Every other page in this series is about what the MSP console can do for your clients. This one is about what it could do to them in the wrong hands: one console that can push software and open remote sessions on every computer you manage. That makes it the single most valuable target in your business — guard it like one.
An MSP console is a force multiplier in both directions. The same reach that lets you patch ten clients in an evening would let an intruder touch ten clients in an hour. The defences are known and mostly free: two-factor authentication on every login, HTTPS only, named scoped accounts, a patched and backed-up server, and tight control of who can reach the console at all. Work through this list once, properly.
Enable two-factor authentication for the Endpoint Central console and enforce it for every user, administrators first. The MSP console's password alone should never be enough to reach every client's network. Pair this with real password discipline: unique passwords in a password manager, no browser-saved master passwords on shared PCs, and immediate disablement when a staff member leaves. Most MSP compromises do not begin with exotic hacking; they begin with one reused password and no second factor.
Everyone logs in as themselves, with the smallest role and scope their job needs (the roles guide in this series covers the setup). Shared accounts destroy accountability — when every action in the audit log says “admin”, no action can be attributed. Keep true administrator accounts to named seniors, and review the user list monthly: leavers disabled, scopes still matching real client assignments, no account you cannot explain. Ten minutes, once a month, every month.
Ask a blunt question: does the console login page need to be reachable from the whole internet? For many MSPs the honest answer is no — restrict access to your office network and a VPN for field staff, or at least to known IP ranges. Roaming agents still need their channel to the server, which is a different, narrower exposure than the human login page. Reducing who can even attempt a login shrinks your attack surface more than any password policy.
Your Endpoint Central server runs software too — keep its operating system and the product itself updated, because a management server with a known vulnerability is a skeleton key. Back up the server and its database on a schedule, and test a restore at least once a quarter: if this server dies or is encrypted by ransomware, your recovery of every client's management depends on that backup being real. Finally, read the console's audit and login reports — failed logins and odd-hour admin actions are the early smoke of exactly the fire this page exists to prevent.
See Endpoint Central MSP running live — customers, offices and agents on one screen, step by step.
▶️ Watch Full VideoTwo-factor authentication on every login, administrators first. It defeats the most common real-world attack — a stolen or reused password — in one move. HTTPS, scoped named accounts and tested backups complete the set.
Agent communication and the human login page are different exposures. Agents need their channel to the server, but the web console login can usually be restricted to your office network, a VPN or known IP ranges. Restrict the login page as tightly as your working pattern allows.
Monthly, as a fixed routine: disable leavers the day they leave, check every scope still matches real assignments, confirm the administrator list has not grown, and look for shared accounts. Access rots quietly; the review is what stops the rot becoming an incident.