CIPP and SeQontrol: run both
If you run CIPP, keep running it. Here is what it does that we do not, and the one thing it was never built to do.
Keep it
That is the recommendation, not a courtesy. CIPP is free and open source, and on multi-tenant administration it does things this platform does not attempt: standards deployment across a book, GDAP management, identity lifecycle, offboarding, licence juggling, the daily operations of running Microsoft 365 for other people.
If your problem is "I need to administer sixty tenants without sixty browser tabs", that is CIPP, it costs nothing, and nothing here replaces it. Running both is a normal setup, not an awkward one.
What it was not built to do
Produce evidence. CIPP tells you what a tenant looks like now and lets you change it. What it does not do — and does not claim to — is retain a control-tagged record that a control held over a period, with the exceptions named, time-boxed and attributable to whoever accepted them.
Where this stands today: ShareCare and SecurityPortal findings already carry control tags and history. CompliancePortal, which turns them into framework evidence with attestation, is built but not yet released.
That distinction does not matter until somebody asks. Then it is the only thing that matters: a cyber-insurance renewal, a client's customer sending a security questionnaire, an auditor asking how you know MFA was enforced in March rather than today. A management plane answers "what is it now". An assurance layer answers "what was it, and can you prove it".
The other two differences
Outside-in. CIPP works through the tenant. A good deal of what gets a client breached is not in the tenant at all — an expiring certificate, a spoofable domain, a forgotten subdomain pointing at a service somebody else now controls. Those need scanning from outside, with no credential, and that is a different kind of tool.
Who carries the risk. CIPP runs with your credentials in your Azure subscription, which is exactly right for a management plane and is also a security engineering job you now own: the app registrations, the secret rotation, the upgrade path, the impact if it is compromised. That is a reasonable trade for free. It is worth being deliberate that you have made it.
What we ask for, since you will ask
You already know what CIPP holds across your book, so what a second tool wants is a fair question. Each product has its own Entra application and its own admin consent, scoped to what that product reads. Scanning is app-only, and a scan only reads; remediation is a separate consent on top of it, and every read-only product keeps working without it. Revoking one product's consent revokes exactly one product's Graph access. The access, in full, and what it does not cover yet.
Across a book
The evidence is per client; the work of keeping it is not. One console across every client tenant, capacity pooled across the book rather than forty minimum charges, and partner margin built into the plan — so the evidence layer is a line you resell beside CIPP rather than a cost you absorb. The provider model.
What we will not claim
We are not cheaper than free, and we will not pretend the comparison is close on that axis. We do not do tenant administration, and adding it would make us worse at the thing we are for.
And we will not tell you CIPP is risky, insecure or unprofessional. It is none of those, it is maintained by people who know this platform properly, and a provider running it is making a defensible engineering decision. We are asking for the budget line next to it, not instead of it.
Start with the client you worry about most
Sign up as a provider — the provider agreement is accepted online, at sign-up — and run it on your own tenant first, or see the provider model before you do.