Delegated onboarding
A provider organisation manages a fleet of client tenants with delegated administrative access, so onboarding a new client does not mean a new commercial relationship for them.
For managed service providers
Microsoft 365 security across every client tenant
SeQontrol was built provider-first, not retrofitted for it. Onboard one tenant and you get a fleet view across your whole book from day one — one console and one evidence trail — priced per managed tenant so you can mark it up and resell it.
Every released product on the tenant you run your own business from, up to fifty users, for one flat monthly rate. Not a trial. Sign up as a provider and accept the provider agreement online; client tenants come after.
The machinery
Multi-client is in the platform, not bolted on top
These are platform capabilities every product inherits, which is why the fleet story is the same in each one instead of being good in the flagship and absent everywhere else.
Audited impersonation
Support your clients from inside their tenant, with every impersonated session recorded in the hash-chained audit trail.
An approval gate before you act
An opt-in gate means a provider action inside a managed tenant can require the client's approval first.
Fleet views in every product
Manage five clients or five hundred from one screen, in each product, with the same shape of view rather than a different mental model per product.
Benchmarking across your book
Rank clients against each other. "These eight are in the bottom quartile of my book" is a specific, defensible conversation.
Templates and bulk action
Push a baseline template across managed tenants and bulk-heal drift with per-tenant guardrails and approvals, rather than repeating the same fix forty times by hand.
Commercials
Priced for a book of clients, not for one enterprise
A 60-tenant provider averaging 23 users behaves nothing like a single 1,400-user enterprise. Retail per-seat pricing would price the first one out entirely, so it does not apply to you.
Pooled capacity
Users, sites and domains pool across your managed tenants, so a book of small clients is priced as one pool rather than as forty minimum charges. Compliance frameworks are licensed once across the whole book rather than per client.
Per-tenant floor, greater-of
A modest per-tenant floor applies as greater-of against the pooled total — never added on top of it. You pay whichever of the two is larger, not the sum.
Partner margin
A partner-level plan with real margin built in, so the service is a line you profit on rather than a cost you absorb.
How the two interact
Your pooled user count is priced as one total. The per-tenant floor is calculated across your managed tenants. You pay whichever figure is larger — never both added together — so a book of many small tenants is not punished for its shape. Full licensing detail.
Compliance is licensed once, not sixty times
Per-tenant compliance pricing does not survive a fleet, so it is not what you are quoted. Two things cost money and they are charged for separately: a framework, which costs the same to build and maintain whether one client uses it or sixty, and a tenant, where the probes, evidence and retention genuinely are per client.
So you buy the frameworks you standardise on — once, across the book — and then a modest per-tenant fee for each client assessed against them. A sixty-client book on one framework with sign-off lands at a fraction of per-client pricing. The figures are on the pricing page. One caveat worth knowing before you plan around it: the licence is a commercial agreement today, because provider-scoped entitlements are still being built — the platform enforces per tenant, not per book.
Quarterly reviews
PosturePortal — still in development — becomes the client-facing artefact: one board per client, annotated and saved, instead of an afternoon of assembling exports by hand.
One product opens a conversation without an onboarding
WebScan needs no tenant, no consent and no onboarding — it reads public endpoints. A prospect's own graded result, with the standard behind every failure, is a better first meeting than a capability deck.
Be clear about which door you are using, because they are different. The free tier is deliberately narrow — one URL at a time, and it keeps nothing — so it is for checking, not for working through a prospect list at scale. For prospects, use the free surface scan request: you send the domain, we run it, you get the result to take into the meeting. Licensed sites, once someone is a client, carry no such limit.
Rolling it out
Run it on yourself first
Every released product, every tier, on the tenant you run your own business from, up to fifty users, for a flat monthly rate that is a small fraction of what the same tenant computes at list. Both numbers are published — work out the ratio yourself rather than take the word for it.
It is not a trial and it does not expire. It exists because the alternative is asking you to resell something you have never run, and because your own tenant is the one you will notice us being wrong about — your admin accounts, your client documentation, your own exposure. If this product is going to embarrass itself, we would rather it happened in front of you than in front of your client.
Needs a provider agreement, which you accept online when you sign up as a provider. It applies to your own domain only, and client tenants are priced as client tenants.
Start with one assessment, then add products per client
- Start. Open with a single high-urgency assessment — a Copilot-oversharing report, or an email-spoofing report — scoped to the worst few clients in your book.
- Show. The fleet benchmark, with quantified risk across named clients.
- Add. More products per tenant, through entitlements. Each one is its own admin consent through the same onboarding flow, so it can be quoted as a fixed, repeatable step. What each consent does and does not cover.
- Keep. The audit trail, the scheduled scans and the evidence packs become what you show your clients.
What SeQontrol doesn’t do
Before you point this at a book of client tenants
You are being asked to grant read access across every tenant you manage, so the limits belong on this page rather than in a footnote on call three.
Microsoft-first. Microsoft 365 and Entra are covered in depth. Box sharing ships today with app-only revoke; Slack Connect is detect-only until the admin APIs exist to act on. Google Cloud and AWS are read-only connectors in CompliancePortal, which is built and running but not released yet. Everything beyond that is roadmap.
Not everything is remediated app-only yet. Exchange forwarding, SharePoint site roles, Power Platform and delegated-admin relationships are detected and reported, not written back. Microsoft documents an application-only write path for all four; the gap is ours, not the platform’s, and the product names the reason instead of guessing.
Every product is a separate consent. There is no single grant that turns the platform on for a client: each product has its own Entra app and its own admin consent. For a book of clients that is real onboarding work, and it is worth quoting for. What you get back is that no product holds permissions it has no use for. Dropping one from a client revokes exactly one product’s Graph access — the Exchange management role, the Azure reader assignment, the Power Platform registration and each DNS authorisation are separate, and come off separately.
Every other limit is on one page.
Before the first call
Questions providers ask first.
The four that come up in nearly every conversation with a provider, answered here so the call can start somewhere more useful.
“We already run CIPP.”
Keep running it. CIPP administers tenants and it is free; nothing here replaces that, and running both is a normal setup rather than an awkward one.
What it was not built to do is keep a control-tagged record that something held over time, per client, that you can hand to an insurer or an auditor. How the two compare.
“Microsoft already gives us most of this.”
For a single tenant with no reporting obligation, largely true, and you should start there. Secure Score is a number per tenant, and the native reports sit per workload.
What a book of clients needs is one shape of view across all of them and evidence that a control held over a period. The four specific gaps.
“Do you write to our clients’ tenants?”
Not unless you grant it. Scanning is app-only, and a scan only reads. Remediation is a separate consent on top of the read grant, and every read-only product keeps working without it.
If you grant it, an opt-in approval gate can make each action wait for the client’s sign-off, and every session inside a client tenant lands in the hash-chained audit trail. What we do with the access.
“What happens if we stop?”
Revoke a product’s admin consent and that product loses its access to that tenant; nothing else does. Withdrawing write consent stops every write path and leaves the findings and evidence intact.
Subscriptions are monthly with no minimum term. Export a client’s findings and evidence before the subscription ends; when it ends, what we hold for that tenant is deleted. The adjacent grants — Exchange role, Azure reader, Power Platform registration, DNS authorisations — come off separately: the limits page lists them.
Start with your worst five clients
A scoped assessment across the clients you already worry about, with a fleet benchmark you can take straight into the next review.