Ctrl+K
tatersecurity.com Open App

Getting Started

This guide walks you through initial setup of TATER, from signing in for the first time to importing your first compliance scan.

Prerequisites

Before you begin

Ensure you have a supported web browser, PowerShell 5.1+, and the appropriate administrative access for your organization.

Requirement Details
Modern Web Browser Chrome, Edge, Firefox, or Safari 11+
PowerShell 5.1+ Required for Windows endpoint compliance scanning and M365 runbooks
Bash (Linux agent) Standard bash shell - required only for Linux endpoint scanning
Local Admin / sudo Access For OS compliance scanning on target machines (Windows or Linux)
M365 Admin Rights Security Admin or Global Admin for cloud tenant auditing

Step 1: Sign In and Choose an App

Open the TATER hub

Navigate to app.tatersecurity.com in your web browser. This lands on the TATER hub - the shared sign-in and app-picker page for the whole suite.

Authenticate

Click Sign in with Microsoft and authenticate using your organization's Microsoft credentials (TATER uses MSAL.js with an OAuth 2.0 popup flow). Environments without Entra ID can sign in with email/password or SSO instead.

Pick TATER Security

After sign-in the hub shows a tile for each app you can use - TATER Security, TATER Ops, TATER Manage, My TATER, TATER Insights, and (if licensed) TATER Vault. Choose TATER Security, the compliance and GRC app this guide covers. You can return to the hub any time via the app switcher, and deep links / old bookmarks into the app keep working.

Select your organization

If you belong to multiple organizations, select the one you want to manage from the organization switcher in the header.

Fastest path: the Setup Wizard

Steps 2–4 below walk the manual configuration path. The quickest way to configure a new organization end to end is the downloadable TATER Setup Wizard (from TATER Security → Get Started): pick the features you want and it downloads the right scripts, prompts for the variables, runs the logins locally, and writes the results back. Pair it with the Guided Tenant Onboarding wizard in Step 3 for the ~2-minute tenant connection.

Step 2: Initial Configuration

Navigate to Settings (gear icon in the sidebar) to configure your organization:

  • Company Name: Your organization name (displayed in reports and headers)
  • Company Logo: Upload a logo (PNG, 200x50px recommended). Separate logos for dark and light themes.
  • Accent Color: Customize the dashboard accent color (default: #3b9eff)
  • Tagline: Optional company tagline for reports
Tip

Settings are saved per-organization. If you manage multiple organizations, configure branding separately for each one.

Step 3: Connect Your M365 Tenant

Recommended: Guided Tenant Onboarding wizard

The fastest way to connect a Microsoft 365 tenant is the Guided Tenant Onboarding wizard in Settings > Tenants. It generates a single self-contained PowerShell (Microsoft.Graph) script that the tenant's admin runs once - the script creates a least-privilege app registration, grants admin consent, mints a secret, and prints the Tenant ID / Client ID / Secret to paste back into the wizard. The whole flow takes about 2 minutes, versus roughly 20-30 minutes for a manual app registration.

  • Least-privilege by default: the script defaults to the read-only-audit permission profile (pure Graph, no Exchange step). A Full remediation option adds the write-capable roles with a documented Exchange step.
  • Cloud-tier aware: Commercial, GCC, GCC High, and DoD tenants each get the correct Graph environment automatically.
  • The paste-back step saves the credentials encrypted and adds the tenant to your tenant list - ready to scan immediately.

Alternative: Manual credential entry

If you already have an app registration (or prefer to create one by hand - see the Azure Registered Apps guide), add the tenant credentials in Settings > Tenant Credentials:

  • Tenant Name: Friendly display name (e.g., "Contoso - Production")
  • Tenant ID: Your Azure AD tenant ID (GUID format)
  • Client ID: App registration client ID for Graph API access
  • Authentication: Client secret or certificate-based authentication
Security Note

Tenant credentials are encrypted at rest in the database. Certificate-based authentication is recommended for production environments. Never share or expose client secrets.

Step 4: Import Your First Scan

Option A: Server-Side Scan (Recommended)

If tenant credentials are configured, you can run a scan directly from the dashboard:

  1. Navigate to the Scans page
  2. Click Run Scan and select your tenant
  3. The API authenticates to Graph API using stored credentials and runs compliance checks server-side
  4. Results appear automatically when the scan completes

Option B: TATER Agent (Windows / Linux / macOS)

Deploy the TATER Agent to endpoints for recurring local compliance scanning:

  • Windows: Install the MSI from Settings > Endpoint Agent. The agent runs as a Windows service and performs scheduled compliance scans with no user interaction.
  • Linux: Download the tar.gz package (amd64 or arm64) and run install.sh with your API key and org ID. The agent installs as a systemd service.
  • macOS: Download the binary (Apple Silicon or Intel) and install it as a launchd service.

Agent scan results are automatically uploaded to TATER and appear on the Scans page. See the Agent Deployment Guide for full installation and configuration details.

Option C: PowerShell Scan

M365-ComplianceAudit.ps1 is the same audit engine the Azure Automation runbook uses, run by hand instead. It is not a standalone file: at startup it dot-sources its Modules\ folder and loads every control script from Controls\ relative to its own location, so it has to be run from the complete audit script folder. Copying the single .ps1 out of that folder makes it fail on the first module load.

Let TATER write the command for you

Settings > Scan Commands generates the exact invocation for a tenant you have already configured - pick the tenant, the product scope, and the framework filter, and copy the command out. That page also lists the one-time Install-Prerequisites.ps1 step, which installs the PowerShell modules (Graph, Exchange Online, Teams, SharePoint) the audit depends on. Run it once before your first scan.

From the audit script folder, a full cloud scan looks like this:

.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -Products AllCloud -OutputPath "C:\ScanResults"

The same script also covers Windows OS compliance scanning - select the endpoint product instead of the cloud ones:

.\M365-ComplianceAudit.ps1 -Products Windows11 -LevelFilter 1 -OutputPath "C:\ScanResults"

The scan writes its results to Reports\M365_Audit_<timestamp>.json underneath the -OutputPath directory (the script's own folder if you omit it) and prints the path when it finishes. Import that JSON from the Scans page using the Import Scan button.

Every parameter is documented in the Running Scans guide. If you would rather not manage the script folder at all, Option A and Option B above need nothing installed locally.

Step 5: Verify Your Import

Return to the main Dashboard page. You should now see:

  • Compliance Score: Overall compliance percentage
  • Control Status: Passed, Failed, Manual, Not Applicable counts
  • Trend Chart: Scan history visualization showing your first data point
  • Application Cards: Per-service compliance breakdown
  • Top Priorities: your "what should I do next?" signal - this widget ranks the 3/5/10 highest-impact failing controls by risk severity, remediation effort, and end-user impact, each with a plain-language reason and a deep link to the control. Work this list from the top; items drop off automatically as controls pass or receive a risk acceptance.
You're ready!

Your first scan is imported and compliance tracking has begun. Continue to the next steps below to get the most from TATER.

Topbar Icon Buttons

The topbar runs across the top of every page and contains several quick-action icon buttons on the right side:

Icon Action Shortcut
🔍 Magnifying glass Open the search / command palette - start typing to filter and jump. In TATER Security this is the full search overlay (recent pages + quick actions + cross-record search); in TATER Ops, TATER Manage, My TATER, and TATER Insights it is a command palette that fuzzy-jumps to any page in that app (arrow keys + Enter to go, Esc to close). Same shortcut everywhere. Ctrl+K / Cmd+K
☑ Checklist Opens TATER Ops → My Tasks (the unified task system across all sister apps; the badge counts your open Ops tasks) -
★ Star Open Favorites dropdown (pin frequently visited pages) -
≡ Hamburger Tools menu (Import Scan, Import Risk Acceptances, Export Bundle) -
↺ Circular arrow Refresh current page - re-fetches data without a full browser reload -
🔗 Chain link Copy a shareable deep-link to the current record (or page) - paste into chat / email / a wiki page and the receiver lands on the same view. Works for detail pages (risk, POAM, RMF, audit, BCP/DR, vendor, task, wiki page, etc.) and list pages with an open detail modal (ConfigDoc, project, SSP). The same icon is present in TATER Ops, TATER Manage, and My TATER topbars. Shift+L
ⓘ Circle-i Report a bug or submit a feature request -
🌙 Moon / ☀ Sun Toggle dark / light mode -

Next Steps

  1. Run the TATER Setup Wizard to configure any features you skipped during initial setup
  2. Review the Dashboard Guide to explore all dashboard features
  3. Create Risk Acceptances for any accepted risks with business justification
  4. Assign controls to team members in the People page for accountability
  5. Set up Azure Runbooks for automated scheduled scanning
  6. Generate your first Executive Summary Report for stakeholders
  7. Configure multi-framework mapping for NIST, ISO 27001, SOC 2
  8. Explore the rest of the suite from the hub: TATER Ops (tickets and service management), TATER Manage (admin console, API keys, connections), My TATER (each person's tasks, reviews, and requests), and TATER Insights (cross-platform reporting)
  9. MSP organizations: Navigate to MSP → Clients to register your MSP org and add client relationships with T1 (Monitor), T2 (Operate), or T3 (Manage) tiers. See the MSP Guide for full setup instructions.

Troubleshooting Initial Setup

Dashboard shows empty state?

Ensure you have imported at least one scan. Navigate to the Scans page and use the Import button to upload a scan results JSON file.

Authentication fails?

Verify your Entra ID app registration has the correct redirect URIs configured. Clear browser cache and try again. Check that your account has the required admin roles.

PowerShell scan fails?

Ensure you are running PowerShell as Administrator. Check execution policy with Get-ExecutionPolicy and set to RemoteSigned if needed. Verify the output directory exists and has write permissions.