The key question threat monitoring address is whether something malicious is happening. Elsewhere, platform administration asks whether the platform itself is configured, current and healthy enough to notice.
A tenant can have excellent analysts and still carry sensors two versions behind, exclusions nobody documented and a licence count that no longer matches the estate.
The debate of CrowdStrike Managed Services vs In-House Falcon Administration is a choice about that second job. It is often made by default rather than by decision, usually landing on whichever engineer deployed the sensors first.
This blog sets out what Falcon administration involves, the three operating models available to you and the questions that should decide between them. If you are weighing up the monitoring side of the decision instead, our comparison of CrowdStrike MDR and an in-house SOC covers that ground separately.
What In-House Falcon administration involves
Administration is recurring operational work. It does not stop once deployment finishes.
Sensor versions and update policies
Sensor update policies control which version each host runs. Policies are assigned through host groups, and a host follows one policy at a time according to defined precedence rules.
The common practice is a tiered structure. New versions go to a pilot group first, then to production once validated, with the wider fleet held at a recent version rather than lagging indefinitely. Someone must own that cycle month after month.
Prevention policies and exclusions
Prevention policies determine what the sensor blocks and what it merely records. Exclusions determine what it deliberately ignores.
The Falcon console separates these into distinct types, including machine learning exclusions, indicator of attack exclusions, sensor visibility exclusions and custom indicators of compromise. Each exists for a reason. Each also widens a gap if applied too broadly or left in place after the application that needed it was retired. Exclusion review is rarely urgent, which is precisely why it gets deferred.
Roles and access control
The platform ships with a granular role model. Falcon Administrator sits at the top, with narrower roles such as Prevention Policy Manager and Detections Exceptions Manager scoped to specific functions, and real time response roles tiered from read-only through to full administrative access.
Many teams flatten this. Everyone becomes an administrator because it is faster. That choice removes the audit clarity the role model was designed to give you.
Host and licence hygiene
Falcon licensing is primarily per endpoint. Endpoints leave the business constantly, through refresh cycles, departures and decommissioned servers.
The console exposes what you need to reconcile this. Inactive sensors appear under host management with last-seen data, and subscription counts sit under support and resources. Without a routine, tenants drift towards paying for devices that no longer exist while genuinely unprotected hosts go unnoticed.
CrowdStrike treats this body of work as a defined discipline. Its Falcon Administrator learning path covers sensor deployment, host groups and policy management, and the platform has a dedicated administrator certification. That is a useful signal. Administration is a skill set, not an afterthought.
What CrowdStrike managed services cover
There are two distinct managed options, and they are frequently confused.
1. Falcon Complete
Falcon Complete is CrowdStrike’s own managed detection and response service, delivered by CrowdStrike analysts. It includes 24×7 monitoring, threat hunting and remediation, alongside proactive management and optimisation of the customer environment.
It suits organisations that want CrowdStrike to carry both detection and platform health, and that are comfortable with a service boundary defined by the Falcon platform. Our guide to what CrowdStrike MDR includes breaks the service down in detail.
2. Partner-delivered administration
A services partner can operate the console alongside your team. That typically covers policy and exclusion management, sensor version discipline, host and licence hygiene, integration upkeep and tuning, with your team retaining ownership of decisions and escalation.
This model exists because many organisations sit between the two extremes. They have IT capability but no dedicated Falcon specialist, or they have one specialist and no cover when that person is unavailable.
Comparing the three models
Judge these on administration, not on detection.
1. Continuity
An in-house model depends on the availability of specific people. Leave, illness and resignation all interrupt it, and the platform does not pause while you recruit. Both managed models transfer that continuity risk to a provider.
2. Control and change management
In-house administration gives you the tightest change control. Every policy change originates with your team and follows your process.
Managed models introduce a second party into your tenant. This is manageable, and the console maintains an audit trail of actions taken by users and application programming interface clients. But you should agree in advance who can change what, and how changes are communicated.
3. Cost shape
In-house cost is salary, training and certification, and it is fixed whether the workload is heavy or light. Managed cost is subscription and predictable. Neither is automatically cheaper. The honest comparison includes the cost of work that does not get done in an under-resourced in-house model, such as deferred version upgrades or unreviewed exclusions.
How to decide
Four questions usually settle it.
- Do you have a named Falcon administrator? If the answer is a role rather than a person, administration is already unowned.
- What happens when that person is unavailable? No credible answer means no continuity.
- How current are your sensors right now? If nobody can answer quickly, that itself is the finding.
- How much of your estate sits outside Falcon? A significant amount favours a model that operates across the wider stack rather than one platform.
Conclusion
The decision between CrowdStrike Managed Services and In-House Falcon Administration is not really about cost. It is about ownership and continuity.
Administration is recurring work with a defined skill set behind it. Left unassigned, it degrades quietly, through outdated sensors, accumulated exclusions and licence counts that no longer reflect reality.
As a CrowdStrike services partner, we help organisations decide which model fits and then operate it properly. Our CrowdStrike Consulting team supports deployment, policy design, tuning and ongoing platform management alongside your internal team.
Reviewing how your Falcon environment is administered today? Talk to our team for a focused assessment.
FAQs
What is the difference between Falcon administration and SOC monitoring?
Administration keeps the platform configured, current and healthy. Monitoring watches the detections the platform produces. Both are necessary, and one does not substitute for the other.
Does Falcon Complete remove the need for in-house administration?
Falcon Complete includes management and optimisation of the environment as part of the service. Your team still owns scope, escalation contacts and decisions about your own estate.
What certification covers Falcon administration?
CrowdStrike offers a Certified Falcon Administrator credential, supported by its administrator learning path covering sensor deployment, host groups and policy management.
