FAQ & Troubleshooting

Answers to common questions and solutions for typical issues with TATER.

General Questions

What is TATER?

TATER (Threat Analysis Targeting Enterprise Resources) is a multi-tenant compliance management platform for Microsoft 365 and endpoint environments. It automates security auditing against CIS Benchmarks, CISA SCuBA, DISA STIGs, and custom frameworks.

Which compliance frameworks does TATER support?

TATER supports CIS Benchmarks (M365, Windows 11, Server 2019/2022/2025, Edge, Intune), CISA SCuBA, DISA STIGs, and maps to NIST 800-53, ISO 27001, SOC 2, PCI DSS, HIPAA, and GDPR. See Frameworks & Standards for details.

How many controls does TATER evaluate?

Over 5,000 controls across 19 frameworks, plus dynamic vulnerability controls from MDE endpoint scanning.

Does TATER support multi-tenant environments?

Yes. TATER is designed for multi-tenant use. MSPs and organizations with multiple M365 tenants can manage each tenant independently with separate scan results, overrides, and reports.

Authentication

Verify your Entra ID app registration has the correct redirect URIs
Ensure the app registration includes app.tatersecurity.com in redirect URIs
Clear browser cache and cookies, then try again
Check that your account has been added to an organization in TATER
Verify popup blockers are not blocking the MSAL authentication popup

I get 401 Unauthorized from the API

Your JWT token may have expired. Sign out and sign back in.
The API accepts both raw GUID and api:// prefixed audience formats
For runbook authentication, ensure the API key is correctly configured

Scanning Issues

My scan shows no controls

Verify the scan script completed without errors
Check the output JSON file exists and contains control data
Ensure you are importing the correct file format

Scans time out on large tenants

Large M365 tenants may require 30+ minutes. Increase the timeout parameter in the scan script. For Azure Automation, the default timeout is 3 hours.

Why do Teams controls show SKIP?

Teams Cs* cmdlets require delegated authentication, which cannot be automated in Azure Automation runbooks. Approximately 36 Teams controls permanently return SKIP status. This is a known platform limitation.

Endpoint scan runs out of memory

The MDE bulk vulnerabilities endpoint can cause out-of-memory in Azure Automation's ~400MB sandbox. The Scan-Endpoints runbook uses per-machine vulnerability queries with deduplication to avoid this.

Dashboard Issues

Dashboard shows no data

Ensure at least one scan has been imported
Check that you are viewing the correct organization
Verify your user account has appropriate permissions (at least Viewer role)

Trend chart looks flat

The trend chart needs multiple scans over time to show meaningful trends. Run scans regularly (daily or weekly) to build up historical data points.

Compliance score seems wrong

Check if overrides are affecting the score (overridden controls show as "Override" not "Fail")
Verify the correct compliance zones are configured (unchecked zones exclude controls)
Check the Framework Category filter (Compliance vs. Vulnerability views show different metrics)

Data looks stale — how do I refresh without reloading the browser?

Click the ↺ circular arrow button in the topbar (between the bug report icon and the dark/light mode toggle). It re-fetches and re-renders the current page's data in-place without losing your scroll position or navigation state. This is useful after a scan completes, after another user makes changes, or any time you want the latest data without a full page reload.

Remediation

Remediation button does nothing

Ensure remediation is enabled for your organization in Organization Settings
Verify the remediation webhook URL is configured correctly
Check that the remediation catalog has entries matching your failing controls
Confirm the Azure Automation Account is running and accessible

Exchange remediation fails

Exchange Online remediation requires the PS 5.1 companion runbook. Verify that Run-Remediation-EXO is published in your Automation Account and that the ExchangeOnlineManagement module (v3.4.0+) is installed.

Agent Issues

Agent cannot connect to API

Verify the API base URL includes the /api suffix
Check network connectivity and firewall rules for HTTPS (port 443)
Verify the Organization ID is valid
Test connectivity by opening https://api.tatersecurity.com/api/agent/version in a browser

Agent auto-update fails

Check that the download URL is accessible. CRLF line ending issues during SWA deployment can cause SHA-256 hash mismatches. Re-deploy the MSI to fix hash verification.

Deployment Issues

SWA deployment hangs

The swa deploy CLI can hang when run from Git Bash on Windows. Use PowerShell for SWA deployments instead.

API deployment returns errors

Run cd api && npx tsc --noEmit to check for TypeScript compilation errors
Verify all environment variables are set on the Function App
Check that the database is accessible from the API

Performance

Dashboard loads slowly

Large datasets (thousands of controls across many scans) can slow initial load
Use framework and status filters to reduce the displayed data set
Ensure you have a stable internet connection to the API
Modern browsers with at least 2GB RAM recommended

Getting Help

If your issue is not covered here:

Review the relevant guide page in this documentation
Check Azure Automation job output for runbook errors
Review browser developer console (F12) for frontend errors
Contact support at support@tatersecurity.com