SCOUTz / Seen From Outside
What can you learn about a company's IT from the outside, before they let you in?
A domain scan reads what public records, certificates, and Microsoft's public sign-in page reveal about a company's IT. Anything not visible is labeled Not visible from outside, with the added scope of the Microsoft scan named; nothing is inferred.
What it does
- Read the email platform and the mail filter in front of it.
- Check whether a Microsoft 365 tenant exists and sits in commercial cloud.
- Read whether sign-in is managed in Entra ID from Microsoft's public sign-in page.
- List apps confirmed by DNS or mail records, including CRM, marketing email, and e-signature.
- Read the AI crawler policy in robots.txt.
- Identify the DNS and hosting provider.
- List subdomain names with their sources.
- Label unseen items Not visible from outside and name what the Microsoft scan would add, without inferring them.
Illustrative example
· Not customer data
The scan confirms 1 marketing email app through mail records. An item it cannot read is labeled Not visible from outside, not inferred.
Questions MSPs ask
Which sources does a domain scan use?
It uses public records, certificates, and Microsoft's public sign-in page.
Does an app name mean SCOUTz inferred its use?
No. Apps listed here are confirmed by DNS or mail records. Nothing is inferred.
Can it tell whether a Microsoft tenant exists?
It reads whether a Microsoft 365 tenant exists and sits in commercial cloud, and whether sign-in is managed in Entra ID.
What happens when something cannot be seen?
It is labeled Not visible from outside and names what the Microsoft scan would add.
Does it read the AI crawler policy?
Yes. It reads the AI crawler policy in robots.txt.