How do you avoid being “blind” to your clients’ servers & M365 activity?

I'm running an MSP and realizing I'm basically blind to what's happening on my clients’ servers and their cloud tenants. Endpoints are covered, but I have no clear visibility into server health, backups, storage issues, or security-related changes like forwarding rules, MFA status, failed logins, or admin role changes. For those who solved this, what’s the simplest and most effective way to build real monitoring across servers and cloud environments without overcomplicating everything?