Setup guide for IT engineers

This guide takes you from a new SeatReaper account to a workspace that checks every client every day. Follow the phases in order. Each step says what you need, exactly what to click, and how to check it worked before you move on.

Time: about 60 to 90 minutes for the workspace and its tools, then about 5 minutes per client. You can stop after any phase and come back.

What SeatReaper does: it reads your tools (Microsoft 365, RMM, backup, security agents, training, billing) and finds seats and devices you pay for that nobody uses. It is read-only everywhere: it never removes a license, device or user. You remove things in each vendor's own console, and SeatReaper confirms the saving on the next sync.

Before you start: what you need

Gather these first. You only need the rows for tools your MSP uses; skip the rest.

Only owners connect tools, except Microsoft 365, which techs can connect too.

Tips before you begin:

• Use a password manager or a notepad you will delete afterwards: several tools show a secret once.
• Where a tool offers it, create a dedicated read-only user for SeatReaper rather than using your own login. Disabling that user later revokes SeatReaper cleanly.
• Run the setup from a desktop browser. Pop-up blockers can hide Microsoft's approval window; allow pop-ups for SeatReaper if asked.

Phase 1: Create and secure the workspace (10 minutes)

You need: your work email or Microsoft work account, and an authenticator app on your phone.

1. Open SeatReaper and choose Create an account, or Sign up with Microsoft if you see it. With email, confirm the link SeatReaper sends you.
2. Name your workspace after your MSP. You become its first owner.
3. Take the one-minute tour, or skip it. You can replay it from Help > Take the tour.
4. Turn on two-step verification for yourself: Settings > Security > Two-step verification. Scan the QR code with your authenticator app and save the recovery codes somewhere safe. See Two-step verification.
5. Optional but recommended: add a second authenticator (for example on a second phone) so losing one does not lock you out.

Check it worked: Settings > Security shows your authenticator and "this device" under where you're signed in.

Phase 2: Invite your team (5 minutes)

You need: your teammates' work emails and which role each needs.

1. Open Team, enter an email, pick a role, and choose Create invite. For a tech or viewer who should only work some clients (a dedicated engineer, a contractor), choose Only the clients I choose and tick their clients before you create the invite.
2. Copy the link and send it to them. It works once, only for that email, for 7 days.
3. Make at least one more owner, so the workspace never depends on one person.

Check it worked: each person appears on Team with the right role and client access after they accept. See Inviting your team and setting roles.

Phase 3: Connect your workspace-wide tools (30 to 45 minutes)

These tools are connected once and cover every client. Only owners can connect them. All of them are under Settings > Integrations. Do the ones you use, in any order; each one runs a first sync as soon as it connects.

For every tool the pattern is the same:

1. Create a read-only API user or key in the tool (the help article for each tool lists the exact menu path).
2. On Settings > Integrations, pick the tool under Add an integration, paste the details into its card and choose Connect. Tools you have connected are listed below that, under Connected tools.
3. Read the result line on the card: it says how many devices, sites or seats it found and how many it matched to your clients.

N-central

1. In N-central, create an API-only user with a role that can view devices and customers and nothing more.
2. Administration > User Management > Users, select the user, API Access, Generate JSON Web Token. Copy the token.
3. In SeatReaper, enter your N-central address (for example https://ncentral.yourmsp.com), paste the token, choose Connect N-central.

Matching: by the N-central customer ID you record on each client (Phase 4). Full details: Connecting N-central.

Cove Data Protection

1. Cove Management Console: Management > Users > API Users > Add API user, with the least privileged role that can view devices.
2. In SeatReaper, enter your partner name exactly as it appears at the top of the Management Console, plus the API user name and password. Choose Connect Cove.

Matching: by the Cove customer name you record on each client. Full details: Connecting Cove Data Protection.

Pax8

1. Pax8 app (as Partner Admin): Integrations > Credentials, create API credentials named "SeatReaper". Copy the client ID and secret.
2. Paste both into the Pax8 card and choose Connect Pax8.

Matching: automatic, by Microsoft subscription ID once a client's Microsoft 365 is connected, or by company name. Full details: Connecting Pax8.

Microsoft Partner Center (if you buy from Microsoft directly)

1. Partner Center (as an admin): Settings > Account settings > App management, Add new web app, copy the App ID, then Add key and copy the secret.
2. Enter your partner tenant ID, the App ID and the secret on the Partner Center card and choose Connect Partner Center.

Matching: by Microsoft 365 tenant ID; customers with no matching client are listed with their tenant ID. Full details: Connecting Microsoft Partner Center.

Datto RMM

1. Datto RMM: Setup > Global Settings > Access Control, turn on Enable API Access.
2. Setup > Users, choose a user that can view all sites and devices (a dedicated one is best), Generate API Keys. Copy the API key and secret key, and note the API URL (for example https://merlot-api.centrastage.net: the platform is "merlot").
3. In SeatReaper choose the platform, paste the key and secret, choose Connect Datto RMM.

Matching: by site name, or by the client you pick. Full details: Connecting Datto RMM.

Datto SaaS Protection

1. Datto Partner Portal: Admin > Integrations > API Keys, create a key pair. Copy the public and secret keys.
2. Paste both into the Datto SaaS Protection card and choose Connect.

Matching: by the client whose Microsoft 365 users use the customer's domain, then by name. Full details: Connecting Datto SaaS Protection.

NinjaOne

1. NinjaOne: Administration > Apps > API > Client app IDs > Add. Choose API Services (machine-to-machine), the Monitoring scope only, and the Client Credentials grant type.
2. Copy the client ID and the client secret (shown once).
3. In SeatReaper choose your region (the address you sign in at, such as app.ninjarmm.com or eu.ninjarmm.com), paste the ID and secret, choose Connect NinjaOne.

Matching: each organization by name or by the client you pick; any device still unmatched links by its name to the client that has the same device in N-central, Datto RMM or Cove. Full details: Connecting NinjaOne.

CrowdStrike Falcon

1. Falcon console (Flight Control parent if you have one): Support and resources > API clients and keys > Create API client.
2. Give it Hosts: Read, plus Flight Control: Read if you manage child CIDs. Copy the client ID and secret.
3. In SeatReaper choose your cloud (US-1, US-2, EU-1 or US-GOV-1, from the console address), paste the ID and secret, choose Connect CrowdStrike.

Matching: each child CID by name or by the client you pick; any host still unmatched links by its name to the client that has the same device in N-central, Datto RMM, Cove or NinjaOne. Full details: Connecting CrowdStrike Falcon.

SentinelOne

1. SentinelOne console, at the account or global level: Settings > Users > Service Users, create a service user with a view-only role and an expiration date.
2. Copy its API token (shown once) and your console address (it ends in sentinelone.net).
3. Paste both into the SentinelOne card and choose Connect SentinelOne.

Matching: each site by name (a Default site by its account's name) or by the client you pick, then by device name like CrowdStrike. Full details: Connecting SentinelOne.

Huntress

1. Huntress: open the account menu, choose API Credentials, and generate a key. Copy the API key and secret (shown once).
2. Paste both into the Huntress card and choose Connect Huntress.

Matching: each organization by name or by the client you pick, then by device name like CrowdStrike. Full details: Connecting Huntress.

Sophos Central

1. Sophos Central Partner (or Enterprise, or a single tenant): API Credentials Management, add a credential with a read-only role such as Service Principal Read-Only.
2. Copy the client ID and secret (shown once), paste both into the Sophos Central card and choose Connect Sophos Central.

Matching: each tenant by name or by the client you pick, then by device name like CrowdStrike. Full details: Connecting Sophos Central.

Acronis Cyber Protect Cloud

1. Acronis management portal, partner level: Settings > API clients, create an API client. Copy the client ID and secret (shown once) and note your data center address (such as https://us5-cloud.acronis.com).
2. Paste them into the Acronis card and choose Connect Acronis.

Matching: each customer tenant by name or by the client you pick, then by device name like CrowdStrike. Full details: Connecting Acronis Cyber Protect Cloud.

Webroot

1. Get Unity API credentials (client ID and secret) for your GSM console. If the console does not offer them, ask Webroot support.
2. Create a GSM console admin used only by SeatReaper, with no interactive prompts on sign-in.
3. In SeatReaper enter the GSM keycode, the API client ID and secret, and that admin's email and password. Choose Connect Webroot.

Matching: each site by name or by the client you pick, then by device name like CrowdStrike. Full details: Connecting Webroot.

Flowroute

1. In Flowroute Manager open Preferences > API Control and copy the access key and secret key.
2. In SeatReaper paste both and choose Connect Flowroute. Reading call and text history can take a few syncs on a large account.

Matching: numbers are grouped by alias and linked to the client whose name starts the alias, or the client you pick. Full details: Connecting Flowroute.

Check Phase 3 worked: each card on Settings > Integrations shows Connected and a result line such as "412 devices in 37 sites, 389 matched to 35 clients". It is normal for the matched numbers to be low until you add clients in Phase 4; they rise on the next sync. A card that shows Needs attention has the reason underneath; see the troubleshooting table below.

Phase 4: Add your clients (10 minutes, plus a few minutes per client)

A client is one end customer, usually one Microsoft 365 tenant. Owners and techs can add them.

Fastest: import a CSV. Clients > Import CSV > Download template, fill in one row per client, and import. Columns:

Use the same name as in Datto RMM, NinjaOne, Datto SaaS Protection, CrowdStrike, SentinelOne, Webroot, Huntress, Sophos Central, Acronis and Pax8 where you can: those tools match clients by name, ignoring capitals, punctuation and endings like Inc or LLC.

You can also add clients one at a time with Clients > Add client. See Importing clients from a CSV and Adding a client and finding its IDs.

Check it worked: Clients lists every client with its setup progress (for example Setup 3/7).

Phase 5: Connect each client's Microsoft 365 (about 3 minutes per client)

This is the most important connection: it is where most license waste is found. It needs an admin of the client's tenant, once per client.

1. Open the client and, under Data sources, choose Connect Microsoft 365.
2. Microsoft opens. Sign in as a Global Administrator or Privileged Role Administrator of the client's tenant (not your own MSP tenant) and choose Accept.
3. You return to the client's page and the first sync runs.

If your GDAP role cannot approve app permissions in that tenant, start the connection yourself and send the Microsoft page to an admin at the client; it is valid for 30 minutes. SeatReaper asks only for read-only permissions (users, sign-in dates and MFA registration, licenses, subscriptions) and cannot read email or files. See Connecting Microsoft 365.

Check it worked: the client's Microsoft 365 card shows Connected with a user and license count, and the licenses table fills in. If it says sign-in dates are unavailable, the tenant has no Entra ID P1 or P2 license: blocked users are still found, inactive ones are not.

Duo

1. Duo for MSPs: in the parent account's Admin Panel, Applications > Protect an Application > Accounts API. A single account: Admin API with only Grant read resource.
2. Copy the integration key, secret key and API hostname, paste them into the Duo card and choose Connect Duo.

Matching: each child account by name or by the client you pick; inside a client, users by email against Microsoft 365. Full details: Connecting Duo.

KnowBe4 (per client, if you use it)

1. In the client's KnowBe4 console: Account Settings > Account Integrations > API, turn on Reporting API access, copy the key, and note the region (us, eu, ca, uk or de).
2. In SeatReaper (owners), open the client, Data sources > KnowBe4, choose the region, paste the key, Connect KnowBe4.

See Connecting KnowBe4.

Google Workspace (if any clients use it)

1. Once: in Google Cloud, turn on the Admin SDK API and the Enterprise License Manager API, create a service account and download a JSON key. An owner pastes the key under Settings > Integrations > Google Workspace.
2. Per client: a super admin of the client's Google Workspace adds the service account's client ID and the two scopes shown on the Google Workspace card under Security > Access and data control > API controls > Manage domain-wide delegation.
3. In SeatReaper, open the client, Data sources > Google Workspace, enter an admin email of the client's domain, Connect Google Workspace.

See Connecting Google Workspace.

Phase 6: Link anything that did not match (5 to 10 minutes)

1. Open Settings > Integrations. Under each tool, the list of sites, CIDs, customers or companies shows unlinked ones first.
2. For each unlinked one, pick the client and choose Save. Picked links are kept on every sync. Choose Automatic to undo.
3. Open a few clients and check Data sources and the device lists look right.

Check it worked: every list says something like "37 of 37 linked to clients", and each client's setup checklist is complete for the tools it uses. See The client setup checklist.

Phase 7: Set prices and thresholds (10 minutes)

Prices turn findings into money. Without them, items show Set price and count as $0.

1. Open Settings > Price book.
2. For each Microsoft 365 license, enter your monthly cost (not the client's price). With Pax8 connected, choose Use this price to copy Pax8's cost.
3. Enter your monthly cost per device or seat for each other tool (N-central, Datto RMM, NinjaOne, CrowdStrike, SentinelOne, Webroot, Huntress, Sophos, Acronis, Cove, Datto SaaS Protection, KnowBe4, Duo), per Google Workspace license, and per local and toll-free Flowroute number.
4. Mark free or bundled items as Ignore so they are never flagged.
5. Check the thresholds: by default a user is inactive after 90 days without a sign-in, a device after 60 days without a check-in, a backup after 30 days, and a phone number after 90 days without a call or text. On Growth and Pro you can override them per client.

See The price book.

Check it worked: the Overview page shows open waste in dollars and Waste by tool, with few or no "unpriced" lines.

Phase 8: Turn on team security (5 minutes, owners)

All under Settings > Security:

1. Require two-step verification for everyone. Teammates without an authenticator are asked to set one up before they can see anything.
2. Require Microsoft sign-in (if your team uses Microsoft 365). Sign in with Microsoft yourself first; SeatReaper will not let you turn it on otherwise, so you cannot lock yourself out. When someone leaves your company and their Microsoft account is disabled, their SeatReaper access ends too. See Sign in with Microsoft.
3. Security alerts are on for every owner by default: you get an email when someone joins, a role changes, two-step is removed, credentials change, or support opens the workspace.
4. Optional: Audit log streaming to your SIEM. Enter an https endpoint and store the signing secret it shows once. See Security alerts and audit log streaming.

Your first review (15 minutes)

1. Open the Queue. Every item says what is wasted, the evidence (for example last sign-in 142 days ago) and what it costs per month.
2. For each item: Approve it (you will remove it), or Dismiss it with a reason (for example "on leave until March").
3. Remove approved items in the vendor's own console: the license in Microsoft 365, the device in N-central, and so on.
4. On the next sync (daily, or Sync now), SeatReaper checks each one is really gone from every tool that billed for it and marks it Verified saved.
5. When someone leaves a client, use Offboarding instead: it lists their sign-in, licenses, devices and seats in every tool and confirms each one as it disappears. See Offboarding someone everywhere.

See What SeatReaper flags and Working the queue.

After setup: what happens on its own

• Every day, every connection syncs and the rules run again. Nothing needs to be scheduled.
• Every week, everyone gets a short digest email with new waste and savings (each person can turn it off).
• Reports: send clients a Prospect Waste Assessment or a Monthly Waste Summary from Reports, or schedule them.
• Compliance evidence (Growth and Pro): when a client needs evidence for HIPAA, CIS Controls, NIST SP 800-171 (CMMC) or a cyber insurer, open Reports > Compliance evidence and print or download the report. The more of the client's tools are connected, the more complete it is. See Compliance evidence reports.
• Secrets expire: put a reminder in your calendar for each API secret's expiry date. When one expires, that card shows Needs attention; paste a new secret on the same card.

Troubleshooting

Still stuck? Use Help > Get help to open a request with SeatReaper support. If support needs to look at your workspace, an owner grants time-limited, read-only access under Settings > Security; every view is in your audit log. See Getting help.

Reference: what SeatReaper reads, and how to revoke it

Every connection is read-only. Credentials are encrypted before they are stored and are never shown again.

Disconnecting a tool in SeatReaper deletes everything synced from it. See Security and your data.

Related

• Getting started with SeatReaper
• What SeatReaper flags
• Security and your data