In short: Blackpoint ITDR is a 24/7 identity threat detection and response service for Microsoft 365, Google Workspace and Cisco Duo. It spots impossible travel, risky inbox rules and stolen sessions, then suspends the account, ends sessions and forces a password reset. It is quoted on the user accounts protected.
What Blackpoint ITDR is
Many attacks on small and mid-sized organisations start with a stolen login rather than malware. An attacker who has a user's Microsoft 365 password or session token can read email, set up forwarding rules, send convincing invoices to customers and reach files in SharePoint and OneDrive, all without touching a laptop.
Blackpoint ITDR (identity threat detection and response) watches for that activity around the clock. It is the identity half of Blackpoint's service, also described by Blackpoint as Cloud MDR. It runs on the CompassOne platform and can be combined with Blackpoint MDR for endpoints.
Coverage includes:
- Microsoft 365: Entra ID, Exchange, SharePoint, OneDrive and Teams
- Google Workspace
- Cisco Duo
Alerts show where single sign-on logins come from, so the SOC can act quickly on suspicious access.
What it detects and how it responds
Blackpoint looks for the signs of a compromised account, including:
- impossible travel and sign-ins from countries you have not approved
- sign-ins at unusual hours or through VPNs and proxies
- application activity outside the user's normal baseline
- business email compromise behaviour: new inbox rules, forwarding to outside addresses and permission changes
- session hijacking, where a stolen session token is reused
When its detection model is confident, ITDR contains Microsoft 365 and Google Workspace credential threats automatically:
| Response | Effect |
|---|---|
| Suspend the account | Stops the attacker using it |
| Terminate active sessions | Ends any stolen sessions |
| Force a password reset | Makes the stolen password useless |
| Incident summary | A record of what happened, for us and for you |
Anything below the model's confidence threshold goes straight to a human analyst, and human analysts cover the whole identity surface, including Google Workspace and Cisco Duo. If a legitimate user is suspended by mistake, Blackpoint re-enables the account on request.
How Blackpoint ITDR is licensed
ITDR is quoted on the user accounts it protects in Microsoft 365, Google Workspace or Cisco Duo, within a CompassOne package.
| Package | How ITDR is included |
|---|---|
| Essentials ITDR | ITDR on its own, with the 24/7 SOC, posture rating and asset inventory |
| Core | ITDR together with endpoint MDR, vulnerability management, Cloud Posture and application control |
| Standard | Everything in Core, plus SIEM with 365 days of log storage |
Blackpoint ITDR does not need premium Microsoft licensing; it works on standard Microsoft 365 plans. If your users have Microsoft Entra ID P2 or Microsoft 365 E5, Blackpoint gains extra detection capabilities from them. Those Microsoft licences are handled by Forever Group's Microsoft licensing team. Ask us for a quote for Blackpoint ITDR.
Requirements and deployment
There is nothing to install on devices. Setup involves:
- Authorising Blackpoint in your Microsoft 365, Google Workspace or Cisco Duo tenant using an administrator account, through a short guided set-up
- Setting approved countries and notification preferences, so travel and location alerts reflect how your team really works
- Agreeing notification contacts and out-of-hours escalation with us
It works best alongside the basics: MFA on every account, conditional access where your Microsoft licences allow it, and email filtering. If you need stronger MFA, see identity, MFA and privileged access.
Who it suits and how we help
Blackpoint ITDR suits any organisation whose work lives in Microsoft 365 or Google Workspace, and especially those handling payments, client money or sensitive correspondence, where one compromised mailbox can be costly. It is also a lighter way to start with Blackpoint before adding endpoint coverage.
We connect your tenant, tune approved locations, agree notification preferences and make sure alerts reach us at any hour. When an account is contained, we work with the user to confirm what happened, remove any rules or app consents the attacker added, and check whether customers or suppliers were contacted. Licence changes and renewals sit on your Forever Systems invoice.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Blackpoint ITDR protect?
Microsoft 365 accounts (Entra ID, Exchange, SharePoint, OneDrive and Teams), Google Workspace and Cisco Duo.
Do I need Microsoft 365 E5 for Blackpoint ITDR?
No. Blackpoint ITDR works on standard Microsoft 365 licensing. Users with Entra ID P2 or Microsoft 365 E5 give it extra signals for additional detections.
What happens when Blackpoint detects a compromised account?
For high-confidence Microsoft 365 and Google Workspace credential threats it suspends the account, ends active sessions and forces a password reset, then logs an incident summary. Anything less certain goes to a human SOC analyst.
Can I buy Blackpoint ITDR without endpoint MDR?
Yes. The CompassOne Essentials ITDR package covers identities on their own, and you can add endpoint MDR later by moving to Core or adding Essentials MDR.