ShareCare Available
Crawls sharing and permissions across the whole of Microsoft 365 app-only, scores exposure by sensitivity and impact, and remediates — with a grace window and undo. The Copilot-readiness answer, across every tenant.
ShareCare
Microsoft 365 exposure, posture and DMARC · for MSPs and their clients
See what your Microsoft 365 tenants over-share, how their posture scores and what they expose.
SeQontrol watches everything your Microsoft 365 environment exposes — sharing and permissions, security posture, email authentication and your public-facing systems — with every finding linked to the security or compliance control it validates.
- Built byPeople, with AI assistance
- Your dataStays in Azure (Europe)
- AccessWe require minimal read access. Based on what you enable we'll require separate and explicit consent, which you can remove at any time.
- PricingEvery price is on this page
Who’s looking after this environment?
Customer · One environment
What changed for Microsoft 365 admins
-
Copilot reads what people can reach.
Copilot surfaces anything a user can technically reach. Sharing links and group memberships nobody reviewed for years can now show up in Copilot answers — and the rollout stalls until somebody can understand how widely sensitive data is exposed.
-
Auditors ask for evidence over a period.
Auditors increasingly expect evidence that controls operate continuously, not a screenshot taken once a year. Every finding here is already linked to the security or compliance control it validates.
- See the issues that need attention immediately, with direct links to the affected items.
- A clear exposure score, with the ability to drill down to the affected users, files and permissions.
- Two numbers, not one. What is failing at Critical or High, and what was never assessed. A row can be quiet because it is clean or because nobody could look.
- A row that is entirely unassessed says so. Nothing failing, nothing passing, ten checks unread — which is a licensing conversation, not a security win.
- A grade, and what it is made of. The four counts sit next to the score, so a low number can be read rather than argued with.
- Every failure cites the RFC. The standard is the reason.
- Why it matters, then the fix, then a waiver. The check stays on screen either way, and the waiver expires.
MailTrust screenshot to follow
MSP · A book of tenants
All tenants. One console.
You run an MSP, an MSSP or a vCISO practice. Clients are asking whether Copilot is safe, and you need an answer that scales past doing it by hand, sixty times.
- Fleet console
- Delegated onboarding with approval gates
- Pooled capacity
- Partner margin
- Fleet benchmarking
- Quarterly client reviews
What changes at sixty tenants
- One console across every client, from day one — not sixty browser tabs.
- Priced on what each product counts, pooled across the book, with a per-tenant floor as greater-of and a partner margin.
- A benchmark that ranks your book, so the conversation with each client is specific rather than general.
- Audited impersonation, and an approval gate before you act on a client’s tenant.
Products
Each product can be purchased separately, but they share the same platform and findings database.
One console, one findings store and one audit trail underneath; a separate, scoped consent for each product on top. Four are running today. Two more are built but not released, and two are still in development.
Available today
SecurityPortal Available
Conditional Access coverage, MFA gaps, over-privileged apps and risky sign-in patterns, with a tier you can only climb with evidence.
SecurityPortalWebScan Available
Finds the public face of your organisation — including the hosts nobody wrote down — and grades it. No tenant, no consent, and the scan is free.
WebScanMailTrust Available
Takes every domain from DMARC monitoring to safe enforcement, writing the DNS records in-product for supported providers.
MailTrustBuilt, and not released yet
ConditionalAccessPortal Coming soon
Conditional Access policy inventory, baseline coverage gaps and approval-gated policy write-back for the Entra environment.
ConditionalAccessPortalCompliancePortal Coming soon
Turns the scans you already run into framework-mapped, audit-ready evidence. It proves the technical controls on the platforms SeQontrol supports — it is not a whole-company compliance programme.
CompliancePortalStill in development
Dredd Under development
Holds your approved configuration as a versioned baseline and forces the decision on every deviation: revert it or ratify it.
DreddPosturePortal Under development
The read-only board that aggregates findings, risk and coverage from every product, per tenant and fleet-wide.
PosturePortal
Licensing
Three licence tiers on most products.
Most products are sold on the same three steps. You buy the depth you actually want, and the step that writes to your tenant is always a deliberate, separate decision.
-
Step 1 · See it
Visibility
Inventory, scoring and findings history. Nothing in your tenant changes.
-
Step 2 · Govern it
Governance
Policies, access reviews, approvals, waivers that expire, and evidence packs.
-
Step 3 · Act on it
Automation
Write-back with undo, behind its own consent — and every change approved on its own.
Scanning is never metered. No per-scan pricing, no charging per finding, no hard cap that stops a scan for a commercial reason. You are billed on the size of the environment — a number you already know before you buy.
The principle
Security stands above compliance.
- Waived findings stay visible, and stay in the score. A waiver changes the report, not the environment.
- Exceptions expire. Mandatory expiry, and automatic invalidation when the finding changes shape.
- Never a fabricated pass. A control that cannot be assessed reports “not assessed”, never green.
- Findings are not metered. Discovering more never costs more, so nothing rewards looking away.
Why security comes first
Not because compliance does not matter — it is a whole product here — but because a compliance control can be waived, and an attacker does not abide by your waivers.
Every framework has an exception process. A control gets accepted as a risk, signed off, and the report goes green. Nothing about the environment changed. Do that a few times across a few frameworks and you have built something worse than a gap: a documented, audited, board-reported sense of safety that does not correspond to anything real.
So the order is deliberate. The security finding is the fact. Compliance is an interpretation laid over that fact, and a waiver changes the interpretation only. You can accept a risk. You cannot make it disappear from the screen.
Three ways in
Three free assessments.
Each is an assessment with a report at the end, whether or not you buy anything afterwards. Two of them need nothing from you but a domain name.
What Copilot can reach
A scoped crawl of your tenant, or your worst few client tenants: anonymous links, external guests, company-wide shares and the app consents nobody remembers granting — scored, with the list of what to revoke. You can revoke the consent the moment the report lands.
Get my exposure reportWho is sending as you
SPF, DKIM, DMARC, BIMI and MTA-STS across your sending and parked domains, and what an attacker could send from the ones you forgot you owned.
Check my domainWhat your attacker sees first
TLS, certificates, security headers, cookies, DNS hygiene and exposed content on your public-facing systems — graded against the standards that define each one.
Scan my site
One product needs nothing from you at all, and it does not stop being free.
WebScan’s complete scanner is included with every SeQontrol
account — one URL at a time, for as long as you keep the account. The licence buys what happens after
the scan: history, schedules, alerts, evidence.
Before you ask
Common objections.
The three reasons people do not buy this. All three are reasonable, and two of them are sometimes right.
“Microsoft already gives me this.”
For one tenant, one administrator and no reporting obligation — largely true. Secure Score, Purview and SharePoint Advanced Management ship with your licence and you should start there. A tool you already own and will actually check beats one you buy and ignore.
It stops being true when you need evidence that a control held over a period, or when you manage sixty tenants and nothing native spans them. The four specific gaps.
“We already run CIPP.”
Good, and keep running it. CIPP administers tenants and it is free; nothing here replaces that, and running both is a normal setup rather than an awkward one.
What it was not built to do is retain a control-tagged record that something held over time. That does not matter until an insurer, an auditor or a client’s customer asks — and then it is the only thing that does. How the two compare.
“I am not letting a vendor write to my tenant.”
Correct instinct, and you do not have to. Scanning is read-only. The permission that writes is a separate consent you may never grant, and every read-only product keeps working without it.
If you do grant it, each change is approved on its own, and a refusal from your directory is recorded as a refusal rather than retried quietly. What we do with the access.
Compared with tools you may already use.
Start with what anyone can already see.
The spoofing check and the surface scan need only a domain — no tenant and no consent. The Copilot reach report needs a read-only connection and nothing more.
Start with a handful of tenants.
Sign up as a provider — the provider agreement is accepted online — and run it on your own tenant first, then on your worst few clients. Or have us scope that first assessment with you.
Built in Nieuwegein, the Netherlands · Data in Azure (Europe)