ShareCare Available
Crawls the whole Microsoft 365 sharing and permission surface app-only, scores exposure by sensitivity and blast radius, and remediates — with a grace window and undo. The Copilot-readiness answer, across every tenant.
ShareCare
Microsoft 365 exposure, posture and DMARC · for MSPs and their clients
A dam isn’t a wall. It’s a control.
SeQontrol watches everything your Microsoft 365 estate exposes — sharing and permissions, security posture, email authentication and the public web surface — with every finding tagged to the control it proves. The decisions you make upstream protect everything downstream.
- Built byHumans, but assisted by AI
- Your dataStays in Azure (Europe)
- AccessScanning reads. Anything that writes to your tenant is a separate product decision and a separate, explicit consent.
- PricingEvery price is on this site, with no call first
Who’s looking after this estate?
Customer · One estate
Why your estate needs a keeper now
-
Copilot reads what people can reach.
Copilot surfaces anything a user can technically reach. Permissions that sat harmless for years became a live data-leak path overnight — and the rollout stalls until somebody can show the blast radius.
-
Compliance stopped being a date.
Auditors increasingly expect evidence that controls operate continuously, not a screenshot taken once a year. Every finding here is already tagged to the control it proves.
- Two links, not a report. The things that need a decision today, with the count on them, straight through to the items.
- One number to take to a meeting — and one you can take apart, all the way down to the file and the person it is shared with.
MSP · A book of tenants
Every client tenant. One console.
You run an MSP, an MSSP or a vCISO practice. Clients are asking whether Copilot is safe, and you need an answer that scales past doing it by hand, sixty times.
- Fleet console
- Delegated onboarding with approval gates
- Pooled capacity
- Partner margin
- Fleet benchmarking
- Quarterly client reviews
What changes at sixty tenants
- One console across every client, from day one — not sixty browser tabs.
- Priced on what each product counts, pooled across the book, with a per-tenant floor as greater-of and a partner margin.
- A benchmark that ranks your book and sells the remediation work, so the conversation with each client is specific rather than general.
- Audited impersonation, and an approval gate before you act on a client’s tenant.
The keeper’s tools
One platform. Products you switch on and off.
One console, one findings store and one audit trail underneath; a separate, scoped consent for each product on top. Four are running today. Two more are built but not released, and two are still in development.
Available today
SecurityPortal Available
Conditional Access coverage, MFA gaps, over-privileged apps and risky sign-in patterns, with a tier you can only climb with evidence.
SecurityPortalWebScan Available
Finds the public face of your organisation — including the hosts nobody wrote down — and grades it. No tenant, no consent, and the scan is free.
WebScanMailTrust Available
Takes every domain from DMARC monitoring to safe enforcement, writing the DNS records in-product for supported providers.
MailTrustBuilt, and not released yet
ConditionalAccessPortal Coming soon
Conditional Access policy inventory, baseline coverage gaps and approval-gated policy write-back for the Entra estate.
ConditionalAccessPortalCompliancePortal Coming soon
Turns the scans you already run into framework-mapped, audit-ready evidence. It proves the technical controls on the platforms SeQontrol supports — it is not a whole-company compliance programme.
CompliancePortalStill in development
Dredd Under development
Holds your approved configuration as a versioned baseline and forces the decision on every deviation: revert it or ratify it.
DreddPosturePortal Under development
The read-only board that aggregates findings, risk and coverage from every product, per tenant and fleet-wide.
PosturePortal
Licensing
You decide how far it goes.
Most products are sold on the same three steps. You buy the depth you actually want, and the step that writes to your tenant is always a deliberate, separate decision.
-
Step 1 · See it
Visibility
Inventory, scoring and findings history. Nothing in your tenant changes.
-
Step 2 · Govern it
Governance
Policies, access reviews, approvals, waivers that expire, and evidence packs.
-
Step 3 · Act on it
Automation
Write-back with undo, behind its own consent — and every change approved on its own.
Scanning is never metered. No per-scan pricing, no charging per finding, no hard cap that stops a scan for a commercial reason. You are billed on the size of the estate — a number you already know before you buy.
The principle
Security stands above compliance.
- Waived findings stay visible, and stay in the score. A waiver changes the report, not the estate.
- Exceptions expire. Mandatory expiry, and automatic invalidation when the finding changes shape.
- Never a fabricated pass. A control that cannot be assessed reports “not assessed”, never green.
- Findings are not metered. Discovering more never costs more, so nothing rewards looking away.
Why security comes first
Not because compliance does not matter — it is a whole product here — but because a compliance control can be waived, and an attacker does not abide by your waivers.
Every framework has an exception process. A control gets accepted as a risk, signed off, and the report goes green. Nothing about the estate changed. Do that a few times across a few frameworks and you have built something worse than a gap: a documented, audited, board-reported sense of safety that does not correspond to anything real.
So the order is deliberate. The security finding is the fact. Compliance is an interpretation laid over that fact, and a waiver changes the interpretation only. You can accept a risk. You cannot make it disappear from the screen.
That is what the three words under the logo are ordered by: secure first, because it is the thing that is actually true; compliant second, because it is provable once the first is real; confident last, because confidence earned in that order is the only kind worth having.
Three ways in
Try it before you buy it.
Each is a real assessment with a real report at the end, whether or not you buy anything afterwards. Two of them need nothing from you but a domain name.
What Copilot can reach
A scoped crawl of your tenant, or your worst few client tenants: anonymous links, external guests, company-wide shares and the app consents nobody remembers granting — scored, with the list of what to revoke. You can revoke the consent the moment the report lands.
Get my exposure reportWho is sending as you
SPF, DKIM, DMARC, BIMI and MTA-STS across your sending and parked domains, and what an attacker could send from the ones you forgot you owned.
Check my domainWhat your attacker sees first
TLS, certificates, security headers, cookies, DNS hygiene and exposed content on the public face of your estate — graded against the standards that define each one.
Scan my site
One product needs nothing from you at all, and it does not stop being free.
WebScan’s complete scanner is included with every SeQontrol
account — one URL at a time, for as long as you keep the account. The licence buys what happens after
the scan: history, schedules, alerts, evidence.
Before you ask
Fair questions.
The three reasons people do not buy this. All three are reasonable, two of them are sometimes right, and we would rather say which.
“Microsoft already gives me this.”
For one tenant, one administrator and no reporting obligation — largely true. Secure Score, Purview and SharePoint Advanced Management ship with your licence and you should start there. A tool you already own and will actually check beats one you buy and ignore.
It stops being true when you need evidence that a control held over a period, or when you manage sixty tenants and nothing native spans them. The four specific gaps.
“We already run CIPP.”
Good, and keep running it. CIPP administers tenants and it is free; nothing here replaces that, and running both is a normal setup rather than an awkward one.
What it was not built to do is retain a control-tagged record that something held over time. That does not matter until an insurer, an auditor or a client’s customer asks — and then it is the only thing that does. The honest split.
“I am not letting a vendor write to my tenant.”
Correct instinct, and you do not have to. Scanning is read-only. The permission that writes is a separate consent you may never grant, and every read-only product keeps working without it.
If you do grant it, each change is approved on its own, and a refusal from your directory is recorded as a refusal rather than retried quietly. What we do with the access.
Already using something? Good.
Start with what anyone can already see.
The spoofing check and the surface scan need only a domain — no tenant and no consent. The Copilot reach report needs a read-only connection and nothing more.
Start with a handful of tenants.
Sign up as a provider — the provider agreement is accepted online — and run it on your own tenant first, then on your worst few clients. Or have us scope that first assessment with you.
Built by JeffOps · Nieuwegein, the Netherlands · Data in Azure (Europe)