I recently started working as a technician for a small MSP that mainly supports dental practices. My previous experience was in a large corporate IT environment with well-defined processes, but many of these smaller offices have shared workstation passwords, local administrator access, and no domain infrastructure.
My boss wants us to improve security for some existing clients, while all new clients will receive managed user accounts and a more structured identity setup. I'm comfortable with on-premises Active Directory, but I'm unsure how far we can go with larger existing practices without migrating them to a domain. Dental applications such as Dentrix, Eaglesoft, OpenDental, imaging systems, cameras, and chair hardware may also require local services or elevated permissions.
What would be a practical security-improvement plan for these offices? I'm especially interested in identity and MFA, endpoint protection, patching, backups, network security, compliance responsibilities, and whether Microsoft Entra ID and Intune, on-premises Active Directory, or a combination makes the most sense. We currently use NinjaOne for RMM and ticketing, OpenText, and Ubiquiti network equipment.
5 Answers
Microsoft 365 can be a good route for smaller practices if they already rely on it. Entra ID provides cloud identities and MFA, while Intune and Defender can enforce device configuration, compliance, encryption, application controls, and security policies. It can reduce dependence on traditional domain controllers, but licensing, application compatibility, and the location of dental servers still need to be evaluated. Entra-only management will not automatically replace an on-premises domain for software that depends on a local server, file shares, or legacy authentication.
If an office already has legitimate Windows servers and several workstations using local file shares or server-hosted dental applications, an on-premises domain can still be a sensible option. Use individual accounts, separate administrator accounts, Group Policy, managed updates, strong backups, and segmented networks for workstations, servers, guest devices, cameras, and medical equipment. The right answer is not automatically cloud-only or domain-only; it should follow the software, infrastructure, and budget of each practice.
Start with the client’s compliance and risk requirements rather than treating this as purely an IT project. The practice should have designated privacy and security responsibilities, a documented risk assessment, policies for handling protected health information, an incident-response plan, and an appropriate business associate agreement with the MSP. A compliance consultant can help translate those requirements into technical controls, while you implement and document the safeguards.
That distinction matters because the client owns the compliance risk. The MSP can recommend controls and manage them, but the practice needs to approve the priorities, budget, and policies.
Make the business case in terms the practice owner understands: fewer ransomware risks, less chance of an employee accessing records they shouldn’t, faster recovery, and clearer accountability. Put the recommendations into a written security roadmap with priorities, costs, client approvals, and deadlines. Some owners may resist changes or refuse necessary spending, so record those decisions and define what the MSP can and cannot responsibly support.
Build a baseline in stages: eliminate shared accounts, create named user accounts, remove routine administrator access, enable MFA everywhere possible, deploy centrally managed endpoint protection, establish regular patching, and verify that backups are both offline or otherwise isolated and regularly tested. Document exceptions instead of quietly leaving insecure settings in place. Dental software may require special permissions, so work with each vendor to find the least-privilege configuration rather than granting everyone local admin by default.
Dentrix, Eaglesoft, OpenDental, imaging platforms, cameras, and chair equipment can all have unusual requirements. Inventory those dependencies first and test changes on one workstation before rolling them across a practice.
Before choosing cloud-only management, find out where the practice hosts its dental and imaging applications. Many offices still run those services on local Windows servers, which may make a traditional domain or a hybrid design more practical.