CrowdStrike for MSPs: Program, Minimums, Flight Control and Pricing

CrowdStrike sells to MSPs through two different partner licences, three buying routes and a multi-tenant console, and none of it sits on one page. This guide puts it on one page: how the program is structured, what MSPs report about minimums and entry points, how Falcon Flight Control works across clients, and what the November 2026 price list means for a book of small clients. Read it before the distributor quote lands, because the route you buy through decides who owns the support ticket and the renewal.

TL;DR

Two Partner Licences, Not One

CrowdStrike's partner program terms, the public legal page as read in November 2026, draw a line the sales deck does not. Section 6.4 covers the "MSP Partner", also called a "Managed Service Provider Partner" or "Managed and Monitored MSP". That partner gets access to the client's own instance of Falcon and runs it on the client's behalf for as long as the client stays a joint customer. The client holds the subscription. The MSP holds the keyboard.

Section 6.5 covers the "CrowdStrike Powered Service Provider", or CPSP, which the terms note was formerly called "Packaged MSP" or "Managed Security Service Partner". Here the partner buys the licences, bundles them into its own packaged service, and is "responsible and liable" for what its customers do with the product. Quantities are capped at whatever the partner's order says, and the partner may not resell the Falcon modules on a stand-alone basis without a separate designation. This is the model behind the MSSP bundles on distributor price lists.

The difference decides three things: who the renewal belongs to, who CrowdStrike support talks to, and whether you can put your brand on it. Under the MSP Partner model the client owns the contract and can take it with them. Under CPSP you own it, you can brand it, and you carry the liability. Pick on purpose. The r/msp threads below are full of MSPs who found out which one they had signed after the first support ticket.

Where MSPs Buy It: Direct, Distributors, or Inside the RMM

Three routes exist, and the thread that maps them best is a December 2025 r/msp post from a small MSP leaving Pax8 and needing CrowdStrike for about 100 seats. The replies covered the market in a day: Pax8 carries it, Arrow carries it, Sherweb did not at the time, and NinjaOne can supply it to MSPs that run Ninja as their RMM. One commenter added the catch on the RMM route as they understood it: a CrowdStrike licence billed for every Ninja device, one to one, so ask before assuming you can cover a subset. An October 2026 r/msp thread with 96 upvotes went further on that route, with the poster advising peers to stay with Pax8 or TD Synnex after a 15-day open support ticket. Support follows the route you bought through. That is the lesson, not the vendor.

On the Pax8 marketplace, read in November 2026, the CrowdStrike catalogue is written for the CPSP model: CrowdStrike MSSP Defend for endpoint protection, Falcon MSSP Complete Defend for managed detection and response, Falcon Adversary OverWatch, Falcon Firewall Management, a Data Protection add-on and Falcon for Mobile. Prices sit behind the partner login, which is normal for distributor SKUs and the first reason to get two quotes.

At the other end of the scale, go direct. When an MSP with a 20,000-endpoint client asked r/msp in August 2025 which distributor could beat CDW, the top reply, with 36 upvotes, was "at that volume I would go direct". Another commenter put CrowdStrike's deal-registration delta at roughly 10 to 12% off list, which is why the reseller that registered the deal first is hard to displace. Below enterprise volume, several replies said distributor pricing lands in the same ballpark whichever one you pick, so choose on support and billing rather than on a point of discount.

Minimums and Entry Points, as MSPs Report Them

CrowdStrike publishes no seat minimum. The pricing page's only hard limit is the 100-device cap on Falcon Go, the small-business tier. Everything an MSP buys through a distributor is quoted per seat, and the 100-seat start in the Sherweb thread drew no "too small" replies. So the minimum is not a number. It is a fit test, and MSPs describe it that way.

The clearest account is a July 2025 r/msp thread titled "CrowdStrike - as an MSP", 26 upvotes and 68 comments. The poster runs the IT division of a larger firm, under 1,000 client seats, inherited a CrowdStrike resale agreement, and uses it mainly as an EDR. Their complaint was not detection. It was that the training is organised by security role rather than for engineers who cover everything, that basic questions to CrowdStrike and the distributor produced a "salad of responses", and that the vendor seemed "entirely interested in big enterprise". Five months later the same poster wrote that CrowdStrike's recent partner agreement "excludes it as an option for smaller setups". One MSP's experience, dated and attributed, and the most-read one on this exact question.

Read against the partner terms, that account makes sense. The CPSP designation assumes a partner that can package, support and carry liability for a security product. A two-technician shop can sign it, but the economics assume a SOC-shaped business. Ask three questions before you do: which designation you are signing, whether the quote is per seat or carries a commitment, and who answers a tier-one ticket at 2 am, you or the distributor.

Falcon Flight Control: One Console, Many Clients

Flight Control is CrowdStrike's multi-tenancy. The Flight Control data sheet describes it as a feature included with Falcon Insight XDR, built for a "whole-of-state" model where one parent manages many child environments, and that is the shape of an MSP book. Each client gets its own customer ID, a child tenant with its own data. The MSP works from the parent: push a prevention policy once and it lands in every child, see detections across the whole estate, and drop into one client when a case needs it.

What it does not do matters as much. Flight Control segments administration and data. It does not bill per client, it does not open a ticket in your PSA, and it does not report in the client's brand. The CrowdStrike Falcon review for MSPs covers the console in more depth. The short version is that Flight Control makes Falcon operationally sane across 30 tenants, and your RMM and PSA still do the rest of the job. The three-minute walkthrough below shows the parent-and-child model from the admin side.

Falcon Complete for Service Providers: Resell the SOC or Build One

Falcon Complete is CrowdStrike's own 24/7 managed detection and response. Falcon Complete for Service Providers is the version an MSP can sell. CrowdStrike's data sheet, read in November 2026, says partners can white-label or co-brand it, bundle it with their existing services and keep "full ownership of customer relationships", while CrowdStrike's analysts do the detection and response. For an MSP without a SOC, that is enterprise MDR on day one.

The trade is dependence, and the partner-economics number CrowdStrike quotes shows why both sides accept it. A Canalys study that CrowdStrike announced at Fal.Con in September 2025 found partners can generate up to $7 in services revenue for every $1 a customer spends on the Falcon platform. The vendor's reading is that Falcon is a services engine. Your reading should be that the services are where your margin lives, so decide which services you are keeping. If you plan to build your own detection practice later, the SOC as a service build-versus-buy guide has the staffing maths, and it is worth reading before you decide what you would be reselling in the meantime.

CrowdStrike Pricing for MSPs, November 2026

The public price list has three tiers and a quote button. Falcon Go is $59.99 per device per year ($7.99 monthly), capped at 100 devices. Falcon Pro is $99.99 ($14.99 monthly). Falcon Enterprise is $184.99 ($19.99 monthly). Falcon Complete and every MSSP bundle on the distributor lists are quoted. The three list prices were the same in June 2026 and November 2026. Modules such as Exposure Management and Falcon for IT sit on top of any tier as quoted lines; our Falcon for IT review covers what that module adds for an MSP.

Two community data points frame the negotiation. In the August 2025 volume thread, one commenter put deal registration at roughly 10 to 12% off list. In a November 2025 r/msp thread, an IT lead at a 125-user company comparing quotes reported CrowdStrike at "nearly 3x per user" against Bitdefender, and the 81 replies split between those who said the detection earns it and those who said pair a cheaper EDR with a managed SOC such as Huntress. The Huntress review for MSPs runs that second option in detail.

The worked example, at list: a 30-client book of 600 endpoints on Falcon Pro is $59,994 a year, or $8.33 per endpoint per month. On Enterprise it is $110,994, or $15.42 per endpoint per month. If you bill a flat security line of $15 per endpoint per month (a planning assumption, not a market figure), Pro leaves $6.67 of gross margin per endpoint before your labour, and Enterprise leaves nothing. That is why the tier question and the route question are the same question. A 10% registration delta on Pro is worth about $6,000 a year on that book, and it goes to whoever registered the deal.

Does CrowdStrike Compete With Its MSPs?

Yes in two places, no in a third, and all three are public. First, CrowdStrike sells Falcon Go, Pro and Enterprise direct from its website with a cart, a 15-day free trial and, in November 2026, a Black Friday sale running 23 November to 4 December on all three tiers. A small business can buy the product your quote describes without you. Second, Falcon Complete is CrowdStrike's own MDR, so an MSP selling its own SOC service competes with its vendor's SOC unless it resells Complete through the service-provider program. Third, CrowdStrike does not run endpoints, patch third-party software or answer the user's printer ticket, and the Canalys multiplier is its own statement that partners do the work around the platform.

So the question is not whether CrowdStrike competes. It is which part of the stack you own. Detection is the vendor's. Response, operations, the RMM, the PSA and the client relationship are yours. Teams that keep those on an open, AI-native layer such as OpenFrame (published pricing, July 2026: $1 per device per month with 10 million AI tokens a month included) run Falcon as the EDR line and keep the operations line at a price that does not move with the vendor's renewal. The MSP security stack guide shows where each layer sits.

Who It Fits, and Who Should Look Elsewhere

CrowdStrike through the MSP program fits a security-led MSP or MSSP with mid-market clients, a team that can carry the CPSP responsibilities, and a book large enough to register deals and negotiate. It fits an MSP that wants to sell MDR this quarter and would rather resell Falcon Complete than hire a SOC. G2 rates the Falcon Endpoint Protection Platform 4.7/5 across 680 reviews as of November 2026, and the r/msp threads that criticise the program rarely criticise the detection.

It is a weaker fit for a shop whose book is dozens of 20-endpoint clients, where the per-seat list price and the role-based training outrun the margin and the staff. Those shops land better with an EDR packaged for small business plus a managed SOC, and with their operations stack consolidated so the security line stays affordable.

The short answer: sign the designation on purpose, buy through the route whose support you trust, run clients through Flight Control, and keep the operations layer on your own terms. Then CrowdStrike is a strong lock on the door, not the landlord.