Scope, domain verification and authorization
Add and verify a customer's domains, authorise active scans, and define internal network scopes for discovery.
Updated
On this page
RevoSecure only tests what you've told it belongs to the customer, and only actively tests what's been proven and authorised. Scope lives in the customer's Attack surface → Domains & scope.
Domains
The primary domain is added with the customer. Add more under Domains & scope. Domains can also arrive from:
- a connected Microsoft 365 tenant: its verified custom domains are added with the badge From Microsoft 365
(Microsoft's own
onmicrosoft.com-style domains are left out); - a Syncro import: a suggested primary domain, always unverified.
A domain another customer of your workspace already has isn't added twice; the tenant page lists it as In <customer>'s domains until you decide where it belongs.
Verify a domain
Verification proves the customer controls a domain. You need it for active scans and before sharing a customer portal.
| Method | How |
|---|---|
| DNS TXT | Publish the TXT record shown, then Check now |
| HTTPS file | Serve the file shown at the path given on the domain's website, then Check now |
| Microsoft 365 | Automatic for the tenant's verified domains while the connection is current (Verified via Microsoft 365) |
DNS verification asks the domain's own name servers, so a record is recognised as soon as the DNS provider publishes it. After the first Check now, pending domains are re-checked automatically every 10 minutes for 14 days, and you're notified when one verifies.
When Microsoft 365 verification lapses
A domain verified via Microsoft 365 goes back to unverified (passive scans only) when it's no longer a verified domain of the tenant, the connection is removed or refused by Microsoft, or the tenant hasn't synced successfully for 7 days. You're notified (Domain no longer verified). Domains verified by DNS or HTTPS never change this way, so Verify by DNS as well if a domain must stay verified whatever happens to the connection.
Active scans
An active external scan (port scan, zone transfer) needs, for every domain included:
- a verified domain;
- a written authorization attestation on the assessment (at least 10 characters, for example who authorised it and the reference);
- approval: an administrator's own request runs at once; others wait as pending approval until an administrator approves them.
Everything is audited. Passive assessments need none of this.
Internal network scopes
Internal discovery (from an agent inside the customer's network) is limited to internal IP and CIDR scopes, managed by administrators. Each scope must be:
- a private IPv4 network (RFC 1918); public, loopback, link-local and IPv6 ranges are refused;
- explicitly marked as allowing active testing, with an authorization attestation;
- unexpired. Revoking or expiring a scope cancels work in progress.
See Internal assessments for the rest of the requirements.