What it does
Compliance scans answer "is this control passing or failing?". The Configuration Inventory answers a different, complementary question: "what is the tenant actually configured to do, right now?" It captures the raw configuration values - not pass/fail verdicts - across your Microsoft 365 tenant so you have a current, structured snapshot for living documentation, audit evidence, and configuration-drift detection.
Each snapshot is captured automatically as part of the weekly cloud compliance scan, stored for 180 days, and compared against the previous snapshot so you can see exactly what changed in the tenant between scans.
This is a read-only feature. TATER captures and displays your existing configuration; it does not change anything in your tenant.
How it's captured
During each cloud scan, after the controls are evaluated, TATER's runbook reuses the same Microsoft Graph and Exchange Online connections the scan already established to read your tenant's configuration objects, then uploads a single snapshot to TATER. The capture is strictly additive and non-fatal: if any single category can't be read, that category is flagged and the rest of the snapshot still lands - the compliance scan itself is never affected.
A snapshot is produced on every successful cloud scan, so the inventory stays as current as your scan cadence (weekly by default; run an on-demand scan from Settings → Cloud Scanning any time you want a fresh one).
What's captured (17 categories)
Each category is one area of tenant configuration. Categories appear in a snapshot only when the corresponding service connected during the scan.
| Area | Categories |
|---|---|
| Entra ID | Organization profile, authorization policy, authentication-methods policy, Conditional Access policy inventory, named locations, verified domains, directory-role membership, cross-tenant access settings |
| Licensing | Subscribed SKUs / license inventory |
| Intune | Device compliance policies, device configuration profiles |
| Exchange Online | Organization config, accepted domains, remote domains, transport rules, mail-flow connectors |
| SharePoint | Tenant sharing & security settings (appears once SharePoint app-only scanning is connected) |
The page
Open TATER Security → Reports & Policies → Config Inventory. The page shows:
- KPI strip - when the snapshot was captured, its source, the number of categories and total config items, and the count of drift changes vs the previous snapshot.
- Snapshot history selector - jump to any earlier snapshot (last 50 retained within the 180-day window) to see the tenant's configuration as it was at that point in time.
- Drift panel - when the selected snapshot differs from the one before it, a summary (added / removed / modified) plus a per-change table showing the category, the specific key, and the before → after values.
- Category accordion - every captured category with its item count; click to expand and read the raw captured configuration values. Categories that couldn't be read are marked with an error note instead of a count.
- Refresh - re-fetch the latest snapshot (for example, right after a fresh scan completes).
Configuration drift
The first snapshot for an organization establishes the baseline (drift = 0). Every snapshot after that is compared field-by-field against the previous one. A change is classified as:
- Added - a configuration key that wasn't present before (e.g. a new Conditional Access policy, a new transport rule).
- Removed - a key that existed before and is now gone.
- Modified - a key whose value changed (the table shows both the old and new value).
Drift is computed automatically on every scan - no configuration required. This makes it easy to answer "what changed in our tenant since last week?" during an audit, an incident review, or a change-control conversation.
Reading it from your AI (MCP)
The Configuration Inventory is fully available to the TATER MCP server, so an AI agent can document your environment or reason about drift directly from real configuration values - TATER runs no internal LLM; your own assistant does the synthesis. Available on both the HTTP and stdio MCP servers:
list_config_categories- list the categories in the latest snapshot with item counts.get_config_inventory- return the raw captured values for a category (or the whole snapshot).get_config_drift- return the change set vs the previous snapshot.
A common pattern: ask your assistant to "document our Entra ID configuration" or "summarize what changed in the tenant since the last scan", and it reads these tools and writes the result into a Configuration Documentation page or a report.
API
For Power BI, scripts, or other integrations (Auditor+ token):
| Endpoint | Returns |
|---|---|
GET /api/config-snapshots/latest | The newest snapshot (all categories + drift). Add ?category=entra-org for one category. |
GET /api/config-snapshots | Snapshot history (metadata + drift summary per snapshot). |
GET /api/config-snapshots/drift | The drift report for the latest snapshot. |
GET /api/config-snapshots/{id} | A specific snapshot by id. |
Permissions
Auditor and above can view the Configuration Inventory and its drift. The data is org-scoped - each organization sees only its own tenant configuration.
Related
- Configuration Documentation - author and version living docs (often generated from the inventory).
- Running Scans - snapshots are produced by the cloud scan.
- MCP Setup - connect your AI assistant to read the inventory.