Short answer for a client's IT or security team: SeatReaper installs nothing on any device, needs no inbound port on the client's network, and needs no exclusion in antivirus or EDR. It reads each tool's cloud API from SeatReaper's own servers, the same way the tool's own web console does.
Nothing runs on client devices
There is no agent, script, service or scheduled task. SeatReaper never connects to a laptop, server or firewall. So:
- EDR and antivirus (CrowdStrike Falcon, SentinelOne, Huntress, Sophos, Webroot, Defender) have nothing to inspect on the device, and there is nothing to exclude or allow.
- RMM (N-central, Datto RMM, NinjaOne) does not run anything for SeatReaper. SeatReaper reads the device list through the RMM's API.
- The client's network sees no traffic from SeatReaper at all.
How SeatReaper connects
Every connection is outbound from SeatReaper's servers to the vendor's API over HTTPS (port 443), with the read-only key, API client or approval you created for it. The calls look like any other API integration in that vendor's logs.
SeatReaper's servers run in the cloud and do not have fixed IP addresses. That has two consequences:
- Do not limit SeatReaper's key to certain IP addresses. Several consoles let you restrict an API key or API user to an IP allowlist. Leave that off for the key you made for SeatReaper, or the sync fails. Protect the key instead by keeping it read-only and rotating it when it expires.
- Firewall rules by IP cannot single SeatReaper out. For the few tools that run on your own server (below), the address has to be reachable over HTTPS from the internet.
Tools on your own server
Most tools are cloud services, and nothing changes on your side. These can run on a server you host, and then SeatReaper must reach them at a public https host name. SeatReaper refuses IP addresses, internal names (.local, .lan, .corp and similar) and any name that points to a private network address.
| Tool | What must be reachable | Notes |
|---|---|---|
| N-able N-central (self-hosted) | The N-central server's web address on 443, or the port you use | N-able's hosted N-central needs nothing. SeatReaper calls the N-central API with a read-only API user's token. |
| 3CX | The 3CX web client address, such as https://client.my3cx.us or https://pbx.client.com:5001 | Usually already published for the 3CX apps. |
| Yeastar P-Series | The PBX address and port, or its Yeastar remote access address | Leave IP restriction off on the API settings. |
| ConnectWise PSA or HaloPSA (self-hosted), for tickets | The PSA's API address | Cloud-hosted PSAs need nothing. |
| A webhook you add | Your https endpoint | Check the X-SeatReaper-Signature header to accept only SeatReaper's posts. |
Microsoft 365
Each client's admin approves the SeatReaper Connector app once in their tenant (see Connecting Microsoft 365). After that:
- Entra ID > Enterprise applications lists SeatReaper Connector with its read-only permissions. If removals are turned on, SeatReaper Actions is listed separately.
- Sign-in logs > Service principal sign-ins shows SeatReaper Connector signing in, normally once a day plus any Sync now. That is expected.
- Audit logs show nothing from SeatReaper Connector, because it cannot change anything. Changes made with SeatReaper Actions (blocking a sign-in, removing a license) appear there under that app's name.
- Conditional Access: a policy that blocks unknown apps or service principals, including a workload identity policy, can block the sync. Exclude SeatReaper Connector from it.
- Defender for Cloud Apps or app governance, if the client uses it, may list SeatReaper Connector as a new app with read access to directory data, or raise an informational alert when it is first approved. That is the approval working as intended: review it and mark the app as approved.
What each security tool's logs show
| Tool | Where SeatReaper shows up | Can it set off an alert? |
|---|---|---|
| CrowdStrike Falcon | The API client you created, in the audit log for API activity | No. It reads hosts only (Hosts: Read). It never touches detections, policies or the sensor. |
| SentinelOne | The service user's API token, in Activity | No. A view-only role (such as Viewer) that reads sites and agents. |
| Huntress | API requests under the account's API key | No. Huntress keys cover the whole account, but SeatReaper only reads organizations and agents. |
| Sophos Central | The API credential | No. A read-only role (Service Principal Read-Only). |
| Webroot | Sign-ins by the console admin you made for SeatReaper | No alert from the endpoints. The Unity API signs in as that admin, so use one kept only for SeatReaper, without a password change or interactive prompt pending. |
| Duo | The Admin API application, in the administrator log | No. Only Grant resource - Read (and Grant accounts - Read for Duo for MSPs). |
| N-central, Datto RMM, NinjaOne, Cove, Acronis | The API user or API client you made | No. Each reads devices and customers only. |
| Microsoft 365 | Service principal sign-ins for SeatReaper Connector | Only an informational "new app" notice in Defender for Cloud Apps, if used (above). |
SeatReaper never reads alerts, detections, threats, emails, files or chats, and it does not judge whether a tool is working. It only compares what each tool bills for with what is still in use: a device another tool still sees checking in is not flagged as dead.
Email from SeatReaper
Digests, alerts and scheduled reports come from SeatReaper's sending address (scheduled reports show your MSP's name as the sender). Mail goes out through SeatReaper's email provider, whose addresses change, so if a spam filter holds it, allow the sender address rather than an IP. Ticket emails to a PSA intake mailbox come from the same address.
For a security questionnaire
- Installed software on client devices: none.
- Inbound ports on the client network: none. Self-hosted N-central, 3CX, Yeastar or PSA: HTTPS only, at a public host name you choose.
- Fixed source IPs: no. Do not IP-restrict SeatReaper's keys.
- Access level: read-only in every tool. Changes in Microsoft 365 happen only through the separate SeatReaper Actions app, only on Growth and up, and only after an owner turns them on and the client's admin approves it.
- To revoke: delete the key, API client or app approval in the tool. Each Connecting article says where.
More in Security and data and the Trust center.