Protected
What you set. This resource is meant to be backed up, under a policy you can trace.
One ConsoleThat ShowsWhat Needs You
The EnterProtect console is one place to run backup and security for every client: one alert queue across your whole book, protection state and health kept apart, and evidence a client's auditor can file.
- One alert per root cause, with the downstream noise folded in
- Fixed roles, so backup duty never carries the right to read client data
- Tickets in ConnectWise PSA or CommandIT, routed by alert type
Three Products, Three Consoles, One Morning
Backup in one portal, Microsoft 365 in another, scanning in a third. Every morning your team reconciles three queues by hand, and the exception that matters is in whichever one nobody opened first. Here's the fine print behind most consoles, and what EnterProtect does instead.
One Pane of Glass*Three products in one frame, still with three vocabularies and three queues.EnterProtect runs every product in one console, with one alert queue and one way to restore.
Green*Green in one portal and green in another aren't the same claim.Here protection state and health are separate facts, and acknowledging an alert never turns anything green.
Alerts*One failure, a dozen notifications, and a team trained to skim.Here repeated events update one alert, and an offline appliance is one alert, not one per server behind it.
Ticketed*A ticket closed in the PSA while the server is still unprotected.Here a closed ticket doesn't resolve an alert. The product's own evidence does.
Bulk Actions*Two thousand machines, two thousand confirmations, and no way back from a mis-click.Here a bulk action is one decision, with a preview before it and an undo after it.
Read Access*Backup duty that quietly comes with the right to read client data.Here backup and recovery are separate roles, enforced on the server, not just hidden on screen.
One Alert Per Root Cause
When an appliance goes offline and fifty resources stop backing up, that's one alert with fifty affected resources, a recommended action a junior tech can follow, and a resolution that arrives on its own when the appliance is back.
Protection State and Health, Never Blended
Installed isn't protected, and protected isn't healthy. Every resource answers both questions, and a fleet table shows whichever one needs you.
Protection state is what you intended: Protected, Setup required, Paused or Unprotected. Health is whether it's working: Healthy, Needs attention, Critical or Unknown. A row shows the protection state when it's anything but Protected, and the health otherwise, so the exception always shows.
Healthy
What's true now. Its latest recovery point arrived when the schedule said it would.
Needs Attention
Protected as intended, but not meeting expectations. The row says why without anyone opening it.
How the Console Works
Every product brings its own depth. The console owns the queue, the roles, the evidence and the tickets, so learning one product's flow teaches you the rest.
A Client's Evidence Bundle in a Minute
One dated document per client, across every product they use: validation results, restore tests, immutability receipts and destruction certificates. It names what it couldn't show, and no section can be left out.
One PSA Ticket Per Alert
Create a ticket from any alert or link one by number, and its status syncs back to the row. In ConnectWise PSA, each alert type routes to a service board, type and subtype. CommandIT applies its own routing, which the console shows read-only.
One Restore Grammar
Start from the thing, pick the point, browse, select, choose the destination. Learn it once for mail, files, sites, Teams and servers. The default destination never overwrites anything.
Silence Never Reads as Good News
Alerts reach people by email, webhook or PSA, routed by severity, product and site. A channel that fails raises its own alert by another path, and destructive or security events also go out of band.
Cases and EnterProtect Access, Side by Side
Open a case with the affected resource attached. Any EnterProtect access to your clients shows on the same screen, counting down to its expiry, and you can revoke it there.
Your Own Business, Protected First
Your MSP is an organization in your own list, protected exactly like a client, with your own Microsoft 365 free for a year while you protect clients. It never enters the basis you rebill from.
Statements You Can Rebill From
Every period produces a per-client statement whose numbers match the invoice, final before the 1st. Client quantities sync to your ConnectWise PSA agreements, and prices sync only if you switch that on.
Usable at 3 AM, From a Phone
The console is built for a desk and stays usable on a handset. The navigation becomes a drawer, and identity, status and the decision column stay on screen.
See the Console
A tour of the console your techs will live in: one queue for every client and every product, and the evidence at the end of every restore.
Video Coming Soon
- 01Every client and every product in one list, with protection state and health kept apart.
- 02An appliance goes offline: one alert with fifty resources in its scope, not fifty-one alerts.
- 03The alert becomes a ticket on the right PSA board, and the ticket updates instead of multiplying.
- 04A bulk change: the preview, one authorisation, and pause and cancel that work.
- 05A client's evidence bundle builds in a minute.
- 06The client's own console, carrying the MSP's name and support number.
One Decision, Applied to Every Machine
A bulk change is one authorised decision applied many times, not a loop of confirmations. So a mis-click has a preview before it and an undo after it.
- 01
Select by What's True
Choose by tags or criteria. The selection resolves when the action runs, so yesterday's new machine is in and last week's retired one isn't.
- 02
Read the Preview
The preview is mandatory: what will change, what already matches and what won't, broken down by client. If nothing would change, the action stops instead of running.
- 03
Confirm Once
One confirmation names what changes, from what to what, across how many. Targets you aren't authorised for are left out, and the preview says so.
- 04
Watch It Run
Progress is live, pause and cancel are real, and each target reports its own result. One record holds the decision, with per-target detail underneath.
- 05
Undo It
Where the old value was recorded, one action puts it back, with its own preview. Where an action can't be undone, enrolment for one, the preview says so before you confirm.
Roles That Mean Something
Fixed roles at your MSP and at each client, with no custom-role builder. Backup duty never carries the right to read client data, and you can preview a role first.
Owner
Ownership: billing, granting Owner, legal holds, client transfer and offboarding, and approving destruction. An MSP always keeps at least one Owner.
Administrator
Runs the platform: clients, users, products, policies, appliances and integrations, plus production and bare-metal recovery. Everything except what's Owner-only.
Backup Operator
Works the queue: runs and validates backups, deploys and manages alerts, with no recovery control and no access to restored client data.
Recovery Operator
Restores: browses recovery points, recovers to a safe destination, exports after a fresh second factor and runs isolated tests. No deployment, policy or appliance administration.
Viewer
Reads configuration, health, jobs, recovery history, evidence and reports within its scope, and holds no action permission at all.
Viewer, at a Client
The business contact at a client. Sees their protection status and their own access record, and never reaches backup content.
Backup Admin, at a Client
The client's in-house IT person. Restores the odd file, folder or email within limits you set, and runs an on-demand backup before a risky change.
Your Clients Log In and See Your Name
Today you prove a client's data is protected with a screenshot or a phone call. Give them a login and they check it themselves, while your name stays on every screen.
Their Protection, Under Your Name
A verdict first: how many resources need attention, then the evidence. Your name and support number on every screen, and your logo once you upload it. Their own record of every action on their data and every EnterProtect access lease. You create every client login, so you hold the full list of who can reach their data. They never see your costs, your other clients, or a way around you to EnterProtect.
Questions About the Console
Something we haven't answered? A person reads every message.
Do I need a separate console for each EnterProtect product?
No. Every product runs at console.enterprotect.com, in the same destinations: one alert queue, one way to restore, one set of reports. Each product's own depth sits inside them, so a BCDR alert and a Microsoft 365 alert read the same way.
How does EnterProtect cut down alert noise?
Repeated events for one root cause update one alert, and an upstream failure never creates a wall of downstream ones. An appliance outage behind fifty resources is one alert with a scope of fifty, and it resolves itself when the appliance returns.
Which PSAs does EnterProtect work with?
ConnectWise PSA and CommandIT. In ConnectWise PSA, a routing table sends each alert type to a service board, type and subtype, with a default row so nothing goes unrouted. CommandIT receives the alert stream and routes it with its own rules, which the console shows read-only. Either way, one alert carries one ticket.
Can I write my own alert rules?
No. Alert rules and escalation templates are EnterProtect-managed, so every MSP gets thresholds that hold up. You decide who hears what: routing by severity, product and site, with escalation, and quiet hours that a critical alert overrides.
Can I create custom roles?
No. The roles are fixed and their permissions can't be edited, so two people with one role always hold the same powers. An Owner or Administrator can preview the console as any role before assigning it, and a preview only ever narrows what you see.
Can my clients log in to EnterProtect?
Yes, once you invite them. A client user is a Viewer or a Backup Admin inside exactly one organization, and the invitation carries your name. Clients can't invite anyone, including their own colleagues, so you always hold the full list.
What if a bulk change goes wrong?
Undo it. Where the action recorded the previous value, one action restores it, with its own preview and record. Machines a later action changed aren't dragged back. Where an action can't be undone, enrolment for one, the preview says so before you confirm.
Is MFA required on the console?
On every account. Passkeys are preferred, an authenticator app is the fallback, and Owners need a phishing-resistant passkey. A password alone never completes a sign-in, and actions like an export, a production overwrite or a retention change need a fresh second factor no more than ten minutes old.
How fast does EnterProtect support respond?
Critical within 1 hour, around the clock. Warning within 4 business hours. A question by the next business day. You set the severity, and support doesn't retune it.
One Queue for Everything You Protect
Microsoft 365, servers, files and scanning land in the same queue, with the same proof behind every restore. Start with the product your clients need first.
Commitments in Writing
- One console for every product, with no second portal to log into.
- Backup duty never carries the right to read client data.
- Acknowledging an alert never changes what's true about a resource.
- Your clients see your name on every screen, never your costs.