent does DNS filtering for the whole device and works with its browser extension.
Secure DNS (DNS over HTTPS): A browser setting that encrypts site lookups and can route around DNS filters. Filters either handle it or need it switched off.
CASB: Cloud access security broker: a catalogue and policy engine for cloud apps. Defender for Cloud Apps is Microsoft's.
Sanctioned, monitored, unsanctioned: Defender for Cloud Apps' labels for an app: approved, allowed with a warning, or banned.
Network protection: The part of Defender on each device that blocks connections to bad or banned sites, for any program.
Endpoint DLP: Purview rules enforced on the device: copying sensitive files to USB, printing, copying their contents, or letting named apps open them.
Network data security: Purview checking prompts and uploads as they pass through Entra Internet Access, for browsers, apps and add-ins. Partly in preview.
Certificate pinning: An app that only trusts its own security certificates. It breaks under TLS inspection, so it has to be left uninspected.
Global Secure Access client: Microsoft's small app that tunnels a device's traffic to its cloud. With only the Microsoft traffic profile it is included in Business Premium; the Internet Access profile needs the Entra Internet Access licence. Windows, Mac, iPhone and Android versions exist.
Traffic profiles: The settings that decide what the Global Secure Access client tunnels: Microsoft 365 traffic (included with Entra ID P1), all other internet traffic (Entra Internet Access), or private office systems (Entra Private Access).
Tenant restrictions: A Microsoft setting that stops staff signing in to personal or other organisations' Microsoft 365 accounts on work devices, closing a quiet route for data to leave.
App Control for Business: Windows' own allow and block list for which programs may run, deployed with Intune.
Adversary in the middle: A phishing site that sits between the user and the real login page, passing the MFA prompt through and stealing the session. Passkeys defeat it.
Sensitivity label: A tag such as Confidential put on a document in Microsoft 365, which DLP rules can then act on.
SSO and SCIM: Single sign on lets staff open Keeper with their Microsoft account; SCIM creates and removes their Keeper accounts automatically as they join and leave.
ZTNA and ZTBA: Zero trust network access, and DefensX's newer name, zero trust business access. As product labels both mean private access to an organisation's own systems in place of a VPN, not zero trust as a whole.
Active use billing: DefensX charges only for users and devices active in the month, with no minimum term.
MCP and AI agents: AI tools that act on their own, calling other systems through connectors. AI Guard One and Entra Internet Access both aim to see and control this traffic.
Preview: A Microsoft feature released for testing but not yet fully supported. Avoid building a client proposal on one.

Questions clients ask

We already pay for Business Premium. Why do we need anything else?

Business Premium protects the device, the inbox and sign in very well. It filters the web with only one policy for everyone, and it can't see what staff paste or upload into other websites and AI tools. The M-Tech standard adds proper web filtering, training and a password manager; DefensX Core+ adds the AI and upload controls.

Which web filter should we have, Microsoft's or DefensX?

Both block dangerous and unwanted sites for every app on your devices, with different rules for different teams. Entra Internet Access keeps everything in Microsoft, filters every app on company phones, and is the foundation if you later want Microsoft's data protection suites. DefensX Core is cheaper, also catches brand new fake login pages, works for staff who sign in with Google and on shared desktops, and is a small step up to its AI controls. We'll recommend the one that fits how you work.

Doesn't Microsoft's tunnel make our sign ins safer?

Yes. Routing Microsoft 365 traffic through the Global Secure Access tunnel lets Conditional Access insist that sign ins come through your own tunnel, so a password or session stolen by a fake login page doesn't work from an attacker's computer. It can also stop staff signing in to personal or other companies' Microsoft accounts on work devices. Those features come with Business Premium for Microsoft traffic, so you get them whichever web filter you choose; the Entra Internet Access licence adds filtering of all other internet traffic.

Can't you just block ChatGPT?

Yes, in minutes, with the web filter. But people move to their phones and home computers, where nothing can see them. The better answer is an approved AI, Copilot Chat being free, plus rules on what can go into the others. Block only the tools you have no business reason to allow.

We use the ChatGPT desktop app. Does DefensX protect that?

Not yet. DefensX works inside the browser, so for the desktop app it can block it but not see what's typed. The options today are to use the web version with DefensX controls, approve a business ChatGPT plan with its own admin controls, or use Microsoft's Purview route, which needs higher licences and testing. DefensX has announced AI Guard One to extend its controls to desktop apps; we'll confirm what it covers before recommending it.

What about web filtering on our phones?

Entra Internet Access filters every app on company phones through the Defender app; DefensX filters only inside its own secure mobile browser. Either way, Intune app protection, already in Business Premium, stops company data being copied out of Outlook, Teams and OneDrive into other apps.

If we ban an app in Defender for Cloud Apps, is it blocked straight away?

Not quite. Microsoft allows up to three hours for the ban to reach devices. It then applies to every program on the device, but only on devices running Defender. On the M-Tech standard, the web filter does the blocking instead.

Does this mean you're reading our staff's browsing and AI chats?

The tools check activity against your rules; nobody at M-Tech reads it as a matter of course. Some features, such as prompt logging in DefensX Premium or time tracking in Core+, do record what people do, so tell staff, update the IT policy and consider a data protection impact assessment before switching them on.

DefensX Premium includes training. Why also pay for Huntress?

You shouldn't pay for both. Huntress is M-Tech's training service: managed content, phishing simulations and reporting. If a client takes DefensX Premium, it's for remote browser isolation, prompt records or 90 days of logs, not the training.

Our browsers already save passwords. Why Keeper?

Browser password stores are tied to one person and one browser, can't be shared safely, and don't disappear when someone leaves. Keeper gives shared team folders, admin policies and audit, connects to Microsoft sign in, and removes leavers automatically. We switch off browser saving once it is in.

We're on Google Workspace Business Standard. Can't Google do this for us?

Not on Business Standard. Google's DLP for Drive, Gmail and Chat comes with the Enterprise editions, which are priced by quote and apply to every user. Browser controls over uploads, pastes and AI sites are a separate product, Chrome Enterprise Premium, which only covers Chrome. DefensX covers the browser for Google and Microsoft users alike without changing your Google plan.

If we buy the remote access part, are we zero trust?

Not on its own, and we'd be wary of anyone who says so. Zero trust is a way of designing security across everything: every sign in checked, devices checked, access limited to what each person needs, and checks that keep going. Replacing your VPN with private access applies those ideas to your office systems, which is a good step. The rest comes from the other layers we put in place: Conditional Access and MFA, device management, web and AI controls, and tying sign ins to your own devices.

Do we need all of this on day one?

The standard, yes: it's the baseline we're comfortable supporting. Run the web filter's report of AI tools and sites in use for a few weeks; it shows whether the AI controls in DefensX Core+ are needed, and whether anyone needs Premium or Premium+.

Test yourself

0 of 12 answered

In plain English, what does a DNS filter do?

A client asks what Defender for Cloud Apps does. Which answer is right?

What is Purview, in one line?

A client uses the ChatGPT desktop app and wants to stop client data being pasted into it, while still using it. What can do that today?

Staff are copying text from Outlook into the ChatGPT app on their personal iPhones. What is the cheapest fix?

Finance needs stricter web rules than everyone else. The client is on the M-Tech standard. How?

A client's staff mostly work from company phones, and they're planning to move onto Microsoft's Purview suite next year. Which web filter fits?

A client asks for phishing simulations. Which product owns that at M-Tech?

Someone typed their password into a brand new fake Microsoft page. Which combination best stops it happening again?

A contractor needs the office accounts server from their own laptop. What fits?

A Google Workspace client with Chromebooks wants AI controls. What do you do first?

What should you tell a client about DefensX AI Guard One today?

/ Please confirm before quoting

Which web filter M-Tech standardises on: Entra Internet Access or DefensX Core. A pilot of DefensX on two or three clients would settle it: DNS filtering for apps that use their own secure DNS, how Mac users get on with Safari unsupported, and whether the phone filtering gap matters.
If DefensX becomes the standard, how existing clients on Entra Internet Access move across, or whether they stay as they are until renewal.
DefensX AI Guard One: how it reaches desktop apps, whether it covers the ChatGPT and Claude desktop apps, its price and tier, and UK availability.
Whether the Global Secure Access client (Microsoft traffic profile only) and the DefensX agent run cleanly side by side. If they do, a client can have Microsoft's Conditional Access benefits, included in Business Premium, with DefensX as the web filter.
The contents of the Defender and Purview Suites for Business Premium with M-Tech's distributor before quoting. Independent breakdowns agree Defender for Cloud Apps is in the Defender Suite only; Microsoft's own service description lists it in the enterprise Purview Suite, which is easy to confuse with the Business Premium version.
DefensX private access (ZTNA): whether it enforces MFA or checks device health before connecting, whether it works from unmanaged devices without the agent, which tiers the £5.20 add-on attaches to, performance for large file transfers, and compatibility with the client's antivirus (DefensX notes that products locking the hosts file, such as Webroot, can break it).
DefensX: ChromeOS support, Google group sync, the scope of Premium+ application control, where logs and prompt records are stored for UK clients, and its support terms.
Whether DefensX's DNS layer can be switched off cleanly, for clients on Entra Internet Access who add DefensX Core+ for the AI controls.
What DefensX Core reports about AI use on its own: whether its DNS logs show AI sites by person, given the shadow AI report is a Core+ feature.
How the compliant network check is scoped in Conditional Access, so phones, shared desktops, unmanaged devices and service accounts without the Global Secure Access client aren't locked out.
M-Tech's own prices for Entra Private Access and Entra Suite (Microsoft UK list £3.80 and £9.20) and the Defender and Purview suites (UK distributor list £9.24 each, £13.80 together).
Whether the Purview Suite for Business Premium meets Microsoft's "Purview E5 or equivalent" requirement for checking prompts through Entra Internet Access, and which of those features are still in preview.
Which AI desktop apps work under TLS inspection, if a client goes the Microsoft route. Test ChatGPT, Claude, Notion and any others before promising inspection.
Google: the Workspace Enterprise Standard price for the client from a Google reseller, the UK price of Chrome Enterprise Premium (Google lists $6 per user per month), and the client's current Workspace edition.
Huntress SAT: whether it syncs users from Google Workspace as well as Microsoft 365, for mixed estates.
Keeper: which add-ons M-Tech includes as standard, such as dark web monitoring and advanced reporting and alerts.