What is IT AMC in the USA and why do businesses need it?

IT AMC (Annual Maintenance Contract) in the USA is a comprehensive service agreement for maintaining all IT equipment and systems. Businesses need IT AMC for predictable costs, 24/7 support, preventive maintenance, reduced downtime, and expert technical assistance. It's the most affordable way to ensure reliable IT operations.

How much does IT AMC cost in the USA?

IT AMC pricing in the United States is scoped per engagement and depends on the number of devices, support level, and services included. Small businesses with basic coverage sit at the entry level, and comprehensive packages scale with the size of your estate. We offer the best affordable IT AMC solutions in United States with customized pricing.

What is included in managed IT services in the USA?

Our managed IT services in the USA include complete IT infrastructure management, 24/7 monitoring and support, cybersecurity, cloud services, backup and disaster recovery, help desk support, network management, and proactive maintenance. It's a complete IT department solution with affordable monthly pricing.

What is the response time for IT support in the USA?

GR IT Services responds to P1 critical issues in 5 minutes for managed clients, delivered remotely. We offer 24/7 reliable IT support to businesses across the USA with a guaranteed SLA.

Which areas in the USA does GR IT Services cover?

We provide IT support and managed IT services across all major USA cities including New York, Los Angeles, Chicago, Houston, Phoenix, Philadelphia, San Antonio, San Diego, Dallas, and San Jose. We serve businesses nationwide with complete IT support.

Why is GR IT Services the best IT company in the USA?

GR IT Services combines reliable 24/7 support, a 5-minute P1 response SLA, complete IT solutions, and certified Microsoft CSP and Apple Jamf partner status. We provide IT AMC and managed IT services across the USA with a guaranteed SLA and senior engineers on every engagement.

Microsoft Defender for APIs for US businesses

Which of your APIs run unauthenticated, and which have had nobody call them in 30 days?

Both questions get answered from traffic actually observed rather than from documentation somebody wrote. An endpoint is marked inactive once 30 days pass without a call. An API is marked unauthenticated when none of the expected authentication mechanisms executed during a call. For any American business whose products and partner integrations run on APIs, that observed evidence separates a real inventory from an educated guess.

Book an API security review See what it finds

Microsoft Defender for APIs for US organizations

30 daysWithout traffic before an endpoint is Inactive
OWASP API Top 10Covered by runtime threat detection
ObservedFindings come from traffic, not from specs
Azure APIMThe scope of the plan today

What Defender for APIs does

Eight things it tells you that documentation does not.

What makes this valuable is that all of it derives from real traffic. Build an API inventory from specifications and you have documented intent. Build one from observed calls and you have documented what is genuinely running. Those two lists differ every single time.

An inventory of what is actually published

One dashboard aggregates every managed API you have, broken out by API collection, by endpoint and by Azure API Management service. Where teams publish APIs independently of one another, this is very often the first complete list anybody in the business has ever seen.

Which endpoints are unauthenticated, measured properly

Authentication gets assessed by checking for API Management subscription keys wherever a subscription is required, and by checking whether the policies validating JWT, client certificates and Microsoft Entra tokens actually executed. Where none of them ran during the call, that API is marked unauthenticated.

Which endpoints nobody is using

Any endpoint that has taken no API call traffic across the last 30 days is marked inactive, carrying a last called date recorded in UTC. An unused API is pure attack surface offering nothing in return, and the recommendations say explicitly to disable and remove them.

Which endpoints are exposed externally

There is an external traffic observed date showing when external API traffic was last seen travelling to or from that endpoint. It distinguishes an API that is theoretically reachable from one that outside parties are genuinely calling, and those two are entirely different risk conversations.

Which APIs handle sensitive data

Request and response bodies get classified against the supported data types so that risk can be prioritized properly. Without that classification, an unauthenticated endpoint returning nothing of consequence and an unauthenticated endpoint returning personal data read as identical findings on the same list.

Runtime threat detection across the OWASP API Top 10

Ingested API traffic is monitored with runtime anomaly detection driven by machine learning alongside rule-based analytics. The alerts span the top ten OWASP API threats, data exfiltration, volumetric attacks, anomalous and suspicious API parameters, anomalies in traffic and IP access, and unusual usage patterns.

API risk in the wider attack path picture

Run Defender CSPM alongside this and the Cloud Security Graph analyzes assets and the connections between them to expose risk and possible lateral movement paths, while the Cloud Security Explorer ships two built-in query templates aimed at identifying risky API assets.

Findings where the people who own APIs already work

Once the plan is on, API security recommendations and alerts surface inside the Azure API Management portal as well as in Defender for Cloud, and those alerts export out to a SIEM such as Microsoft Sentinel. Findings that reach the API team without anyone having to switch portals get acted on considerably more often.

How the findings are actually produced

Because every part of this derives from observed traffic, the inventory it produces tends to surprise people.

That one design decision explains both why the findings hold up so well and why a single behavior confuses teams during onboarding.

Nothing about authentication gets read from a specification. It is assessed by checking whether API Management subscription keys were present where a subscription is required, and whether the policies validating JWT, client certificates and Microsoft Entra tokens genuinely executed. An API that documents its authentication beautifully and never executes it is marked unauthenticated.
Usage gets measured on the same principle. An endpoint with no API call traffic across the last 30 days is marked inactive and carries a last called date in UTC, while external exposure is recorded as the date external traffic was genuinely observed rather than as a property somebody set in a configuration file.
Here is the behavior that confuses people during onboarding, and it follows directly from all of that. Any API endpoint that has received no traffic since it was onboarded shows the status awaiting data. That is neither an error nor a gap in coverage. It is the plan waiting for a call it can observe.
The practical consequence is that this inventory becomes more valuable across the first few weeks rather than being complete on day one. Assess the day after onboarding and you will see a great deal of awaiting data. Assess a month later and you learn which endpoints are used, by whom, from where, and whether authentication genuinely occurred.

Ask us to run a 30 day API assessment

How we approach it

Four things that make an API program produce change.

Findings about APIs are usually accurate and usually ignored, because they land with a security team holding no authority over the code and no working relationship with the developers who wrote it.

We let it observe before we report

An endpoint with no traffic since onboarding shows as awaiting data, and inactive status needs a full 30 days without a call before it means anything. Run the assessment in week one and you get an incomplete picture plus an argument nobody needed to have. Waiting out the window is what makes these findings defensible.

We lead with unauthenticated endpoints, evidenced

The authentication assessment verifies whether subscription keys were present where required and whether policies validating JWT, client certificates or Entra tokens actually executed during the call. That is observed evidence rather than a configuration review, which is a much harder finding to dismiss.

We remove what nobody uses first

Disabling and removing unused APIs is one of the explicit recommendations, and it is the only security improvement that costs nothing and breaks nothing. Endpoints inactive for 30 days are the starting list, and it is usually longer than the owning team expects.

We put findings where the API owners already are

With the plan enabled, recommendations and alerts appear in the Azure API Management portal as well as in Defender for Cloud. Findings that reach a developer in the tool they already use get fixed. Findings in a security portal they do not have access to get discussed.

How an engagement runs

Four phases across roughly six weeks.

What sets the timeline is the observation period. Onboarding itself takes an afternoon, and the findings only reach completeness once traffic has been observed across a normal cycle of use.

01
Week 1
Onboard and start observing
The plan goes on and the APIs are onboarded, either from the Defender for Cloud portal or from inside the API Management instance itself. Expect a great deal of awaiting data at this stage. That is the plan working correctly rather than a problem to raise.
- Plan enabled and APIs onboarded
- API Management instances confirmed in scope
- Baseline inventory captured
- Recommendations to onboard remaining APIs actioned
02
Weeks 2 to 4
Let traffic accumulate, then read the findings
Thirty days is the window that matters, being the threshold at which an endpoint gets marked inactive. Across that period, authentication status, external traffic and data classification all fill in from real calls rather than from assumptions.
- Unauthenticated endpoints identified from observed calls
- Inactive endpoints identified after 30 days
- Externally called endpoints listed
- Sensitive data carrying APIs classified
03
Week 5
Act on the two easiest wins
Unused APIs get disabled and removed, which is explicitly recommended and reduces attack surface at no functional cost whatsoever. Unauthenticated endpoints go to the teams that own them, accompanied by evidence that no authentication mechanism executed during real calls.
- Unused APIs disabled or removed
- Unauthenticated endpoints assigned to owners
- Authentication remediation planned per API
- Posture recommendations prioritized by data classification
04
Week 6
Wire detection into the response workflow
Runtime alerts get routed to whoever actually responds, exported into Sentinel or whatever other SIEM you run, and the recommendations are surfaced inside the API Management portal so that the teams owning those APIs see them without having to switch tools.
- Alerts exported to the SIEM
- Recommendations visible in the API Management portal
- Response owner named for API alerts
- Recurring review scheduled for new APIs

Where this matters

Six situations where APIs are the weak point.

The common thread is an API estate that grew faster than the process for reviewing it, which is nearly universal in organizations doing anything digital.

A business exposing APIs to partners

Partner integrations pile up over time, and every one of them is an authenticated channel right up until somebody publishes a version that is not. Put the external traffic observed date next to the authentication status and you have a direct answer to whether any externally called endpoint is running with no authentication actually executing.

A financial firm with payment or banking interfaces

When APIs carry regulated financial data and the systems behind them fall under GLBA, the FTC Safeguards Rule or NYDFS Part 500, classifying request and response bodies is what makes proper prioritization possible. An unauthenticated endpoint carrying nothing sensitive and one carrying customer records are wildly different findings, and only that classification tells them apart.

A retailer whose mobile app is API driven

Anything consumer-facing attracts volumetric attacks, credential stuffing and parameter manipulation. Runtime detection covers volumetric attacks, anomalous and suspicious API parameters, and anomalies in traffic and IP access, which between them describe precisely what shows up against a retail API.

An organization that has never inventoried its APIs

That inventory is the first thing delivered and frequently the most valuable thing delivered. An aggregated view of every managed API broken down by collection, by endpoint and by API Management service tends to surface endpoints that nobody currently owns, and that absence of an owner is a finding all by itself.

A company with old APIs nobody retired

Versioned APIs accumulate for one reason: deprecating any of them requires knowing who is still calling it, and nobody knows. Thirty days of traffic data answers that question outright, and the recommendation to disable and remove unused APIs turns what was a difficult conversation into an evidenced one.

A business already running Defender CSPM

Enable both and the Cloud Security Graph analyzes your assets and the connections between them to expose risk and possible lateral movement paths, while the Cloud Security Explorer brings built-in query templates aimed at risky API assets. APIs stop being a silo of their own and join the same risk picture as everything else.

Three positions

How US organizations understand their API exposure.

Most organizations sit in the middle column, and its weakness is quite specific. A penetration test captures a single moment, and APIs change between tests more than almost any other part of an estate.

Inventory from observed traffic

Continuous API monitoringYes

Periodic penetration testingAt test time

Documentation and trustNo

Unauthenticated endpoints found

Continuous API monitoringContinuously

Periodic penetration testingAt test time

Documentation and trustIf someone checks

Unused endpoints identified

Continuous API monitoringAfter 30 days without traffic

Periodic penetration testingRarely

Documentation and trustNo

External exposure observed

Continuous API monitoringYes, with dates

Periodic penetration testingInferred

Documentation and trustAssumed

Sensitive data carrying APIs known

Continuous API monitoringClassified

Periodic penetration testingSometimes

Documentation and trustNo

Runtime attacks detected

Continuous API monitoringYes, OWASP API Top 10

Periodic penetration testingNo

Documentation and trustNo

New APIs covered automatically

Continuous API monitoringOn onboarding

Periodic penetration testingNext test

Documentation and trustNo

Findings reach the API team

Continuous API monitoringIn the APIM portal

Periodic penetration testingIn a report

Documentation and trustNot applicable

Attack path context

Continuous API monitoringWith Defender CSPM

Periodic penetration testingNo

Documentation and trustNo

Effort per cycle

Continuous API monitoringLow

Periodic penetration testingHigh

Documentation and trustNone

Feature	Continuous API monitoring	Periodic penetration testing	Documentation and trust
Inventory from observed traffic	Yes	At test time	No
Unauthenticated endpoints found	Continuously	At test time	If someone checks
Unused endpoints identified	After 30 days without traffic	Rarely	No
External exposure observed	Yes, with dates	Inferred	Assumed
Sensitive data carrying APIs known	Classified	Sometimes	No
Runtime attacks detected	Yes, OWASP API Top 10	No	No
New APIs covered automatically	On onboarding	Next test	No
Findings reach the API team	In the APIM portal	In a report	Not applicable
Attack path context	With Defender CSPM	No	No
Effort per cycle	Low	High	None

What the dashboard tells you

Ten data points recorded per endpoint, and what each one is actually useful for.

Every field here answers a question that a security review would otherwise put to a development team and expect them to answer from memory.

Field or capability

Endpoint name and URL path with method

The question it answers: What exists, as defined in API Management

Field or capability

Last called date in UTC

The question it answers: Is anything using this

Field or capability

30 days unused, marked Inactive

The question it answers: Can this be removed

Field or capability

Authentication status

The question it answers: Did an authentication mechanism actually execute

Field or capability

External traffic observed date

The question it answers: Is this being called from outside

Field or capability

Data classification

The question it answers: Does this carry sensitive data

Field or capability

Awaiting data status

The question it answers: No traffic observed since onboarding

Field or capability

Security recommendations

The question it answers: What to fix, prioritized by risk

Field or capability

Runtime alerts

The question it answers: Is this being attacked right now

Field or capability

Cloud Security Explorer templates

The question it answers: Which API assets are risky, queried directly

Field or capability	The question it answers
Endpoint name and URL path with method	What exists, as defined in API Management
Last called date in UTC	Is anything using this
30 days unused, marked Inactive	Can this be removed
Authentication status	Did an authentication mechanism actually execute
External traffic observed date	Is this being called from outside
Data classification	Does this carry sensitive data
Awaiting data status	No traffic observed since onboarding
Security recommendations	What to fix, prioritized by risk
Runtime alerts	Is this being attacked right now
Cloud Security Explorer templates	Which API assets are risky, queried directly

How an engagement runs

Five steps, and one of them is waiting.

That observation window is not dead time being wasted. It is what converts an inventory of what exists into an inventory of what is used, by whom, and whether anything authenticated them on the way in.

1
Enable the plan and onboard the APIs
You can onboard from the Defender for Cloud portal or from inside the API Management instance in the Azure portal, whichever suits. Onboarding APIs to the plan appears among the recommendations too, which makes a useful cross-check that nothing got missed along the way.
2
Allow at least 30 days of observation
An endpoint becomes inactive after 30 days without traffic, and anything with no traffic at all since onboarding shows as awaiting data. Read the findings before that window has elapsed and you get a picture that is technically accurate while being practically misleading.
3
Triage by authentication and data classification together
Unauthenticated endpoints get ranked by whether they carry sensitive data, drawing on how the request and response bodies were classified. That combination is what turns a flat list of findings into a priority order the business will actually accept and work through.
4
Remove the unused and fix the unauthenticated
Unused APIs go first, being explicitly recommended for removal and carrying no functional cost at all. Authentication remediation follows, worked through with the teams that own each API and supported by evidence that no mechanism executed during real calls, rather than by an opinion about the configuration.
5
Connect detection to response
Runtime alerts spanning the OWASP API Top 10, data exfiltration, volumetric attacks and access anomalies get routed to a named responder and exported into Sentinel or whichever SIEM you run, while the recommendations surface inside the API Management portal for the teams who own the code.

Straight answers

What US organizations ask about Defender for APIs.

As documented, the plan currently secures APIs published in Azure API Management. Onboarding takes place either in the Defender for Cloud portal or within the API Management instance in the Azure portal. Anything published outside API Management falls outside the scope of this plan entirely.

From the call itself, not from anything written down. It checks for API Management subscription keys on APIs or products where a subscription is required, and it checks whether the policies validating JWT, client certificates and Microsoft Entra tokens actually executed. Where none of them ran during the API call, that API is marked unauthenticated.

It means an endpoint that has taken no API call traffic across the last 30 days, displayed with a last called date recorded in UTC. Since disabling and removing unused APIs appears explicitly among the recommendations, your inactive endpoints are the natural place to start that work.

Because no traffic has been observed against them since the moment they were onboarded. Nothing is broken and nothing is uncovered. Everything here derives from real calls rather than from specifications, so an endpoint nobody has called yet genuinely has nothing to report.

Thirty days at minimum, since that is the window governing the inactive determination and it is long enough for authentication status, external traffic and data classification to fill in from genuine usage. Reading the dashboard during week one hands you an incomplete picture, and incomplete pictures tend to generate arguments nobody needed.

Runtime anomaly detection built on machine learning together with rule-based analytics. The alerts it raises cover the top ten OWASP API threats, data exfiltration, volumetric attacks, anomalous and suspicious API parameters, anomalies in traffic and IP access, and unusual usage patterns.

It does. Request and response bodies are classified against the supported data types for the express purpose of supporting risk prioritization. That is what allows an unauthenticated endpoint carrying customer records to be ranked above one carrying nothing of consequence, and that ranking is exactly what a SOC 2 auditor or an insurer will expect you to be able to defend.

They can. With the plan enabled, API security recommendations and alerts appear in the Azure API Management portal alongside Defender for Cloud. That matters considerably more than it sounds, because a finding reaching somebody inside the tool they already have open gets acted on, and one sitting in a portal they cannot access does not.

They can. Alerts and recommendations export out into a SIEM such as Microsoft Sentinel so investigation happens inside the threat response workflow you already run. For any team already operating a SIEM, that avoids creating a separate API alert queue that nobody ends up watching.

They complement each other. A penetration test is deep and point in time. This is continuous and observational, so it catches the endpoint published last Tuesday without authentication, which a quarterly test would not see for another two months.

Context. Cloud Security Graph analyzes assets and connections across the organization to expose risks, vulnerabilities and possible lateral movement paths, and Cloud Security Explorer includes two built-in query templates for identifying risky API assets. APIs become part of one risk picture rather than a separate list.

Removing the unused APIs. It is recommended explicitly, the inactive list hands you the candidates after 30 days, and it shrinks your attack surface without altering anything anybody relies on. It is also the finding a development team is least likely to argue with.

Then this plan will not cover them, because it currently secures APIs published in Azure API Management and nothing else. Establish that early rather than late, since a business whose critical APIs sit behind a different gateway needs a different approach entirely rather than a partial version of this one.

It can, and the external traffic observed date is what makes the distinction. An endpoint with no external traffic recorded against it is being called internally and nowhere else, which is a materially different risk position from one that outside parties are actively calling, even where the two configurations look identical on paper.

By putting together two fields the dashboard already provides. Authentication status names the endpoints with no authentication mechanism executing. Data classification names the ones carrying sensitive data in their request or response bodies. Where those two overlap is the list worth working first.

Each engagement is scoped and quoted on its own, sized against how many API Management instances and APIs are involved. A first step that costs nothing: count how many APIs you publish, then work out how many of them anybody has called during the past month. Where those two numbers diverge significantly, the inventory on its own justifies the exercise.

API security review

Fifteen questions about your own API estate.

Very few businesses can answer the first three of these from memory, and those three happen to be exactly what an attacker establishes before anything else.

Inventory

How many APIs do we publish?
A number, from observation.
Which are called from outside?
Observed, not configured.
Which had no traffic in 30 days?
They are attack surface.
Are all API Management instances onboarded?
There is a recommendation for this.
Who owns each API?
Findings need an owner.

Authentication

Which endpoints are unauthenticated?
Measured during real calls.
Do we require subscription keys?
One of the mechanisms assessed.
Do we validate JWT in policy?
Another assessed mechanism.
Do we use client certificates anywhere?
Also assessed.
Do we validate Entra tokens?
The fourth mechanism.

Risk and response

Which APIs carry sensitive data?
Data classification shows this.
Is Defender CSPM enabled alongside?
It adds attack path context.
Do alerts reach the SIEM?
Export is supported.
Do API teams see the recommendations?
They appear in the APIM portal.
Who responds to an API alert at night?
Name them.

Count the APIs you publish. Then count how many were called at all in the last month.

Whatever gap sits between those two numbers is attack surface delivering nothing in return. Removing it is the easiest security improvement on offer, and by definition nothing depends on it.

Book an API security review See Microsoft security services