Productize the assessment. Do not invent a victim list.
After Drift, CISOs will pay for someone to list their OAuth grants and sit with them while they revoke. MSSPs can productize that. ScopeMantle's partner program is built for it: 70 / 30 wholesale, deal registration honoured, no poaching in registered territory, co-brand allowed, no minimum commit. Channel-led on purpose. Details live on partners.
This page is the bundle shape, the SOW edges, and the honesty rules. It is not a customer-count brag. We will not give you logos we do not have.
1. Week-one assessment
- Connect read-only Google and Okta on a partner or client tenant. Entra only if the client accepts Beta incompleteness in writing.
- Do not deploy agents. If the client's change board fears agents, that is the sentence.
- Week two: executive PDF. Grant count, below-forty list, top ten revoke recommendations, terminated-user leftovers if you were given HRIS emails.
- Co-brand the PDF if you want. Optional powered-by footer.
Fixed-fee SOWs should cap an employee band. Overage change-order aligned to ScopeMantle per-employee wholesale, not a surprise invoice. End-customer list price reference remains $5 annual / $6 monthly so procurement does not think you invented a third number.
2. Thirty-day attestation sprint
Client names sponsors (marketing, engineering). They approve or revoke flagged grants. You do not bulk-revoke without CISO (or named delegate) sign-off. That sign-off limits the partner-liability argument later. Day 30: revoke day for what they signed. Export before/after. That pair is their CC9.2 starter pack.
Ninety-day attestation renewal with a business sponsor. Permanent exceptions fail their next audit and become your support burden.
3. Recurring monitoring
Convert to a monthly digest to the client CISO: new grants, below-forty, breach-feed matches. That is MDR-shaped OAuth, not a full SOC. Upsell DSAR ops if they have a privacy practice. See white-label DSAR.
4. Partner compliance
Your SOC 2 should treat ScopeMantle tenant access as a subprocessor relationship. Multi-tenant segregation is your control. We will not write your report. Client case access is in-scope for your CC9.2, not something you hide behind our brand.
Counsel: operator DSAR templates are not lawyer-reviewed. Do not let analysts send subject-facing mail on a client's behalf without the client's counsel gate.
What not to put in the one-pager
- Fabricated "200 assessments delivered."
- HIPAA or BAA claims. We are not attested.
- Entra GA.
- Win rates against Push or Nudge.
What to do this week
- Read partner terms. Register a deal before you demo.
- Draft an SOW with employee-band cap and wholesale overage.
- Run the assessment against your own tenant so the PDF is not theoretical.
- Open a partner sandbox conversation. India-specific: DPDPA program.
Assessment PDF outline (steal this)
- Scope: IdPs connected, date of export, Entra Beta footnote if needed.
- Live grant count, unique client IDs, grants per employee (headcount from the client, not from us).
- Below-forty list with scopes and owners. Top ten revoke recommendations with one-line why.
- Terminated-user leftovers if HRIS emails were provided. If not, write "not in scope this sprint."
- Chrome extension note if Admin and the store disagree.
- 90-day attestation plan and who must sign.
- Honest limits: what OAuth cannot see (warehouse keys, Salesforce apps that never touched the IdP).
Do not put a heat-map of "industry peers" on page one. We will not give you a benchmark. Compare the client to themselves in 30 days.
SOW clauses that save arguments
- Employee band and wholesale overage math, worked example in an appendix.
- Client CISO (or named delegate) must sign the revoke list. Partner does not freelance production revoke.
- Deal registration ID in the header so we do not collide.
- Subprocessor list: ScopeMantle plus your tools.
- No logo rights to ScopeMantle customers, because we have not published a list.
- Beta features called by name.
Delivery calendar
Day 0: kickoff, IdP access, change-ticket if their CAB needs it. Day 3: first sync complete or a written blocker. Day 10: draft PDF internally. Day 14: readout. Day 15 to 45: attestation sprint, weekly 30-minute stand-up, no new scope. Day 45: revoke day for signed rows. Day 46+: monitoring SKU or stop.
If day 3 is still "waiting on super-admin," you do not have a delivery problem. You have a sponsor problem. Pause the clock in the SOW. Do not eat the days.
How to talk about Drift without fear-selling
Use it as a mechanics example. Ask whether they can revoke a client ID by Monday. Time their answer. If they say "we would find it in Salesforce," ask about Google extensions. If they say "CASB," send them the data path. Then show their own Admin list. Their number does the selling. Your job is not to invent victims.
Partner-side failure modes
- Bulk revoke on Friday without sign-off because you wanted a heroic QBR.
- Selling Entra completeness.
- Reusing one demo tenant for two prospects.
- Calling the PDF a "certification."
- Staffing the sprint with people who cannot read a scope string.
- Forgetting sandboxes and agency Connected Apps, then claiming the estate is clean.
Train analysts on gmail.readonly versus calendar versus admin.directory before they meet a client. A 20-minute scope clinic is cheaper than a wrong revoke. Point them at the scoring framework so they are not inventing a fourth dimension on the call.
Field guide: first three clients
Client one should be your own tenant or a friendly design partner who will forgive a clumsy PDF. Connect Google and Okta. Produce the assessment outline from this page. Time the readout. Fix the footer. Do not start with a regulated bank.
Client two should be mid-market, single primary IdP, under 800 employees. Cap the SOW band. Register the deal. Run the 30-day sprint with weekly stand-ups. Require CISO sign-off before revoke day. Export before and after. That pair is their CC9.2 starter and your case study notes. You still may not publish their name unless they agree. We will not publish it either.
Client three is where you decide if monitoring is a real SKU. If new grants after day 45 are near zero, you either have a tight allow-list or a broken sync. Check which. If new grants are a flood, the monthly digest has a job. Price it as recurring, not as endless professional services.
Staffing math without fake utilization
One trained analyst can run two sprints at a time if they are not also doing DSAR bursts. A sprint is not a full-time job after week one, but the readout week is. Do not assign the same person to three readouts on one Friday. Do not staff with people who cannot explain gmail.readonly versus calendar versus admin.directory. A twenty-minute scope clinic is cheaper than a wrong revoke and a refund conversation.
Partner SOC 2: treat ScopeMantle access as a subprocessor. Multi-tenant segregation is your control. Annual review of who in your firm can see which tenant. If a new hire gets god-mode on day one, that is your finding, not ours.
What the PDF must never say
- Certified, attested, HIPAA, BAA, or a SOC 2 report we have not published.
- Entra generally available.
- A customer count or logo wall borrowed from us.
- A win rate against Push or Nudge.
- That CASB already covered this, if you did not show a client-ID export from that CASB.
Wholesale 70 / 30, deal registration, no min commit, co-brand allowed. List price reference $5 annual / $6 monthly. Custom at 500+ on the end-customer conversation. Partner terms. Sandbox.
Mistakes I keep seeing after the first workshop
People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.
Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.
If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.
A note for the partner managing principal
First client is your own tenant. Second is mid-market, one IdP. Third decides if monitoring is a SKU. Do not start with a bank. Do not staff three readouts on one Friday. Do not skip deal registration. Do not freelance production revoke. Seventy-thirty, no min commit, list price visible, Entra labelled, no logo wall. If the leftover-grant number did not move by month four, do not upsell DSAR. Fix the sprint.
What you can do without buying anything
Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.
When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.
Put the deal registration ID on slide one of every readout. If it is missing, you are not running the program, you are running a side conversation. Wholesale math belongs in the SOW appendix with a worked example, not in a hallway promise.
Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.