Who does what
Provider
- Investigate endpoint alerts
- Perform permitted containment
- Report findings and escalate
Your team
- Maintain agents and access
- Set isolation exceptions
- Coordinate clients and recovery
Coverage
- Endpoints
Details
Service scope
Best for MSPs retaining client operations while outsourcing endpoint triage
Endpoint scope
Managed EDR covers supported endpoint products. Microsoft 365 and SIEM services require separate scope.
Response permissions
Isolation opt-outs, protected assets and the chosen EDR determine permitted actions.
Service timing
Confirm the current 15-minute SLA terms and when escalation satisfies the commitment.
Full service analysis
ConnectWise Managed EDR analysts investigate endpoint alerts around the clock and isolate affected devices. The MSP retains agent health, isolation exceptions, client coordination and recovery beyond supported endpoint actions.
- Your team owns
- Keep agents, connectivity and vendor support current
- Define isolation exceptions and escalation contacts
- Coordinate clients and complete out-of-scope recovery
Endpoint scope
ConnectWise renamed its endpoint MDR offer Managed EDR in 2026. Microsoft 365 security and managed SIEM are separate scope decisions. Their presence in the wider portfolio does not extend this endpoint subscription.
Response permissions
The SOC terms allow host isolation unless the client opts out, with written authorization required for listed protected assets. Available remediation varies by EDR. Confirm these permissions against the signed order.
Service timing
Current material advertises a 15-minute SLA that may involve containment or escalation. The April 2025 SOC terms describe a one-hour analysis objective. Ask for the applicable SLA, trigger, exclusions and remedy.
Pricing & contract
- Billing
- Custom
Separate EDR licenses, SOC fees, endpoint commitments and additional Microsoft 365 or SIEM services.
Tradeoffs & buying questions
Strengths
-
Supports three named endpoint product paths
-
Documented isolation exceptions and opt-outs
-
Endpoint scope is clearly separated from wider services
Considerations
-
Response actions depend on the chosen EDR
-
MSPs retain recovery and client coordination
-
Timing commitments need current contract confirmation
Ask before buying
- Which EDR licenses, device counts and minimum commitments are included in the quote?
- Which devices are excluded from isolation, and can the SOC take each response action without asking us?
- What starts the 15-minute SLA clock, when is escalation sufficient, and which contract version controls?
Integrations
Endpoint
- SentinelOne
- Bitdefender
- Microsoft Defender
Common questions
Does Managed EDR include Microsoft 365 or SIEM monitoring?
Those are separate service scopes. Confirm each additional product and its response entitlement in the order.
Can the SOC isolate devices without calling the MSP?
The published SOC terms allow isolation unless the client opts out. Listed protected assets need written authorization. Confirm the signed policy.