Who does what
Provider
- Investigate and contain incidents
- Execute licensed Advanced actions
- Hunt and report incident findings
Your team
- Deploy agents and protection plans
- Maintain critical-device approvals
- Authorize recovery and excluded work
Coverage
- Endpoints
Details
Service scope
Best for MSPs using Cyber Protect Cloud that want Acronis analysts to perform licensed incident response actions
Choose the SOC and tier
TRU-operated Advanced includes duties that differ from Standard or another MSSP's delivery.
Critical endpoints need approval
The MSP's Critical Endpoints group requires approval before any response action, including isolation.
Recovery has prerequisites
Backup, DR and RMM actions need their licenses. Recovery also requires agreement and approval.
Full service analysis
Acronis MDR Advanced by Acronis TRU investigates incidents 24/7 and executes permitted containment and remediation through Cyber Protect Cloud. Your MSP deploys the tools, approves actions on critical endpoints and agrees any licensed backup or disaster recovery work.
- Your team owns
- Deploy agents and configure protection plans
- Maintain contacts and the critical-endpoint group
- Authorize recovery and handle work outside the agreement
Choose the SOC and tier
This profile covers Advanced operated by Acronis TRU. Standard, Legato and other MSSP delivery options have different duties. Advanced adds remediation, threat hunting, root cause reports and on-demand investigation to the core service.
Critical endpoints need approval
Analysts can isolate non-critical endpoints using implied consent under the service definition. The MSP maintains a Critical Endpoints group. Any response action on those devices requires approval, including isolation.
Recovery has prerequisites
Backup recovery requires the Backup entitlement, DR recovery requires Disaster Recovery and both need approval and prior agreement. Scripts, remote shell and patching require RMM. Your MSP still deploys agents and configures protection plans.
Pricing & contract
- Billing
- Per-asset, Tiered, Custom
MDR is licensed per workload. Tier, endpoint count, region and partner affect the quote. Required Security + EDR/XDR and backup, DR or RMM entitlements must be scoped.
Tradeoffs & buying questions
Strengths
-
Service definition identifies action and license prerequisites
-
Advanced response can extend into agreed backup recovery
-
MSP can protect critical devices from unapproved action
Considerations
-
Requires Acronis protection and applicable additional entitlements
-
Critical systems wait for MSP approval
-
Out-of-scope response remains an MSP responsibility
Ask before buying
- Is this quote for Advanced delivered by Acronis TRU, and which workload and platform licenses are included?
- Which endpoints require approval before any action, and who can approve an overnight incident?
- Which backup, DR, RMM and XDR actions are licensed, preconfigured and agreed for our environment?
Integrations
Endpoint
- Acronis EDR
- Acronis XDR
Other integrations
- Acronis Cyber Protect Cloud
Common questions
Does MDR Advanced include backup and disaster recovery licenses?
Those capabilities require the corresponding entitlements, configuration and agreement. Recovery actions always require approval under the TRU service definition.
Will Acronis contact our customer directly?
Communications route through the MSP by default. Current documentation permits customer-level communication when the partner enables it for that customer.