Managed EDR

opt-in capability to detect and remove third-party antivirus products automatically, ideally at the account or organisation level and with safeguards to prevent Microsoft Defender from being removed. This would significantly reduce the manual effort involved in customer migrations, help clear persistent antivirus remnants, and improve endpoint health and compliance reporting.

For cloud-hosted RMMs, only being able to allow by static IP limits our ability to use the RMM during host isolation. Allowing FQDN allowlisting would let cloud-based RMMs connect to an isolated agent to remediate issues.

With the full permission granted through Microsoft Graph, the necessary domains and IPs should be able to be added to the threat policies without needing to be manually added as the guides show.

Employees are using OpenAI ChatGPT, Anthropic Claude, OpenClaw, browser copilots, AI extensions, personal API keys, and many other tools..... often without IT visibility. Our IT departaments need What AI tools are being used What data is being uploaded or pasted If sensitive information is leaving the company Which tools are approved vs shadow AI How to manage risk without killing productivity Many companies are blind here are risk is very high. Traditional firewalls and DNS filters are not enough. In February during The Product Lab, they mentioned the idea of an AI Scraper to detect AI tool usage, APIs, exfiltration risks, and user activity. Two months later, that idea already feels necessary.

Now that trusted device alerts can be supressed, it would be great that if at the same time if an alert comes in for a mobile device, and its from the same IP and location as the trusted device that it could also be treated as non malicious behaviour? The goal is to manage alerts for non trusted mobile phones as many SME's do not have MDM and operate a BYOD policy.

Huntress now supports an IP address allow list for isolated hosts, but this doesn't work with Cloud RMM, AV, or other tooling which typically uses dynamic IP addresses for agent connectivity. Vote here if you'd like to see this capability added. Even better, it would be great to hear what specific tools you'd want to use it with; the list of DNS names that need allowing for typical cloud tooling is long, and we could potentially preconfigure them (just check a box) for common-needed tools.

Partner would like to see Managed AV and Ransomware Canaries become supported for Linux endpoints to have full visibility on them same as windows endpoints

Can a row on the agents page be added to show the last know logged in user and also be used to search the agents page with?

the "Enforce Strict Isolation" checkbox in the isolation dialog appears to re-check itself visually after submission even when strict is not applied. Cosmetic (the allowlist was honored), but worth a ticket.