SeatReaper reads every SentinelOne agent that is not decommissioned, with its last activity and last signed-in user, across your sites. It never changes agents, policies or threats.
Create a service user
- Sign in to your SentinelOne console at the account (or global) level that holds your clients.
- Open Settings > Users > Service Users and create a service user. Menu names can differ slightly between console versions.
- Give it a view-only role (for example Viewer) at the account or global scope, so it can see sites and endpoints.
- Choose an expiration date for its API token, then copy the API token. It is shown once.
Note your console address, such as https://usea1-partners.sentinelone.net. SeatReaper only connects to sentinelone.net addresses.
Connect
An owner opens Settings > Integrations > SentinelOne, pastes the console address and the API token, and chooses Connect SentinelOne. SeatReaper reads one site to check the token, saves it encrypted, and runs the first sync. After that it syncs every day, and Sync now checks at any time.
When the token reaches its expiration date the sync fails and the card shows why. Create a new token for the service user and enter it again.
How agents are linked to clients
- Each site is linked to the client with the same name (ignoring capitals, punctuation and endings like Inc or LLC), or to the client an owner or tech picks under SentinelOne sites. A site still called Default site goes by its account's name, so one account per client works too. A picked link is kept on every sync.
- An agent in a site that is not linked still links to a client when exactly one client has a device with the same name in N-central, Datto RMM or Cove, or in a NinjaOne organization linked to a client.
What SeatReaper does with it
- Dead devices: an agent SentinelOne has not seen for the device threshold (60 days unless you change it) is flagged, but only if every other tool it appears in also considers it dead. One item lists every tool still billing for it. See What SeatReaper flags.
- Offboarding: SentinelOne agents appear in the device list when you offboard someone, with the last signed-in user, and are confirmed once they leave SentinelOne or are decommissioned.
- Prices: set your monthly cost per protected device in the price book.
Disconnect
An owner chooses Disconnect on the card. SeatReaper deletes the sites and agents it synced. Delete the service user in SentinelOne to revoke access completely.
In compliance reports
On Growth and Pro, SentinelOne is one of the EDR tools in the Device inventory and gaps report in the compliance evidence reports. A device another tool has seen recently but no EDR tool knows about is listed as missing EDR.