Rentals
Shop Online
  • Security · Microsoft Defender and Sentinel

Defended in depth. Proven on paper.

Braintree is your security operations partner. We harden your Microsoft environment, watch it around the clock on Defender and Sentinel, and produce the compliance evidence your board and regulator ask for.
Book a posture review
Run the posture check
Microsoft Secure Score, Efficient Group
0 %
Detection and response coverage
0 /7
SA businesses
0 +
Microsoft-certified professionals
0 +
  • The wedge

We run your defence. We do not resell tools.

Most providers sell you a licence and a dashboard, then leave you to watch it. Braintree runs managed detection and response on the Microsoft Defender and Sentinel signals already in your tenant. We hold the posture, every day after, and we have the evidence to prove it.
  • Defence in depth

Five attack surfaces. One operations centre watching.

Attackers do not pick one door. Braintree’s security operations centre watches all five, on the Microsoft signals already inside your tenant, and feeds every one into Microsoft Sentinel. Detection is tuned. Response has a clock.

Surface 01

Identity

  • Microsoft Entra ID
    Conditional access, multi-factor enforcement and privileged identity management. The most attacked surface, closed first.
  • Access reviews
    Scheduled reviews of admin roles and standing access. Stale privilege is removed before it is abused.
Surface 02

Endpoint

  • Microsoft Defender for Endpoint
    Attack-surface reduction rules, device compliance through Intune, and behavioural detection on every managed device.
  • Ransomware recovery
    Immutable backups and tested restores. A measured time to recover, not a hope.
Surface 03

Email and apps

  • Microsoft Defender for Office 365
    Phishing, malware and malicious-link protection across Exchange, Teams and SharePoint.
  • Safe Links and Safe Attachments
    Every link and file checked at the moment of click. The surface most breaches start on, closed.
Surface 04

Data

  • Microsoft Purview
    Sensitivity labels, data loss prevention and retention policy. The controls a compliance evidence file is built from.
  • Compliance evidence file
    Documented controls for POPIA, GDPR or whichever regulator applies. Audit-ready on demand, not reconstructed after a request lands.
Surface 05

Cloud

  • Microsoft Defender for Cloud
    Cloud security posture management across your Azure estate. Misconfiguration found before an attacker finds it.
  • Workload protection
    Servers, containers and databases monitored for threats, on the Azure regions your data must live in.
  • The operations layer

Braintree Security Operations Centre

Every signal above flows into Microsoft Sentinel and into a security operations centre staffed around the clock. SA-based analysts, tuned detections, documented response playbooks, and a monthly posture report written for the board. Detection without an operations centre behind it is just a louder alarm.

  • How we hold the line

A posture, not a project. It runs in a loop.

Security is never finished. We cycle through four phases continuously, so your defence improves the longer we run it.
01

Assess

Baseline Secure Score, map the gaps, document the risk register you sign off.

02

Harden

Conditional access, MFA, sensitivity labels and retention enforced.

03

Monitor

24/7 detection on Defender and Sentinel signals across all five surfaces.

04

Respond

Contain, remediate, report. Then the findings feed straight back into Assess.

sec serverrows | Braintree
Inside the estate we defend. Posture is held on the floor, not on a slide.
  • Proof, not promises

96%

Microsoft Secure Score reached at Efficient Group, international best practice.

We are building platforms that will make us a pioneer, based on future proof infrastructure.
Heiko Weidhase, CEO of Efficient Group. A 500-staff financial services firm, secured and migrated to Azure with Braintree
  • The honest comparison

A third-party MSSP, Braintree, and the practical winner.

What you get Third-party MSSP
The signals Bolted-on tooling beside your tenant
✓ Defender and Sentinel already in your tenant
Microsoft depth Generalist across many vendors
✓ Microsoft Solutions Partner, security specialised
Compliance evidence You assemble it
✓ Board-ready evidence produced for you
Data residency Often offshore
✓ On the two South African Azure regions
The relationship One of many security vendors
✓ One agreement across your whole Microsoft estate
Concierge breadth A large MSSP can staff a wider after-hours bench Focused on the Microsoft stack
5 to 1 in Braintree's favour. A big MSSP wins on raw concierge breadth. Honest.
  • One posture. The commercial case.

One Microsoft Partner. One Intelligent Agreement. One Unified, Secure Solution.

Security bolted on as a separate vendor means a separate contract, a separate SLA, and a gap at every handoff between your productivity partner, your cloud partner and your security tool. Braintree closes the gap. Productivity, cloud and security on one Microsoft Customer Agreement, one operations centre, one accountable team.
A separate security vendor, a separate contract, a gap at every handoff.

Before. Security bolted on.

  • A standalone security tool with its own agent and its own licence
  • A separate contract and a separate renewal cycle
  • Finger-pointing between IT partners when something fires
  • No single team accountable for the Secure Score
  • Compliance evidence scattered across vendors
One Braintree agreement. One operations centre. One posture.

After. One Intelligent Agreement.

  • Microsoft Customer Agreement across Azure, Microsoft 365 and security
  • One operations centre watching productivity, cloud and posture
  • One team accountable for the Secure Score and the incident clock
  • One quarterly review across the whole Microsoft estate
  • One compliance evidence file. Current, and audit-ready.
  • Data sovereignty, by design

Your data stays where the law says it must.

Workloads run on the Azure regions you choose, including both South African regions. Data residency is the default, not an opt-in.
And when your board or your regulator asks, POPIA, GDPR or whichever framework applies, the audit trail, the retention policy and the posture report are already written.
Azure regions worldwide to anchor your data in
0 +
Azure regions in South Africa
0
Evidence file, current and audit-ready
0
  • FAQ

What CISOs ask before they book.

Where does our security telemetry and POPIA evidence live?
On Microsoft Azure South Africa North in Joburg, with three Availability Zones, or Microsoft Azure South Africa West in Cape Town. POPIA-aligned by default. The Information Regulator’s 2026/27 priorities shifted from reactive complaints to proactive monitoring. The first direct-marketing fine of R100,000 was issued to FT Rams Consulting. The maximum penalty is R10 million or 10 years. A security partner with SA Azure operations keeps your telemetry and your evidence file resident. Braintree can.
Both. Braintree managed security runs as a standalone service on your existing Microsoft tenant, with its own scope, its own SLA and its own invoice. It also folds into the One Agreement alongside Azure and Microsoft 365 when Braintree already runs your Microsoft estate. Your commercial model and your existing partner relationships drive the choice. The operations centre and the posture are the same on either path.
A third-party MSSP layers its own agent, console and concierge service on top of whatever you run. Braintree manages security directly on the Microsoft Defender and Sentinel signals already in your tenant. No duplicate agent, no second SIEM, and the Secure Score and POPIA evidence come from Microsoft’s native tooling. Both deliver around-the-clock managed detection and response. Managed Defender is usually simpler to run and more cost efficient when your Microsoft spend is already consolidated. A dedicated MSSP wins on concierge breadth. Choose the model that fits your architecture.
It means data classification with sensitivity labels, retention and deletion policies, documented access controls, a breach notification workflow that meets Information Regulator timelines, and an evidence file that records each control. Plus data residency on the South African Azure regions by default. The architecture is documented and maintained, not a policy PDF written once and filed.
The operations centre watches around the clock. A Severity 1 incident triggers a responder inside the SLA committed in your scope of work, with an SA-based engineer on the call. Documented playbooks cover containment, eradication, evidence preservation and stakeholder notification. The clock and the playbook are agreed before anything fires, not improvised during it.
Microsoft Secure Score with a trend line, an incident summary with response times, a Defender signal overview, MFA and conditional access coverage, backup and recovery test status, POPIA evidence file updates, and a one-page board summary. It is written for the audit committee, not for the operations centre.
Yes. Standalone managed security runs on your existing Microsoft tenant with a clear scope boundary. Your productivity and infrastructure partners continue their engagements untouched. Braintree takes the security layer with a defined scope of work, a defined SLA, and a documented handover protocol for shared change management.

Three answers. Credentials. Braintree is one of nine Microsoft Managed Partners in South Africa. With 220+ SA businesses, 100+ Microsoft-certified professionals and 10+ years on Microsoft. Residency. The honest answer to where your telemetry and evidence live comes from a partner with SA Azure operations. Operations. Braintree runs a security operations centre, not just a tool. Detection without an operations centre behind it is just a louder alarm.

  • From the Braintree practice

Insights for CIOs and CISOs hardening their Microsoft environment.

sec dashboard | Braintree

Posture

Microsoft Secure Score. The one number your board should track.

What Secure Score actually measures, why it beats most third-party risk scores, and how to move it from a low baseline to international best practice inside a year.
  • In production
sec analysts | Braintree

POPIA breach reporting. What the Information Regulator expects.

Compliance

Timelines, evidence and notification steps. And the controls the Regulator expects documented before a breach, not scrambled together after one.
  • In production
sec ins3 | Braintree

Managed services

Managed Microsoft Defender or a third-party MSSP. Which fits an SA business?

A positioning-neutral comparison. Where a dedicated MSSP tool wins, where Managed Microsoft Defender wins, and how to choose without the vendor noise.
  • In production
  • Where this connects

Security wraps the whole estate.

Azure Cloud

The infrastructure we defend. Managed cloud on the South African Azure regions, with Defender for Cloud built in.

Visit Azure Cloud
Microsoft 365 logo (2022)

Modern Workplace

The people we protect. Microsoft 365 deployed, adopted and hardened, with Secure Score held above the Copilot threshold.

Visit Modern Workplace

Support & Managed Services

The team behind it. One proactive operations team across your whole Microsoft estate, under one agreement.

Visit Support & Managed Services
  • Book the 30-minute posture review

Let's grow.

We will show you your Secure Score posture, the gaps an attacker would use first, and the compliance
evidence you are missing. On one agreement, with one team accountable for the outcome.
Book a posture review
Run the posture check
Specialists in Business Applications, Modern Workplace and Azure.