Protected
What you set. This resource is meant to be backed up, under a policy you can trace.
One QueueforEvery Client
Find the client that needs you without checking four portals. Work backup and scanning alerts in one queue, open the right PSA ticket and give clients evidence of what was recovered.
- One alert per root cause, with the downstream noise folded in
- Fixed roles, so backup duty never carries the right to read client data
- Tickets in ConnectWise PSA or CommandIT, routed by alert type
How the Console Handles Daily Work
Review protection, work alerts and manage restores through shared workflows across products.
One Pane of Glass*Manage each product without switching between separate alert queues.EnterProtect runs every product in one console, with one alert queue and one way to restore.
Green*Check whether a resource is protected and whether its backups are healthy.Protection state and health are shown separately. Acknowledging an alert doesn't change either.
Alerts*Related failures are grouped so your team can work on the underlying cause.Repeated events update the existing alert. An offline appliance produces one alert covering its affected resources.
Ticketed*Ticket status and protection status can differ.An alert resolves when the product confirms recovery, rather than when a ticket is closed.
Bulk Actions*Review the scope and consequences before applying a change across machines.Bulk actions have one preview and confirmation. Reversible actions also offer undo.
Read Access*Assign backup administration separately from access to recovered data.Backup and recovery roles have separate permissions, enforced on the server.
One Alert Per Root Cause
When an appliance goes offline and fifty resources stop backing up, that's one alert with fifty affected resources, a recommended action a junior tech can follow, and a resolution that arrives on its own when the appliance is back.
Protection State and Health, Never Blended
Installed isn't protected, and protected isn't healthy. Every resource answers both questions, and a fleet table shows whichever one needs you.
Protection state is what you intended: Protected, Setup required, Paused or Unprotected. Health is whether it's working: Healthy, Needs attention, Critical or Unknown. A row shows the protection state when it's anything but Protected, and the health otherwise, so the exception always shows.
Healthy
What's true now. Its latest recovery point arrived when the schedule said it would.
Needs Attention
Protected as intended, but not meeting expectations. The row says why without anyone opening it.
How the Console Works
Every product brings its own depth. The console owns the queue, the roles, the evidence and the tickets, so learning one product's flow teaches you the rest.
A Client's Evidence Bundle in a Minute
One dated document per client, across every product they use: validation results, restore tests, immutability receipts and destruction certificates. It names what it couldn't show, and no section can be left out.
One PSA Ticket Per Alert
Create a ticket from any alert or link one by number, and its status syncs back to the row. In ConnectWise PSA, each alert type routes to a service board, type and subtype. CommandIT applies its own routing, which the console shows read-only.
A Consistent Restore Workflow
Choose the resource and recovery point, browse the backup, select items and choose a destination. The workflow is consistent across mail, files, sites, Teams and servers, and defaults to a destination that avoids overwriting production data.
Alerts When Delivery Fails
Alerts reach people by email, webhook or PSA, routed by severity, product and site. A channel that fails raises its own alert by another path, and destructive or security events also go out of band.
Cases and EnterProtect Access, Side by Side
Open a case with the affected resource attached. Any EnterProtect access to your clients shows on the same screen, counting down to its expiry, and you can revoke it there.
Your Own Business, Protected First
Your MSP is an organization in your own list, protected exactly like a client, with your own Microsoft 365 free for a year while you protect clients. It never enters the basis you rebill from.
Statements You Can Rebill From
Every period produces a per-client statement whose numbers match the invoice, final before the 1st. Client quantities sync to your ConnectWise PSA agreements, and prices sync only if you switch that on.
Desktop and Mobile Access
The console is built for a desk and stays usable on a handset. The navigation becomes a drawer, and identity, status and the decision column stay on screen.
See the Console
A tour of the console your techs will live in: one queue for every client and every product, and the evidence at the end of every restore.
Video Coming Soon
- 01Every client and every product in one list, with protection state and health kept apart.
- 02An appliance goes offline: one alert with fifty resources in its scope, not fifty-one alerts.
- 03The alert becomes a ticket on the right PSA board, and the ticket updates instead of multiplying.
- 04A bulk change: the preview, one authorisation, and pause and cancel that work.
- 05A client's evidence bundle builds in a minute.
- 06The client's own console, carrying the MSP's name and support number.
Preview and Apply Bulk Changes
Review affected clients and machines before confirming a bulk change. Follow per-target results and undo supported changes when needed.
- 01
Select by What's True
Choose by tags or criteria. The selection resolves when the action runs, so yesterday's new machine is in and last week's retired one isn't.
- 02
Read the Preview
The preview is mandatory: what will change, what already matches and what won't, broken down by client. If nothing would change, the action stops instead of running.
- 03
Confirm Once
One confirmation names what changes, from what to what, across how many. Targets you aren't authorised for are left out, and the preview says so.
- 04
Track Progress
Progress is live, pause and cancel are real, and each target reports its own result. One record holds the decision, with per-target detail underneath.
- 05
Undo It
Where the old value was recorded, one action puts it back, with its own preview. Where an action can't be undone, enrolment for one, the preview says so before you confirm.
Separate Backup and Recovery Permissions
Fixed roles at your MSP and at each client, with no custom-role builder. Backup duty never carries the right to read client data, and you can preview a role first.
Owner
Ownership: billing, granting Owner, legal holds, client transfer and offboarding, and approving destruction. An MSP always keeps at least one Owner.
Administrator
Runs the platform: clients, users, products, policies, appliances and integrations, plus production and bare-metal recovery. Everything except what's Owner-only.
Backup Operator
Works the queue: runs and validates backups, deploys and manages alerts, with no recovery control and no access to restored client data.
Recovery Operator
Restores: browses recovery points, recovers to a safe destination, exports after a fresh second factor and runs isolated tests. No deployment, policy or appliance administration.
Viewer
Reads configuration, health, jobs, recovery history, evidence and reports within its scope, and holds no action permission at all.
Viewer, at a Client
The business contact at a client. Sees their protection status and their own access record, and never reaches backup content.
Backup Admin, at a Client
The client's in-house IT person. Restores files, folders or email within your limits and can run an on-demand backup before a change.
Your Clients Log In and See Your Name
Invite clients to view protection status and activity in a console carrying your name and support details.
Their Protection, Under Your Name
A verdict first: how many resources need attention, then the evidence. Your name and support number on every screen, and your logo once you upload it. Their own record of every action on their data and every EnterProtect access lease. You create every client login, so you hold the full list of who can reach their data. Their access is limited to their own organization, with support requests directed to your MSP.
Questions About the Console
Have a question about your setup? Contact our team.
Do I need a separate console for each EnterProtect product?
No. Every product runs at console.enterprotect.com, in the same destinations: one alert queue, one way to restore, one set of reports. Each product's own depth sits inside them, so a BCDR alert and a Microsoft 365 alert read the same way.
How does EnterProtect cut down alert noise?
Repeated events for one root cause update one alert, and an upstream failure never creates a wall of downstream ones. An appliance outage behind fifty resources is one alert with a scope of fifty, and it resolves itself when the appliance returns.
Which PSAs does EnterProtect work with?
ConnectWise PSA and CommandIT. In ConnectWise PSA, a routing table sends each alert type to a service board, type and subtype, with a default row so nothing goes unrouted. CommandIT receives the alert stream and routes it with its own rules, which the console shows read-only. Either way, one alert carries one ticket.
Can I write my own alert rules?
No. EnterProtect manages alert rules and escalation templates. You decide who hears what: routing by severity, product and site, with escalation, and quiet hours that a critical alert overrides.
Can I create custom roles?
No. The roles are fixed and their permissions can't be edited, so two people with one role always hold the same powers. An Owner or Administrator can preview the console as any role before assigning it, and a preview only ever narrows what you see.
Can my clients log in to EnterProtect?
Yes, once you invite them. A client user is a Viewer or a Backup Admin inside exactly one organization, and the invitation carries your name. Clients can't invite anyone, including their own colleagues, so you always hold the full list.
What if a bulk change goes wrong?
Undo it. Where the action recorded the previous value, one action restores it, with its own preview and record. Machines a later action changed aren't dragged back. Where an action can't be undone, enrolment for one, the preview says so before you confirm.
Is MFA required on the console?
On every account. Passkeys are preferred, an authenticator app is the fallback, and Owners need a phishing-resistant passkey. A password alone never completes a sign-in, and actions like an export, a production overwrite or a retention change need a fresh second factor no more than ten minutes old.
How fast does EnterProtect support respond?
Critical within 1 hour, around the clock. Warning within 4 business hours. A question by the next business day. You set the severity, and support doesn't retune it.
One Queue for Everything You Protect
Microsoft 365, servers, files and scanning land in the same queue, with the same proof behind every restore. Start with the product your clients need first.
Commitments in Writing
- One console for every product, with no second portal to log into.
- Backup duty never carries the right to read client data.
- Acknowledging an alert never changes what's true about a resource.
- Your clients see your name on every screen, never your costs.