Pierre COGNIN

Building Octopane 🐙 one console for MSPs to run Microsoft 365 across every client tenant. Co-founder @Techmood. Building in public.

[Pierre COGNIN @pYerR7]

M365 tip: never ship a new Conditional Access policy straight to "on."
Set it to report-only first. It logs what would have happened without locking anyone out, so you catch the service account or legacy app you forgot before it pages you at 6am. Then flip it on per tenant.

[Pierre COGNIN @pYerR7]

The multi-tenant tax nobody budgets for: reporting.
Every month you rebuild the same security and license summary per client, by hand, in a spreadsheet nobody enjoys. It isn't hard work. It's just an afternoon you burn proving you did the other work.

[Pierre COGNIN @pYerR7]

Build-in-public: stuck on pricing this week.
How do you price a tool whose whole job is handing MSPs back money on wasted licenses? Per tenant punishes growth, per seat feels wrong. Landed on flat tiers, plus contact-sales for the big shops.
https://t.co/aMYHieZnuG 🐙

[Pierre COGNIN @pYerR7]

as co-founder of Techmood I pushed us away from chasing features to shipping things users actually pay for.

we grew our user base while keeping burn tight.

now every early-stage founder faces the same pressure.

here's what worked for us:

[Pierre COGNIN @pYerR7]

a big difference between early startup culture 5-10 years ago vs today is that back then it felt like everyone was building together. now it's far more competitive and territorial.

I've been sitting with this.. not sure where the ecosystem goes from here.

[Pierre COGNIN @pYerR7]

M365 tip: SMS is the weakest MFA you can leave switched on.

SIM swaps and SS7 make texted codes interceptable. In the Authentication methods policy, turn off SMS and voice and push everyone to the Authenticator app or a passkey. Per tenant. Old defaults still allow SMS.

[Pierre COGNIN @pYerR7]

Hot take: "free" is the most expensive word in MSP tooling.

A free tool you self-host still costs you the VM, the patching, the 2am "why did sync break" debugging, and the one person who actually understands it.

That's not free. It's a second job you don't bill for.

[Pierre COGNIN @pYerR7]

Most MSPs audit M365 licenses once a year, if that.

A beta MSP ran it across one client tenant and found ~$1,650/yr sitting in seats nobody had logged into for 90 days.
One tenant. The rest of the book is still unaudited.

https://t.co/aMYHieZnuG 🐙

[Pierre COGNIN @pYerR7]

building something ambitious and watching it fall short still leaves you with skills, network, and hard-won clarity. that's what most people miss before they even start.

[Pierre COGNIN @pYerR7]

M365 tip: block sign-in on your shared mailboxes.

Every shared mailbox has a real user account behind it, often with a password some admin set once and forgot. Attackers love them. Disable sign-in so the box stays mail-only. Check every tenant.

[Pierre COGNIN @pYerR7]

Onboarding a new client tenant is death by a thousand clicks.

MFA, conditional access, sharing settings, your security baseline, all redone by hand in a fresh portal. You set the standard once. Then you reapply it tenant by tenant, forever.

[Pierre COGNIN @pYerR7]

Build-in-public: shipped per-client reports this week.

You do a pile of security work across 50 tenants the client never actually sees. Now Octopane turns any tenant into a clean PDF you can hand over at the QBR. The work becomes visible.

https://t.co/aMYHieZnuG 🐙

[Pierre COGNIN @pYerR7]

a mistake in startup building is when you build a product nobody asked for, not when you build something real and the market just isn't ready for it yet.

[Pierre COGNIN @pYerR7]

M365 tip: MFA does nothing if legacy auth is still on.

Protocols like IMAP, POP and SMTP AUTH don't support modern auth, so they skip your MFA entirely.

Block legacy authentication with a Conditional Access policy, per tenant.
Older tenants still allow it.
Check every one.

[Pierre COGNIN @pYerR7]

The thing about read-only multi-tenant dashboards: they show you the gap, then send you somewhere else to fix it.

Seeing an MFA hole across 12 tenants doesn't help at 4:55pm.

You still tab to the partner portal and fix it one tenant at a time. Visibility isn't the job.

[Pierre COGNIN @pYerR7]

Build-in-public: the ugliest part of Octopane was real MFA state per user.

Microsoft's report needs Entra P1, which most SMB tenants don't have.
So we read per-user auth methods via Graph instead. Real coverage where the portal shows blank.

https://t.co/aMYHieZVke 🐙

[Pierre COGNIN @pYerR7]

Build-in-public: the ugliest part of Octopane was real MFA state per user.

Microsoft's report needs Entra P1, which most SMB tenants don't have.
So we read per-user auth methods via Graph instead. Real coverage where the portal shows blank.

https://t.co/aMYHieZnuG 🐙

[Pierre COGNIN @pYerR7]

"I don't fully agree with every decision they made, but…" is such a strange thing to say about a founder.

are we supposed to agree with every call someone makes?

[Pierre COGNIN @pYerR7]

" Culture isn't a values doc on the wall. It's what you reward, ignore, and tolerate.

Your team is always watching. Culture starts at the top.

[Pierre COGNIN @pYerR7]

M365 tip: blocking sign-in doesn't offboard a leaver. Existing tokens stay valid for up to an hour.

Block sign-in AND revoke sessions (revokeSignInSessions), or they keep reading mail from an app that's still logged in. Same steps, every tenant, every time.