Delegated onboarding
A provider organisation manages a fleet of client tenants with delegated administrative access, so onboarding a new client does not mean a new commercial relationship for them.
For managed service providers
One console. Every client. Every product.
SeQontrol was built provider-first, not retrofitted for it. Onboard one tenant and you get a fleet view across your whole book from day one — the same crawl, the same evidence, the same board — priced per managed tenant so you can mark it up and resell it.
The machinery
Multi-client is in the platform, not bolted on top
These are platform capabilities every product inherits, which is why the fleet story is the same in each one instead of being good in the flagship and absent everywhere else.
Audited impersonation
Support your clients from inside their tenant, with every impersonated session recorded in the hash-chained audit trail. Access you can prove is access a client will grant.
An approval gate before you act
An opt-in gate means a provider action inside a managed tenant can require the client's approval first. Some clients demand it; the ones that do not still like being offered it.
Fleet views in every product
Manage five clients or five hundred from one screen, in each product, with the same shape of view rather than a different mental model per product.
Benchmarking across your book
Rank clients against each other. "These eight are in the bottom quartile of my book" is a specific, defensible conversation — and it sells remediation work.
Templates and bulk action
Push a baseline template across managed tenants and bulk-heal drift with per-tenant guardrails and approvals, rather than repeating the same fix forty times by hand.
Commercials
Priced for a book of clients, not for one enterprise
A 60-tenant provider averaging 23 users behaves nothing like a single 1,400-user enterprise. Retail per-seat pricing would price the first one out entirely, so it does not apply to you.
Pooled capacity
Users, sites and domains pool across your managed tenants, so a book of small clients is priced as one estate rather than as forty minimum charges. Compliance frameworks are licensed once across the whole book rather than per client.
Per-tenant floor, greater-of
A modest per-tenant floor applies as greater-of against the pooled total — never added on top of it. You pay whichever of the two is larger, not the sum.
Partner margin
A partner-level plan with real margin built in, so the service is a line you profit on rather than a cost you absorb.
How the two interact
Your pooled user count is priced as one estate. The per-tenant floor is calculated across your managed tenants. You pay whichever figure is larger — never both added together — so a book of many small tenants is not punished for its shape. Full licensing detail.
Compliance is licensed once, not sixty times
Per-tenant compliance pricing does not survive a fleet, so it is not what you are quoted. Two things cost money and they are charged for separately: a framework, which costs the same to build and maintain whether one client uses it or sixty, and a tenant, where the probes, evidence and retention genuinely are per client.
So you buy the frameworks you standardise on — once, across the book — and then a modest per-tenant fee for each client assessed against them. A sixty-client book on one framework with sign-off lands under a hundred dollars a client rather than several hundred. The figures are on the pricing page. One caveat worth knowing before you plan around it: the licence is a commercial agreement today, because provider-scoped entitlements are still being built — the platform enforces per tenant, not per book.
One product opens a conversation without an onboarding
WebScan needs no tenant, no consent and no onboarding — it reads public endpoints. A prospect's own graded result, with the standard behind every failure, is a better first meeting than a capability deck.
Be clear about which door you are using, because they are different. The free tier is deliberately narrow — one URL at a time, and it keeps nothing — so it is for checking, not for working through a prospect list at scale. For prospects, use the free surface scan request: you send the domain, we run it, you get the result to take into the meeting. Licensed sites, once someone is a client, carry no such limit.
The motion
Run it on yourself first
Every product, every tier, on the tenant you run your own business from, up to fifty users, for a flat monthly rate that is a small fraction of what the same estate computes at list. Both numbers are published — work out the ratio yourself rather than take the word for it.
It is not a trial and it does not expire. It exists because the alternative is asking you to resell something you have never run, and because your own tenant is the one you will notice us being wrong about — your admin accounts, your client documentation, your own exposure. If this product is going to embarrass itself, we would rather it happened in front of you than in front of your client.
Needs an active provider agreement, applies to your own domain only, and client tenants are priced as client tenants.
Land on one urgent thing, expand across the book
- Land. Open with a single high-urgency assessment — a Copilot-oversharing report, or an email-spoofing report — scoped to the worst few clients in your book.
- Prove. Show the fleet benchmark. Quantified risk across named clients is a conversation that closes remediation work on its own.
- Expand. Add products per tenant through entitlements. The client is never asked for new permissions — you switch the product's connector on against the consent they already gave.
- Retain. The audit trail, the scheduled scans and the evidence packs become what you show your clients. The switching cost is the client relationship, not just the tool.
Straight answers
Before you point this at a book of client tenants
You are being asked to grant read access across every tenant you manage, so the limits belong on this page rather than in a footnote on call three.
Microsoft-first. Microsoft 365 and Entra are the deep estate. Box and Slack sharing planes ship today, and CompliancePortal reaches Google Cloud and AWS through read-only connectors. Everything beyond that is roadmap.
Not every plane can be fixed app-only. Exchange forwarding, SharePoint site roles, Power Platform and delegated-admin relationships are detected but not remediated today — and the product names the reason instead of guessing.
Every product is a separate consent. There is no single grant that turns the platform on for a client: each product has its own Entra app and its own admin consent. For a book of clients that is real onboarding work, and it is worth quoting for. What you get back is that no product holds permissions it has no use for, and dropping one from a client revokes exactly one.
Start with your worst five clients
A scoped assessment across the clients you already worry about, with a fleet benchmark you can take straight into the next review.