Introduction
Security threats continue to transform at breakneck speed. Because of AI’s role in attacks and protections, smaller organizations now require more sophisticated and agile protections. Achieving this at a manageable price point can be challenging, which has resulted in greater customer interest in consolidating on Microsoft’s security solutions and enlisting the assistance of service providers to deploy and manage these solutions. The result has been a 19% increase in security partners’ expected revenue opportunity at organizations in the Small, Medium Enterprises and Channel (SME&C) segment.1 Microsoft partners that invested in their internal capabilities, especially those related to the secure use of agentic AI and expanded security managed services, saw significant growth over the past 12 months and anticipate the growth to continue throughout FY 2027.
In the age of AI, every customer organization, regardless of size and geography, needs robust cybersecurity for protection from advanced attacks. While smaller organizations were always at risk, the level of effort and cost associated with successful attacks meant that larger enterprises were more often the targets. Additionally, leaders at smaller organizations often lacked the time and resources to make cybersecurity a priority. Now, everyone is subject to sophisticated attacks, and everyone is acknowledging this increased threat. The good news is that AI is also being deployed to protect against malicious actors. Altogether, this is an excellent time to be a security services provider serving the SME&C segment by meeting customers’ needs and efficiently delivering services at scale.
Because of the increased scope of protections required, as well as ongoing economic and price concerns, smaller organizations are increasingly interested in consolidating their security estate to fewer vendors and outsourced service providers. These organizations see the Microsoft security solution stack (including Microsoft Defender, Microsoft Purview, Microsoft Intune, Microsoft Entra, Microsoft Sentinel, and Microsoft Security Copilot) as a good option for several reasons, including native integration across the solutions reducing cost and complexity, the best-in-class reputation of many of the solutions, Microsoft’s large investment in security solutions targeting the SME&C segment, and the large partner ecosystem.
Many partners have responded by creating and/or improving their offerings for the SME&C segment by expanding across security solution families and deepening their capabilities (e.g., evolving from managed security operations center to managed extended detection and response [MXDR] offerings). Partners who have historically focused exclusively on Corporate and Enterprise segments are increasingly interested in expanding into SME&C. This is driving a redesign of their offerings and capabilities to increase automation and scale, enabling delivery at lower price points.
To understand the impact of these trends on the partner ecosystem, Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential business opportunity partners may realize by building and scaling Microsoft Security practices focused on the SME&C segment.2
As explained earlier in this section, “Microsoft Security” is a broad term that encompasses all products and services across six product families: Microsoft Defender, Microsoft Purview, Microsoft Intune, Microsoft Entra, Microsoft Sentinel, and Microsoft Security Copilot. In this study, Forrester uses the term “security” as shorthand for one or more of the following solution areas built around the six product families:
-
Microsoft 365 Security. This solution area covers activating and managing everything security-related in Microsoft 365, including security operations center (SOC) or security information and event management (SIEM) specific to telemetry coming from the security and compliance features within Microsoft 365 E5.
-
Multicloud Security. This solution area includes securing Azure and other public cloud infrastructure, apps, and data.
-
Data Security and Compliance. Microsoft’s capabilities include data security (information protection, data loss prevention, and insider risk management) and governance and privacy.
-
Identity. Identity and access management includes providing core digital identities to knowledge and frontline workers as well as to third parties, Microsoft Entra ID, Entra Suite (included in Microsoft 365 E7), Zero Trust initiatives, and capabilities such as single sign-on (SSO), multifactor authentication (MFA), Agent 365 agent identity (included in Microsoft 365 E7).
-
XDR. XDR is primarily a proactive managed services opportunity and a natural extension from endpoint detection and response (EDR). XDR includes endpoints, identities, data, and applications both on-premises and in the cloud. XDR is an expansion of the Microsoft 365 E5-specific SOC/SIEM opportunity described in the Microsoft 365 Security bullet. Managed extended detection and response is primarily an ongoing managed services opportunity that builds on XDR and EDR. In this study, the modeled MXDR opportunity primarily reflects recurring managed security operations, with smaller deployment and advisory components.
This year’s study focuses on what has changed for security partners between the first quarter of FY 2026 and the first quarter of FY 2027. This includes 1) what SME&C customers want from Microsoft security partners; 2) how partners make money in the SME&C customer segment; and 3) the best practices and investments that create success.
To better understand the revenue streams, investments, and risks associated with a Microsoft security practice, Forrester interviewed representatives from 14 global and regional partners with practices in one or more of the aforementioned solution areas. These interviews build on more than 100 interviews with Microsoft partners that were conducted in previous years as well as with dozens of organizations that buy partners’ services.
Forrester created a partner opportunity model for SME&C customers based on the achievements of leading partners over the past 12 months. The model is built on a per user per month basis so that it can scale up or down across the SME&C segment. This model quantifies the opportunities for deployment, advisory services, solutions development (e.g., repeatable IP, custom solutions, advanced integration work), and managed services over a three-year period at an organization with 1,000 users. Accounting for attach rates3, Forrester found that the expected revenue opportunity for a new SME&C customer is up by 19% YOY.
Market Trends
The Customer Perspective
This section incorporates Forrester research and survey data to understand the factors driving customer demand with respect to their priorities and reasons for outsourcing IT services. Forrester’s 2026 Security Survey asked security decision-makers at organizations with between 500 and 999 employees what their top IT security priorities were for the year ahead.4 Microsoft partners are well-positioned to help their customers with all of the top five priorities. The second-highest priority is using the built-in capabilities from security vendors such as Microsoft, which is exactly the role that partners fulfill.
[CONTENT]
| IT Security Priorities (Top Five) | |
|---|---|
| Improve application security and/or product security capabilities and services | 34% |
| Use built-in security capabilities (from Microsoft, Google, AWS, or other tools) instead of standalone security technologies for the same capability | 32% |
| Improve data security capabilities, such as sensitive data identification and classification | 32% |
| Improve threat intelligence capabilities to proactively identify security threats targeted to our organization or industry | 31% |
| Use the built-in AI capabilities in current security tools | 31% |
|
Base: 275 security decision-makers Company size: Between 500 and 749 employees or between 750 and 999 employees Source: Forrester’s Security Survey, 2026 |
|
The same survey also asked security decision-makers why they are interested in outsourcing security services.5 Their responses speak to the value of providing comprehensive project-based professional services and managed services. Of especially good news for partners is that “reduce cost” was at the bottom of list.
“Which of the following were the most important drivers of your organization’s interest in outsourcing security services?”
Base: 200 security decision-makers whose organization engages with third-party service providers to augment internal staff or to perform security functions
Company size: Between 500 and 749 employees or between 750 and 999 employees
Source: Forrester’s Security Survey, 2026
Forrester’s broader 2026 Priorities Survey asked 555 business and technology professionals at organizations with between 500 and 999 employees which IT objectives they would focus on in the year ahead.6 The top priority, selected by 43% of respondents, was “strengthen data security, privacy, and regulatory compliance.” Twenty-two percent of respondents said that they will work to “maximize value from external partners and suppliers.”
The Partner Perspective
Partners shared their views on the high-level trends and opportunities driving growth in the SME&C segment and what they believe will be even more important during the next year:
-
Managed services are more profitable and scalable in the SME&C segment. Smaller customers have a greater need for managed services because they lack the in-house teams/talent to do everything themselves. Furthermore, managed services are becoming more sophisticated, evolving from managed SOC to managed XDR offerings. Overall, partners are seeing managed services attach at between 60% and 80% in the SME&C segment versus around 40% in the Corporate and Enterprise segments.
Some partners reported that managed services can be more profitable with SME&C organizations than with larger customers. This is in part because offerings are more standardized and partners are more prescriptive in what the security estate must include and how it is configured. Margins in the SME&C segment are often around 60% versus 50% in Corporate and Enterprise.
Partners across all segments are increasingly using AI to streamline and automate their managed services. Event response automation rates are typically between 70% and 80% at more established managed services partners, and they see room for this to improve.
-
E7 is accelerating the end-to-end, AI-driven security opportunity. Partners are excited about the Microsoft 365 E7 solution due to customer interest and the potential revenue opportunity. Beyond bundled license savings, the two most compelling reasons to move to E7 were security-related: Entra Suite and Agent 365. Customer interest included the SME&C segment, which somewhat surprised partners.
The data indicate that 7% to 10% of SME&C customers will move to E7 over the next few years. Partners said that an E5 to E7 migration should be larger in services revenue than an E3 to E5 migration. To take advantage of this opportunity, partners are building offerings specific to this go-to-market motion.
-
Identity has become more important than ever. All efforts that have been made to secure human identities now need to include nonhuman (agent) identities (e.g., human insider risk now becomes agent insider risk). Partners said that the Microsoft Zero Trust messaging works well in this new, expanded identity space.
Partners also reported more competitive takeout opportunities in the identity space because of economic or cost pressures and as part of the broader consolidation onto the Microsoft platform. A typical SSO migration to Microsoft Entra can be worth $100,000 in services at a 500-person organization.
For these reasons, as well as the inclusion of Entra Suite in the E7 bundle, partners expect identity-related work to grow 30% in FY 2027.
-
The platform story takes hold. The single vendor story is more compelling for the SME&C segment than for larger customers because of limited resources (e.g., money and people). Consolidation is seen as a way to get better security for the same or less money. Outsourced services are also more important, and a customer’s consolidation onto Microsoft expands the opportunity for partners to deliver projects and managed services.
As previously discussed, the launch of the Microsoft 365 E7 offering is moving customers and partners further in this direction. Partners also noted that Microsoft is investing more in solutions that are better suited to smaller SME&C customers, which is translating into more end-to-end platform projects and increased revenues.
-
AI is becoming part of how partners deliver security, not just what they sell. Partners are embedding AI, automation, and agentic workflows into security operations to accelerate triage and investigation, automate repetitive work, and increase the number of customers they can support without proportionally increasing analyst capacity. Some partners are using Microsoft capabilities, while others are building proprietary agents, automation, and intellectual property around the Microsoft security stack. Security Copilot is part of this transition, but partners generally described the broader opportunity as embedding AI across service delivery rather than monetizing Security Copilot as a standalone service.
-
Microsoft funding and incentives reduce the risk of starting new security initiatives. Partners described Microsoft-funded workshops, assessments, and proof-of-value engagements as important tools for creating SME&C opportunities. These programs allow customers to test an approach, understand potential outcomes, and address initial security or AI-readiness questions before committing their budgets to larger projects. This is particularly valuable in SME&C, where customers can be sensitive to upfront services costs and partners often need to demonstrate value quickly.
Partners are increasingly incorporating funding into their regular sales and delivery processes. Funded engagements can initiate new customer relationships and lead to follow-on deployment, advisory, and managed services opportunities. Partners viewed Microsoft’s ability to support activities across the sales cycle as a differentiator, and some reported strong conversion from funded assessments into subsequent services work.
The Partner Opportunity
The trends discussed throughout this study contributed to strong growth across the Microsoft Security partner opportunity serving SME&C organizations. Total partner revenue opportunity (i.e., what partners are offering) increased 21.6% YOY to $81.00 per user per month, while the expected revenue from the likely bundles of services and products that customers are buying (attach rates applied) increased 19% YOY to $36.25 per user per month, reflecting continued customer investment in deployment, governance, identity modernization, and managed security services. Although AI remains the primary catalyst, partners reported that conversations have evolved beyond readiness and planning into implementation, governance, identity management, and ongoing security operations. Across solution areas, partners consistently noted that SME&C organizations want to adopt AI, simplify security operations, and consolidate technology investments, but often lack the internal resources required to do so. This dynamic is creating opportunities across deployment, advisory, solutions development, and managed services while increasing demand for recurring services that help customers operate and govern increasingly complex environments.
Identity and data security and compliance generated the strongest growth among established solution areas. Expected Identity revenue increased 18% YOY to $11.00 per user per month, making it the largest expected solution-area opportunity, and expected data security and compliance revenue increased 17% YOY to $6.75. Microsoft 365 Security remains the largest total opportunity at $24.00 per user per month, and the newly separated MXDR category adds a distinct recurring services opportunity. Together, these findings show how partners can convert AI, consolidation, and security modernization demand into broader and longer-term customer relationships.
How To Read The Partner Opportunity
Total revenue opportunity represents the full modeled revenue opportunity if a customer purchased all of the services and solutions included in the model.
Attach rate represents how frequently each service or solution is expected to be included in a customer engagement based on the partner interviews. Because customers typically purchase a mix of services and solutions rather than every offering, attach rates vary across the model.
Expected revenue opportunity represents total revenue opportunity adjusted for these attach rates, providing a more representative view of the revenue opportunity for a typical customer engagement.
Total revenue opportunity × attach rate = expected revenue opportunity
Across the full model, $81.00 in total revenue opportunity translates to $36.25 in expected revenue opportunity per user per month after attach rates are applied. The model is based on a new SME&C customer with 1,000 users over a 36-month customer journey.
Year-Over-Year Growth (Expected Revenue)
Expected Revenue Opportunity Mix
Forrester also broke down the expected revenue opportunity across four service areas: deployment, advisory, solutions development, and managed services.
-
Total deployment opportunity grew 71% YOY, while expected deployment revenue grew 63%. Deployment remains the most common entry point for new customer relationships and has a blended attach rate of 60%. Growth was led by identity modernization, competitive takeouts, AI-related data security deployments, and Microsoft Security consolidation. These projects frequently create follow-on advisory, solutions development, and managed services opportunities.
-
Total advisory opportunity grew 26% YOY, while expected advisory revenue grew 23%. Partners reported continued demand for guidance about AI adoption, data governance, security modernization, cloud security, and identity strategy. Advisory services have a blended attach rate of 57%, reflecting customers’ need for guidance before committing to larger technology and services investments.
-
Total solutions development opportunity grew 10% YOY, while expected revenue grew 4%. Partners continue investing in reusable intellectual property, integrations, governance workflows, automation, and AI-enhanced delivery. The slower increase in expected revenue indicates that converting these investments into attached customer revenue remains an opportunity, despite solutions development representing $24.90 per user per month in total offerings.
-
Total managed services opportunity grew 12% YOY, while expected revenue grew 5%. Managed services remain the largest service category at $32.60 per user per month in total opportunity and $13.50 per user per month in expected revenue. MXDR, security administration, identity operations, governance, and compliance monitoring provide recurring revenue while addressing SME&C staffing and skills gaps. The difference between total and expected growth also reinforces the importance of introducing managed services early and improving attach motions.
Revenue Opportunity By Partner Service
| Partner service | Total revenue per user per month |
Blended attach rate |
Expected revenue per user per month | Expected YOY growth |
|---|---|---|---|---|
| Deployment | $18.45 | 60% | $11.15 | 63% |
| Advisory | $5.05 | 57% | $2.90 | 23% |
| Solutions development | $24.90 | 35% | $8.70 | 4% |
| Managed services | $32.60 | 41% | $13.50 | 5% |
| Total | $81.00 | 45% | $36.25 | 19% |
Revenue Opportunity By Solution Area
| Solution area | Total revenue per user per month |
Blended attach rate |
Expected revenue per user per month | Expected YOY growth |
|---|---|---|---|---|
| Microsoft 365 Security | $24.00 | 43% | $10.20 | 1% |
| Multicloud Security | $12.35 | 43% | $5.35 | 3% |
| Data Security And Compliance | $16.50 | 41% | $6.75 | 17% |
| Identity | $18.75 | 59% | $11.00 | 18% |
| XDR | $9.40 | 31% | $2.95 | N/A |
| Total | $81.00 | 45% | $36.25 | 19% |
In addition to services, cloud solution provider (CSP) partners also have a software resale revenue opportunity. This includes the margin partners make when reselling licenses. This financial example does not include promotions and incentives because they can by quarter. The licensing margin expected revenue opportunity is $2.10 per user per month, which is based on a blend of Microsoft 365 E5 upgrades and Microsoft Defender Suite license sales. The ratio of expected services revenue to licensing margin revenue is 17:1.
Microsoft 365 Security
Microsoft 365 Security remains the foundation of most Microsoft Security partner practices serving SME&C organizations. While Identity and Data Security are emerging as some of the fastest-growing opportunity areas, partners consistently described security operations, endpoint protection, threat detection, and Microsoft Defender deployments as the starting point for broader customer engagements. Many SME&C organizations have limited security resources and increasingly prefer integrated security platforms over point solution collections. This creates opportunities for partners to consolidate security tools, simplify operations, and help customers realize more value from their existing Microsoft investments. Microsoft 365 Security remains the largest solution area in the model, representing $24.00 per user per month in total revenue opportunity and 30% of total partner revenue.
Microsoft 365 Security also creates recurring opportunities with platform administration and optimization. Partners reported that deployments frequently expand into policy management, endpoint administration, vulnerability management, tenant optimization, and related managed services. These services supplement limited internal resources and can uncover follow-on opportunities in identity, data security, compliance, governance, and AI readiness. Forrester moved some services included in Microsoft 365 Security in prior years into the new MXDR category, accounting for the 9% decline in total Microsoft 365 Security opportunity. This change reflects a revised category structure rather than reduced customer demand.
-
Deployment services continue to create opportunities for long-term customer engagement. Microsoft 365 Security deployment services represent $5.85 per user per month of total opportunity and have the highest attach rate within the solution area at 68%, resulting in $3.95 per user per month of expected revenue. Partners reported that many SME&C engagements begin with Microsoft Defender, Microsoft Sentinel, endpoint security, and threat protection deployments that help customers establish a stronger security foundation while reducing operational complexity. These projects frequently become the starting point for additional identity, governance, compliance, and AI-related initiatives.
-
Advisory and change management services help customers navigate platform consolidation and AI-driven security initiatives. Many SME&C organizations lack dedicated security architecture teams and increasingly rely on partners to develop security roadmaps, assess existing security investments, and identify opportunities for consolidation. Partners reported that security assessments, architecture planning, and AI-readiness conversations often occur before customers expand into data security, identity, or governance-related projects. Advisory services maintain a relatively strong attach rate of 57%, reflecting the continued importance of strategic guidance early in the customer journey.
-
Custom solutions and partner-developed IP help partners scale Microsoft 365 Security delivery. Solutions development represents the largest total Microsoft 365 Security offering at $10.90 per user per month, but its 23% attach rate results in $2.50 per user per month of expected revenue. Partners are investing in dashboards, automation frameworks, orchestration capabilities, and AI-enhanced operational tooling that complement Microsoft’s native capabilities. These investments can improve delivery consistency and allow partners to efficiently support more SME&C customers.
-
Managed services provide recurring revenue and create opportunities to expand customer relationships over time. Managed services generate $5.50 per user per month of total opportunity and have a 50% attach rate, making them one of the largest expected revenue streams within Microsoft 365 Security. Partners reported growing demand for ongoing security administration, policy management, endpoint management, vulnerability management, tenant optimization, and operational support as many SME&C organizations lack the internal resources necessary to manage these activities themselves. These recurring engagements position partners as trusted advisors and frequently create opportunities to expand into identity, data security, compliance, governance, and AI-related initiatives over time.
Microsoft 365 Security Opportunity
Multicloud Security
Multicloud Security remains an important opportunity as SME&C customers expand across Azure, other public clouds, on-premises infrastructure, and third-party platforms. Many customers prefer working with one security partner capable of supporting Microsoft and non-Microsoft environments rather than coordinating multiple vendors and providers. This creates an opportunity for partners to provide consistent security controls, governance, and visibility across a distributed environment. Multicloud Security represents $12.35 per user per month in total opportunity and $5.35 in expected revenue. Its 3% expected revenue growth is more modest than identity or data security and compliance but reflects steady demand as cloud and AI initiatives expand customers’ security requirements.
-
Deployment services help customers establish consistent security controls across cloud environments. Multicloud Security deployment services account for $2.00 per user per month of total opportunity and have a 63% attach rate, resulting in $1.25 per user per month of expected revenue. Partners continue to assist customers with cloud security implementation, posture management, policy configuration, and workload protection as organizations expand their cloud footprints.
-
Advisory services help customers navigate cloud expansion while maintaining security and governance. Advisory services has the highest attach rate within the solution area at 67%, reflecting the need for strategic guidance as organizations operate across multiple environments. Partners reported helping customers assess risk exposure, develop cloud security roadmaps, define governance models, and align security policies across cloud platforms. Many SME&C organizations lack dedicated cloud security teams and rely on partners to provide the expertise needed to make informed investment decisions.
-
Solutions development helps partners manage security across Microsoft and non-Microsoft environments. Solutions development represents $4.55 per user per month of total opportunity, highlighting the importance of partner-developed intellectual property within cloud security practices. Partners continue investing in automation, integrations, monitoring capabilities, dashboards, and operational workflows that improve visibility across multiple environments.
-
Managed services generate recurring revenue by extending security expertise across cloud environments. Managed services represent the largest revenue category within Multicloud Security at $5.20 per user per month and account for $2.35 per user per month of expected revenue. Partners reported that many SME&C organizations do not have the staff or expertise required to continuously monitor and manage security across multiple cloud platforms. As a result, customers increasingly rely on partners for ongoing governance, posture management, policy administration, optimization, and operational support.
Multicloud Security Opportunity
Data Security And Compliance
Data security and compliance has moved from an AI-readiness discussion into one of the fastest-growing service opportunities for partners serving SME&C organizations. Customers are increasingly funding Purview deployments, data classification, data loss prevention, information protection, and governance work needed to support Copilot and other AI initiatives. Expected revenue increased 17% YOY to $6.75 per user per month, showing that AI-related data concerns are converting into purchased services rather than remaining exploratory discussions.
The opportunity is particularly relevant in SME&C, where many organizations are building formal governance capabilities for the first time. One partner reported that 80% to 90% of its Copilot customers subsequently purchased data security services, while another said data security increased from approximately 25% to 40% of the organization’s revenue. These engagements often begin with advisory or deployment work and can expand into recurring governance, compliance monitoring, policy administration, and information protection services.
-
Deployment services are accelerating as organizations establish the foundations required to support AI initiatives. Data security and compliance deployment services represent $3.45 per user per month of total opportunity and have a 61% attach rate, resulting in $2.10 per user per month of expected revenue. Partners reported increasing demand for Purview implementations, data classification, labeling, data loss prevention, governance controls, and compliance-related deployments as organizations seek to better understand and protect business data before expanding AI usage. The cloud security practice lead at a global systems integrator told Forrester: “For customers adopting Microsoft Copilot, data security is the obvious next step. Today, 80% to 90% of our Copilot customers move forward with data security services.”
-
Advisory services help customers understand their data readiness and governance gaps. Advisory services have the highest attach rate within the solution area at 68%, reflecting the significant need for guidance before organizations invest in technology. Partners increasingly monetize governance assessments, compliance reviews, data discovery exercises, AI-readiness workshops, and roadmap development engagements. Many SME&C customers lack dedicated governance teams and rely on partners to identify risks, establish priorities, and create practical plans for improving data security and compliance.
-
Solutions development helps partners simplify data security and compliance management. Solutions development represents $4.95 per user per month of total opportunity, highlighting the growing importance of partner-developed intellectual property. Partners continue creating automation, governance workflows, reporting tools, compliance accelerators, and Purview-related offerings that simplify data security and compliance management. These investments help partners deliver repeatable services while improving customers’ ability to manage information protection and compliance requirements over time.
-
Managed services are the next stage of the data security and compliance opportunity. Managed services represent $7.00 per user per month in total opportunity, the largest service category within this solution area, but the 31% attach rate results in $2.20 in expected revenue. Partners are developing ongoing governance, compliance monitoring, insider risk management, policy administration, and data loss prevention services. Improving conversion from advisory and deployment engagements into these recurring services represents a meaningful opportunity for further growth.
Data Security And Compliance Opportunity
Identity
Identity growth is coming from two directions: current demand for Entra modernization and competitive takeouts and emerging demand to govern AI agents and other nonhuman identities. Identity has expanded beyond authentication and access management into lifecycle management, entitlement reviews, governance, and agentic insider risk. Expected identity revenue increased 18% YOY to $11.00 per user per month, making it the largest expected solution area opportunity in the model.
Partners reported growing demand for migrations from competing identity platforms to Microsoft Entra as customers seek to reduce costs and consolidate more capabilities within existing Microsoft investments. At the same time, AI is creating new requirements for digital worker provisioning, permissions, lifecycle management, access reviews, and governance. Together, competitive takeouts and agent identity management are creating near-term deployment revenue and longer-term advisory, solutions development, and managed services opportunities.
-
Deployment services are accelerating as organizations modernize identity infrastructure and consolidate identity platforms. Deployment services represent $6.40 per user per month of total opportunity and carry a 56% attach rate, resulting in $3.60 per user per month of expected revenue. Partners reported strong demand for Entra migrations, identity modernization projects, privileged access implementations, and identity governance deployments. Several interviewees highlighted growing momentum with competitive takeouts as customers evaluate whether capabilities previously purchased from third-party vendors can be consolidated into Microsoft investments.
-
Advisory services help customers prepare for identity governance and AI-driven identity challenges. Advisory services carry a 50% attach rate and frequently serve as the starting point for conversations about Zero Trust, lifecycle management, governance, entitlement management, and AI-related identity needs. Partners reported helping SME&C customers assess existing identity programs, identify governance gaps, and design operating models capable of supporting human and nonhuman identities. As organizations deploy more AI agents, advisory engagements increasingly focus on governance frameworks and controls designed to address agentic insider risk.
-
Solutions development helps partners automate identity governance and lifecycle management. Solutions development represents $4.50 per user per month of total opportunity and has a 70% attach rate, the highest service attach rate within identity. Partners described building integrations, automated provisioning, joiner-mover-leaver workflows, entitlement management capabilities, and migration tooling. The high attach rate reflects the integration and workflow requirements that often extend identity engagements beyond basic technology deployment. The VP of sales at a systems integrator told Forrester: “We built an automation platform for migrating customers from [a competitor] to Entra, and demand has been strong across both enterprise and midmarket organizations. The conversation is increasingly about AI-driven identity needs and cost consolidation because customers are already paying for capabilities that now exist within the Microsoft stack.”
-
Managed services provide recurring opportunities for governance, lifecycle management, and identity operations. Managed services represent $6.45 per user per month of total opportunity and carry a 55% attach rate. Partners reported growing demand for ongoing identity administration, governance operations, entitlement reviews, privileged access management, and lifecycle management services. Several interviewees noted that organizations are increasingly looking for partners to help govern AI agents alongside human identities, creating a long-term opportunity with identity operations and agentic insider risk management. As customers deploy larger populations of digital workers, partners expect recurring identity services to become an increasingly important source of revenue.
Identity Opportunity
XDR
MXDR is the primary ongoing security operations opportunity for Microsoft Security partners serving SME&C organizations. Unlike Microsoft 365 Security, which establishes and manages the underlying platform, MXDR provides continuous monitoring, detection, investigation, threat hunting, and incident response across endpoints, identities, data, applications, and cloud environments. Most SME&C organizations cannot efficiently staff these capabilities internally. MXDR therefore represents a distinct recurring opportunity of $9.40 per user per month, with managed services accounting for $8.45.
Partners reported that MXDR typically follows Microsoft 365 Security deployment rather than replacing it. After customers implement technologies such as Microsoft Defender and Microsoft Sentinel, partners can assume responsibility for operating and improving detection and response capabilities over time. MXDR is broader than a traditional managed SOC because it connects telemetry and response across multiple security domains. Partners are also investing in AI, automation, and agentic workflows to improve analyst productivity, reduce repetitive work, and support more SME&C customers efficiently.
-
Deployment services establish the operational foundation for MXDR engagements. Deployment services represent $0.75 per user per month of total opportunity and have a 33% attach rate, resulting in $0.25 per user per month of expected revenue. Partners reported that Microsoft Sentinel onboarding, security operations setup, telemetry integration, use-case development, and monitoring configuration often serve as the first phase of an MXDR engagement. These projects establish the operational framework required to deliver ongoing monitoring, detection, and response services.
-
Advisory services help customers evaluate security operations maturity and response capabilities. Advisory services account for a smaller portion of MXDR opportunity but remain important for helping SME&C organizations assess monitoring requirements, incident response preparedness, staffing limitations, and operational risk exposure. Partners reported conducting security operations assessments, response planning engagements, and managed services evaluations that help customers determine which functions should remain in-house and which should be outsourced.
-
Solutions development helps partners improve the efficiency and quality of security operations. While solutions development represents a relatively small portion of MXDR revenue, partners continue investing in automation frameworks, custom detections, AI-assisted investigations, orchestration capabilities, and operational tooling. Several interviewees described building proprietary intellectual property to improve analyst productivity, accelerate investigations, and deliver more consistent outcomes across their customer base.
-
Managed services drive the MXDR opportunity. Managed services represent $8.45 per user per month of total opportunity and $2.65 per user per month of expected revenue, making it the dominant revenue stream within the solution area. Partners reported strong demand for security monitoring, threat detection, incident response, vulnerability management, security operations, and incident response retainers as SME&C customers continue to face resource constraints and cybersecurity talent shortages. Several partners described MXDR as the service that keeps them embedded with customers over time, creating recurring revenue while serving as the operational hub for broader Microsoft Security relationships.
XDR Opportunity
Microsoft-Funded License Resale Opportunity Via CSP Channel
Many CSP partners are the partner of record and eligible to receive money from Microsoft based on their customers’ licenses. The financial example here is based on several assumptions:
-
Compensation is based on the $21 license price difference between Microsoft 365 E5 and E3 (assuming that an upgrade is mostly because of security) and/or the $12 cost for Microsoft Defender Suite.
-
The mix between these two licenses is 50:50.
-
An 18% margin is applied to these license costs, which excludes backend incentives and promotions. However, the frontend margin can sometimes be lower, offsetting some of the other upside.
-
The partner sells the license (is the partner of record) 70% of the time.
Based on the above, the license margin total opportunity is $3.00 per user per month. Applying the 70% attach rate results in an expected revenue opportunity of $2.10 per user per month.
In addition to transactional incentives, Microsoft offers presale, deployment, and adoption incentives on select security solutions designed to further boost partner profitability.
Investments And Best Practices
Eight Steps For Building And Scaling An SME&C Security Practice
SME&C is not simply enterprise at a smaller scale. The partners achieving the strongest growth are building go-to-market, delivery, and customer success models on faster demonstrations of value, greater standardization, and more recurring services. A common customer journey begins with an AI, consolidation, or funded assessment conversation; progresses into a standardized deployment; and expands into adoption, governance, and managed services. The following eight practices help partners build and scale this model.
-
Use AI readiness as the entry point, not a product or feature conversation. Rather than leading with specific security products, many partners begin with discussions on AI adoption, Microsoft Copilot, business transformation, or productivity goals. These conversations naturally expand into data security, identity, governance, compliance, and managed services opportunities. Partners reported that customers rarely ask for governance, classification, or identity modernization directly, but frequently invest in these capabilities once AI initiatives expose foundational gaps.
-
Lead with platform consolidation and operational simplicity. Successful SME&C partners are increasingly positioning Microsoft Security as a platform strategy rather than a collection of individual tools. Customers are looking to reduce product sprawl, simplify administration, lower costs, and maximize existing Microsoft investments. Partners noted that consolidation conversations often lead to opportunities across Microsoft 365 security, identity, multicloud security, data security, and MXDR.
-
Own the customer relationship end-to-end. Unlike many enterprise environments where strategy, architecture, implementation, and support responsibilities may be distributed across multiple stakeholders, SME&C customers frequently rely on partners as their primary security advisors. Partners reported that long-term success depends on owning the customer journey from initial assessment and deployment through adoption, governance, quarterly reviews, and managed services delivery.
-
Use Microsoft funding to reduce the risk of beginning. Build funded workshops, assessments, and proof-of-value engagements into normal sales and delivery processes. These programs can help SME&C customers evaluate an approach and see potential outcomes before committing to a larger investment. Partners can then create defined expansion paths from the funded engagement into deployment, advisory, and managed services.
-
Productize and standardize service delivery to accelerate growth and increase profitability. The most successful SME&C-focused partners emphasized repeatability over customization. Rather than building unique engagements for every customer, they develop packaged offerings, defined scopes, standardized delivery methodologies, automation frameworks, and reusable intellectual property. This allows partners to improve scalability, preserve margins, and support larger customer volumes without proportionally increasing delivery costs.
-
Incorporate AI and automation into service delivery to expand analyst capacity and improve efficiency. Partners are beginning to use AI, automation, and agentic capabilities within their own security practices, especially in SOC environments. These capabilities can help reduce manual effort in areas such as security operations, triage, investigation, and service delivery, while enabling skilled and often constrained resources to focus on higher-value activities. As these technologies mature, partners that embed AI into repeatable delivery workflows will be better positioned to serve growing SME&C customer bases efficiently and maintain competitive service margins.
-
Design the managed services attach motion from the beginning. Do not wait until deployment is complete to introduce ongoing services. Partners should identify monitoring, administration, governance, optimization, or MXDR needs during initial discovery and explain how those services support the customer after implementation. This creates a clearer transition from project revenue to recurring revenue.
-
Align sales incentives with SME&C growth. Several partners reported creating dedicated SME&C teams, specialized sales motions, and compensation structures that reward recurring revenue growth and managed services adoption. Treating SME&C as a strategic segment rather than a smaller version of enterprise helps improve focus, execution, and customer outcomes.
Conclusion
The expected Microsoft Security partner revenue opportunity for a new SME&C customer increased 19% YOY to $36.25 per user per month. AI remains the primary catalyst, but customers are moving beyond readiness discussions and purchasing the governance, identity, data protection, and security operations capabilities needed to adopt AI securely. Identity and data security and compliance produced the strongest growth among established solution areas, while Microsoft 365 Security remained the largest total opportunity and MXDR added a distinct recurring services motion.
The findings also show why SME&C requires a purpose-built partner model. Customers frequently need enterprise-grade capabilities but have fewer internal resources with which to evaluate, deploy, and operate them. This increases the value of platform consolidation, funded proof-of-value engagements, prescriptive deployments, and managed services. The opportunity is not simply to sell more Microsoft Security technology. It is to make security adoption manageable and connect individual projects into a broader customer journey.
Partners expect AI agents and digital workers to create further demand for identity governance, lifecycle management, information protection, and agentic insider risk services in FY 2027 and beyond. Partners best positioned to capture this growth will be those that standardize delivery, use automation to improve scalability, attach managed services early, use Microsoft funding to lower initial customer risk, and align their sales organizations with SME&C growth.
From the information provided in the interviews with partners of various sizes from around the globe, Forrester constructed a Total Economic Impact™ framework for those partners considering building and growing one or more security practices.
The objective of the framework is to identify the revenue streams, investments, and best practices that affect the investment decision. Forrester took a multistep approach to evaluate the holistic opportunity for partners building and growing a Microsoft security practice.
Due Diligence
Interviewed Microsoft stakeholders and Forrester analysts to gather data relative to Microsoft 365 Security, Multicloud Security, Data Security And Compliance, Identity, and XDR.
Interviews
Interviewed representatives at 14 partner organizations with one or more existing Microsoft 365 Security, Multicloud Security, Data Security And Compliance, Identity, or XDR practices to obtain data about revenue streams, investments, and best practices.
Financial Model Framework
Constructed a financial model representative of the interviews using the TEI methodology. The model normalizes all results as a per user per month opportunity at an SME&C customer with 1,000 users on a 36-month customer journey.
Case Study
Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks. Given the increasing sophistication of ROI analyses related to IT investments, Forrester’s TEI methodology provides a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology.
Appendix A
Total Economic Impact
Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists solution providers in communicating their value proposition to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of business and technology initiatives to both senior management and other key stakeholders.
Appendix B
Endnotes
1 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.
2 The SME&C segment is loosely defined as customer organizations with 300 to 2,000 employees.
3 An attach rate is the likelihood of a given service/solution being included in what a customer purchases. Attach rates are applied to solution areas (e.g., Microsoft 365 Security, Multicloud Security, Data Security And Compliance, Identity, and XDR) and to services (e.g., deployment, advisory, business solutions, and managed services). In other words, they’re applied to the typical mix of solutions and services a customer buys. This will vary based on how a partner has entered into security. For example, a compliance partner will attach a lot more data security and compliance, while a managed security services provider will attach a lot more Microsoft 365 security. Use this calculation: total opportunity x attach rate = expected opportunity.
4 Source: Forrester’s Security Survey, 2026, Forrester Research, Inc., April 2026.
5 Ibid.
6 Source: Forrester’s Priorities Survey, 2026, Forrester Research, Inc., March 2026.
Disclosures
Readers should be aware of the following:
This study is commissioned by Microsoft and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis.
Forrester makes no assumptions as to the potential results that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the study to determine the appropriateness of an investment in a Microsoft security practice.
Microsoft reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester’s findings or obscure the meaning of the study.
Microsoft provided the customer names for the interviews but did not participate in the interviews.
Consulting Team:
Luca Son
Jonathan Lipsitz
Marianne Friis
Published
November 2026
PDF