Frequently asked questions

Answers for MSPs building an AI practice

The questions our partners ask most, from the first client conversation to the monthly AI council.

Getting started

What is Lemhi?

Lemhi is the vCAIO platform for MSPs. It gives your team one repeatable way to find AI opportunity with clients, assess readiness, build the strategy and AI policy, get the Microsoft 365 data ready, and then deliver and manage AI as a recurring service.

Engage and Compass are 2 areas of the same platform. Engage covers the front of the journey (AI Intel, the AI Assessment, strategy and roadmap). Compass covers carrying out the plan (playbooks, agents, configuration and the ongoing managed service).

Is Lemhi a service? Will Lemhi engineers do the work for my clients?

Lemhi is a platform your team uses to run your own client engagements. Your people own the client relationship and the delivery. The platform gives step-by-step guidance for every phase, and the Lemhi team works alongside you while you get your first engagements running.

Can my clients buy Lemhi directly?

No. Lemhi is built only for MSPs. Your clients experience it through your brand: the survey, invitations, reports and client portal all carry your logo and colors.

Can I try Lemhi before I commit?

Yes. Most MSPs start with a walkthrough of the platform, then get a trial account. You can run AI Intel on a real prospect, send the AI Assessment to your own team, and explore sample clients with finished example deliverables you can use as sales assets.

Do we need a development team to deliver AI services?

No. Most business use cases can be handled with the AI tools clients already have, like Microsoft 365 Copilot and Claude, plus prebuilt agents. The early work is governance, data readiness, training and quick wins. Custom builds come later, once those tools reach their limits, and can be scoped as separate projects.

Selling and delivering managed AI

What is Baseline, Deliver, Maintain?

It's the 3-phase path every Lemhi engagement follows.

  • Baseline: understand where the client stands. AI Intel, the employee survey, the Microsoft 365 tenant scan, shadow AI discovery and use-case priorities.
  • Deliver: turn the findings into an AI strategy, roadmap and acceptable-use policy, clean up the data foundations, and launch the first prioritized use cases and agents.
  • Maintain: run AI as a recurring managed service, modeled on the vCIO programs you already know.

How should we start AI conversations with existing clients?

Lead with curiosity, not a pitch. Use the meetings you already hold (QBRs, TBRs and alignment meetings) to ask open questions about how people are using AI, where they feel friction, and what worries them. Then make the AI Assessment the consistent next step.

Keep the first conversation about discovery rather than answering every tool question, and don't force AI into every meeting. A good way to start is to test the motion with 3 friendly clients.

Do clients have to go through every phase in order?

No. It depends on the client's maturity and how much they already trust you. Less mature clients usually start with the assessment, workshop and roadmap. Trusted, more mature clients can often go straight into a managed AI agreement, with the assessment and roadmap work handled as part of onboarding.

What does an ongoing managed AI service include?

Think of it as a virtual chief AI officer (vCAIO) for the client. The core is a monthly AI council with leadership and AI champions from across departments. Each month covers:

  • Shadow AI findings and new tool requests
  • Data governance and a fresh tenant scan
  • Agents delivered and coming next
  • Adoption, training needs and new use cases
  • Roadmap and policy updates

Most partners reassess clients every 6 months to show progress.

How is managed AI different from managed IT? Won't clients expect it to be included?

AI readiness is a new scope area, with its own systems, policies and ongoing work. Position it as an addition to managed IT, not something that was missing from it. Your advantage over an outside consultant is that you already know the client's tech stack, security environment and data.

Clients say they already have Copilot or ChatGPT. Why would they need us?

A license isn't a strategy. Clients still need to know which use cases are worth it, how to keep company data safe, which tools are approved, and how to get people using AI well. Training, governance and use-case planning are what turn a license into results.

A client wants custom AI agents or apps right away. How should we handle that?

Steer them to the assessment before any development. Deliver quick, governed wins with the tools they already have during the first 90 days, then bring in custom work when those tools reach their limits. Starting with out-of-the-box capabilities reduces technical debt, brittleness and tool sprawl.

How do we sell AI governance without fear-based selling?

Lead with opportunity. Present security and data findings as prerequisites for moving fast safely, not as reasons to stop. The message to clients: you're not saying no to new AI tools, you're making the environment safe enough to adopt them quickly.

Can AI services help us win prospects who already have an MSP?

Yes. Managed AI is an additive entry point. You can offer it as a standalone or co-managed service alongside a prospect's current provider, starting with AI Intel and the assessment. It builds trust without asking anyone to switch providers on day 1.

A client asks us to connect Claude or another AI tool to Microsoft 365. What should our help desk do?

Say "yes, and." Route the request to the client stakeholder who approves AI tools, start with a limited pilot for a small group with named ownership, and review it through the assessment before granting broader access. Treat AI requests as a path into the assessment rather than isolated tickets.

AI Intel and the AI Assessment

What is AI Intel, and what data does it use?

AI Intel is an outside-in research report you can run on any prospect or client with just a company name and domain. It uses public information like the company website, job postings, press coverage and industry data to surface likely AI opportunities, risks, use cases and industry trends. No Microsoft 365 connection is required.

Use it to open the conversation: pull 2 or 3 insights into outreach, or present the full briefing to an engaged prospect.

What if a client says the AI Intel report got something wrong?

Treat it as part of the conversation. AI Intel is a starting point built on public data, not a verdict, so ask the client what's actually true and use the assessment to validate it. Before running a report, you can add client context and exemptions to keep it focused, and you can edit the wording, reorder sections or hide them before you share it.

When should we skip AI Intel?

AI Intel helps most when a client doesn't yet know where AI can help. If a client is already using advanced AI features or building their own applications, go straight to the AI Assessment.

What does the AI Assessment include?

It combines a short employee survey with a scan of the client's Microsoft 365 tenant. The survey takes most people about 5 minutes and covers their role, AI comfort and usage, the tools they use, the use cases that matter to them and the time they think they could save.

The client receives a workshop presentation with team-by-team results, a tool report on shadow AI and governance, risk findings, roadmap recommendations and a prompt library tied to the workflows employees chose.

How do we get more employees to complete the survey?

Have the client's leader send it, not you. People respond to their own leadership. Lemhi drafts the leader's email for you, and you can kick it off during a live meeting.

  • Set a due date and book the results review before the survey goes out.
  • For companies under about 40 employees, send it to everyone. Larger companies can start with leadership.
  • Have the leader say plainly that naming personal or unapproved tools won't get anyone in trouble.
  • Automatic reminders go out after 3 and 7 days.

A client added a new AI tool after their assessment. Do they need a whole new assessment?

No. Add the tool to their inventory, review its configuration, permissions and data-training settings, and update the acceptable-use policy. Save the full reassessment for the regular cycle.

How often should clients be reassessed?

Most partners reassess every 6 months, and rerun the tenant scan monthly as part of the managed service. Governance itself is ongoing, since new connectors, agents and AI features arrive constantly.

How do we find AI champions inside a client?

Use the survey's comfort ratings. Employees who rate themselves highly are natural champions, and pairing them with people who rate themselves low is one of the fastest ways to lift adoption. Invite your strongest users to the monthly AI council.

How reliable are the time-savings estimates?

They come from employee estimates, so use them to compare and prioritize use cases, not as a precise ROI or headcount forecast. You can break the results down by department, group and respondent, and adjust the estimates, so a few power users don't skew the picture.

Microsoft 365 and connecting clients

Do we need GDAP to use Lemhi?

You need it for the technical half of the platform: the tenant scan, AI data governance, AI observability and deploying agents. Lemhi connects through the GDAP relationships you already manage in Microsoft Partner Center, so clients don't sign in, grant new admin roles or install anything.

AI Intel and the employee survey work without any Microsoft connection. You don't need a reseller (CSP) relationship, and clients who buy Microsoft licenses directly are fully supported.

Which GDAP roles does Lemhi need?

To connect a client, the GDAP relationship needs Application Administrator or Cloud Application Administrator, assigned to a security group that includes the admin who connects Lemhi. That admin also needs to be in AdminAgents.

For full coverage, add Global Reader, Reports Reader, Security Reader, Compliance Administrator and Power Platform Administrator. Microsoft fixes a relationship's roles when it's created, so request the full set up front.

A client's tenant won't connect. What's usually wrong?

The most common causes:

  • The GDAP relationship was approved, but its roles were never assigned to a security group that includes the connecting admin.
  • The only relationship is an automatic one from Microsoft's DAP-to-GDAP transition (names starting with MLT_), which usually lacks a consent role.
  • The connecting admin isn't a member of AdminAgents.

Fix the setting in Partner Center, then click Connect again.

What does the tenant scan check?

It reviews Microsoft's AI readiness controls across Microsoft 365, Entra ID, Defender, Purview, SharePoint and Teams, along with licensing, connected AI apps and agents. Typical findings include Conditional Access gaps, incomplete MFA coverage, missing DLP and sensitivity labels, overshared or inactive SharePoint sites, and third-party apps with too much access. You can rerun it any time to show remediation progress.

Does Lemhi work for clients on Google Workspace?

AI Intel, the employee survey and the strategy, roadmap and policy work all apply to any client. The technical tenant scan currently requires Microsoft 365, and Google Workspace support is on the roadmap.

Does Lemhi help with SharePoint cleanup and oversharing?

Yes. Compass playbooks walk your team through tenant remediation step by step, and Lemhi can restrict selected SharePoint sites from organization-wide search and Copilot. Cleanup still takes hands-on work. Start with the highest-risk data, restrict broadly, then open up a small set of well-organized sites rather than trying to label every file.

Security, data and shadow AI

Does Lemhi read our clients' email, files or chats?

No. Lemhi reads configuration, security posture and aggregate usage data to score readiness. It never reads mailbox contents, file contents, Teams messages or calendar details.

Can Lemhi change anything in a client's tenant?

Every assessment and scan is read-only. Lemhi writes to a client tenant in only 3 places, and only when someone on your team takes the action: deploying an agent you built, applying specific Copilot and SharePoint settings, and restricting selected SharePoint sites from search. Nothing changes automatically, and you can revoke access at any time.

Where is data stored, and is it used to train AI?

Lemhi runs entirely on Microsoft Azure in the United States. Data is encrypted at rest and in transit, and each MSP's data is separated from every other MSP's. Lemhi does not train AI models on your data and does not sell or share it. If you leave, your records are deleted.

Can you share security documentation for our review?

Yes. We share our Security and Privacy Overview, which lists every Microsoft permission Lemhi uses and why, complete vendor security questionnaires, and will walk your security team through the architecture. Contact us to request it.

Can Lemhi find shadow AI tools like ChatGPT and Claude?

Yes, from 2 directions. Lemhi shows every app connected to the client's Microsoft 365 tenant and what it can access, including Claude and ChatGPT connections. The employee survey captures the tools people say they use, including personal and browser-based tools. You can also add tools by hand. It all rolls into a branded tool report with a governance score and remediation plan.

Does Lemhi block unapproved AI tools or monitor what people type into them?

No. Lemhi provides governance and visibility, not enforcement. To block tools or monitor devices and prompts, pair Lemhi with the security stack you already run, such as Microsoft Defender, your endpoint protection or DNS filtering, and record what those tools find in Lemhi so it shows up in the client's reports and plan.

Is it risky to approve Claude or ChatGPT as an app in Microsoft 365?

It can be. Once an AI app is approved in the tenant, any employee may be able to connect it and expose whatever data their own permissions reach. Before approving, review the connector's permissions (especially write access and sending email), restrict sensitive SharePoint sites, and start with a small pilot group.

Our clients are in regulated industries. How does Lemhi help?

AI Policy Builder lets you tailor each client's acceptable-use policy to their data, industry rules and legislation, whether that's HIPAA, CJIS, financial-services record keeping or a municipality's restricted-tool list. You can also add client context and exemptions so reports and recommendations match the client's compliance posture.

Who owns the leads that come through our website assessment?

You do. Leads from your embedded website assessment belong to your MSP and are visible only to your team.

Branding, integrations and exports

Can client deliverables carry our brand?

Yes. Lemhi is white-labeled. Set your logo, browser icon, colors and typography once in your branding settings, and the survey, invitation emails, reports and client portal all carry your brand.

Can we embed an AI assessment on our website to generate leads?

Yes. The embeddable website assessment lets visitors pick their top business challenges, get a tailored AI roadmap and book a meeting with you. Each submission creates a client record and kicks off an AI Intel report in your dashboard. It accepts work email addresses only, and you can require job title to filter out low-quality submissions.

Can we export reports and edit them?

Yes. The workshop presentation exports as editable PowerPoint with speaker notes, and reports export as PDF, Word or Markdown. Before exporting, you can reorder or hide pages and save the layout as a template. You can also hide your own MSP tools so they don't show up in client reports.

Does Lemhi integrate with our PSA or ScalePad?

Today you can export tenant findings as a CSV to open remediation tickets in any PSA, and attach Lemhi reports to the client record. ConnectWise PSA and ScalePad integrations are on the roadmap.

Does Lemhi include prebuilt agents?

Yes. The agent library includes prebuilt agents you can review, customize and deploy into a client's tenant, plus an agent builder that drafts an agent from a plain-language workflow description and your SOPs. Save your best builds as templates and reuse them across similar clients. Agents deploy to Microsoft 365 Copilot today, with Claude support coming.

Onboarding, training and support

What does onboarding look like?

You start by running Lemhi on your own MSP as customer zero, so your team has seen every report and survey before a client does. From there you learn each phase of the client journey and launch your first client engagement alongside it.

Who from our team should be involved?

The 2 people who get the most out of it are the person who will own the AI conversation with clients (often a vCIO or account manager) and the person who will deliver the technical work. Your owner or practice lead should be involved in shaping the offer. Staff who only need training can get a training-only role with no client data access.

What training is available for our team?

Every partner gets Lemhi Labs: live sessions every week plus a library of recordings covering each step of the client journey, AI fundamentals and AI sales. Slides, transcripts and videos are downloadable, and you're welcome to remix the slides for your own client training. The Learn agent in the platform answers questions about selling, delivery and where to find things.

What sales and marketing resources do partners get?

Partners get go-to-market enablement built for MSPs, including:

  • Sales workshops and role-play sessions
  • A white-labeled webinar deck that leads with education
  • Sales playbooks, conversation scripts, question banks and objection handling
  • One-sheets, messaging documents and landing-page copy
  • Sample clients with finished deliverables to show prospects

How do we get help when we have a question?

Every partner gets a shared Microsoft Teams channel with the Lemhi team. Ask there anytime, whether it's a platform question or help preparing for a client meeting.

I didn't receive my Lemhi invitation. What should I do?

Check your junk or spam folder first, since some email filters hold new senders. If it isn't there, ask your Lemhi contact to resend it or send a direct access link.

Still have a question?

Walk through it with our team

We'll show you how other MSPs run the process and answer what's specific to your clients.