TATER License Rentals
Let users request a Microsoft license (Visio, Project, …) for a set number of days. TATER grants it on schedule — by adding the user to an Entra licensing group, or by creating a task for someone to assign it manually — and removes it automatically when the time is up, emailing the user at each step.
Admins configure rentable licenses in TATER Manage → Approvals & Finance → License Rentals. Users request + track them in My TATER → My Licenses. IT approves in TATER Ops → License Approvals.
Two ways to fulfill a license
| Mode | How it's granted / removed | Best for |
|---|---|---|
| Entra group (automated) | A runbook adds/removes the user from an Entra licensing group on a schedule. The Microsoft license follows the group membership. | Licenses assigned via group-based licensing (the ideal path). |
| Manual task | TATER creates an Ops task ("Assign Visio to Jane") on grant and a removal task at expiry. Closing the task flips the rental state and notifies the user. | Licenses not controlled by group membership — assigned by hand in a portal. |
Group-based licensing usually propagates within minutes, but the app (Visio, Project) often needs the user to sign out and back in — or restart the app — before the license activates. Set a per-license re-auth note and TATER includes it in the activation email.
Configuring a rentable license
In TATER Manage → Approvals & Finance → License Rentals, click + Add license and set:
- Name — what the user sees (e.g. "Visio Plan 2").
- Fulfillment method — Entra group (pick or paste the group object id; a built-in Graph search helps) or Manual (a fulfiller email / team + task category).
- Min / default / max days — the allowed rental length (minimum 1 day; max is yours to set).
- Require approval — on by default; optionally list specific approver emails (otherwise org admins approve).
- Cost/day, currency, seat limit — optional, for chargeback and capacity.
- Re-auth note — shown in the activation email.
Runbook setup (Entra-group licenses only)
Entra-group licenses are granted/removed by the Manage-LicenseRentals Azure Automation runbook, which polls TATER on a schedule, makes the group change with its own privileged credential, and reports back. This keeps the group-write permission separate from TATER's read-only scanning credential.
Create a dedicated app registration
In your Entra tenant, register an app with the application Graph permission GroupMember.ReadWrite.All (or Group.ReadWrite.All), grant admin consent, and add a client secret. This app exists only to manage the licensing groups.
Import the runbook + set Automation variables
Import Manage-LicenseRentals.ps1 into your Azure Automation account and add these variables:
LicenseRental_ApiKey a TATER org-bound API key (encrypted)
LicenseRental_TenantId your Entra tenant id
LicenseRental_ClientId the dedicated app's client id
LicenseRental_ClientSecret the app's client secret (encrypted)(ApiBaseUrl defaults to https://api.tatersecurity.com.)
Schedule it
Link a recurring schedule — every 15 minutes is typical. Each run grants any newly-approved rentals whose start time has arrived and removes any whose time is up.
Manual-fulfillment licenses need no runbook — they create an Ops task instead, so you can offer license rentals before (or without) wiring up Automation.
Requesting a license (My TATER)
A user opens My TATER → My Licenses, clicks Request a license, picks one, chooses a duration (1…max), and submits. They see active rentals with a live countdown and can Extend (up to the maximum) or End early. Emails go out when the request is approved, the license is active (with the re-auth note), it's expiring soon, and it's removed.
Approving requests (Ops)
If a license requires approval, IT works the queue in TATER Ops → License Approvals: approve or deny pending requests, and see the whole org's active rentals with pending / active / expiring KPIs. Manual-fulfillment grant/removal tasks also appear in the normal Ops task list.
MCP tools
| Tool | Purpose |
|---|---|
list_rentable_licenses | List the catalog a user can request from. Read-only. |
request_license_rental | Request a rental for yourself, or (as an Admin) on behalf of a user. |
list_license_rentals | List your rentals, or (Admin) the org queue, with status filter. |
approve_license_rental | Approve a pending request (approvers only). |
Permissions & privacy
- Any user can request a license for themselves; only Admins can request on behalf of others.
- Approving / denying requires being an org admin or a listed approver for that license.
- Configuring rentable licenses requires Admin (TATER Manage).
- The privileged group-write credential lives only in the runbook — TATER's scanning credential stays read-only (used here only to search groups for the picker).
Related
- TATER Manage — where rentable licenses are configured.
- TATER Ops — the approval queue and manual fulfillment tasks.
- Azure Runbooks — Automation account + runbook background.
Was this page helpful?