Help home · TATER Ops

M365 Tools in TATER Ops

Find these tools in Ops → M365 Tools. The section includes Flow Monitor and Power Platform inventory, Intune, SharePoint folder checks, SharePoint access review, Teams conversations and meeting artifacts, M365 usage reports, Teams call quality, audit search, and service health.

Connection Health

Under Ops → M365 Tools → Tenant-wide → Connection Health, an OrgAdmin can check the selected organization’s Graph app IDs and application roles. The check requests fresh Microsoft tokens so it can detect newly granted admin consent. It includes the organization’s default Graph connection, any different tenant configured for chat or transcript capture, and the separate teams-presence credential. Missing or rejected credentials and missing permissions are shown with repair guidance. Tokens and secrets are not returned.

Permissions present means the token carries the roles that TATER checks; it does not prove access to a particular folder, mailbox, organizer, or licensed service. Use the linked tool to confirm that resource. Transcript collection also needs Teams transcript access and an organizer application access policy. Presence also needs its workforce policy and selected subjects. Flow Monitor uses a separate scan/runbook integration and is linked for review. The check does not grant consent or change settings.

Capture Coverage

Under Ops → M365 Tools → Tenant-wide → Capture Coverage, an OrgAdmin can review chat and channel subscriptions, expiration, last notification and processing timestamps, pending notification age and retries, and retained message counts by type. Transcript coverage shows the last sync attempt, directory discovery progress, eligible organizers, never-synced and stale organizers, and up to 50 organizer errors. Organizer inspection is capped at 2,000 and labeled partial when more exist. Counts cover seven days by message creation or transcript import time. Recording references and explicitly captured expiration dates are counted separately.

These are observations from retained TATER records, not a denominator of every conversation or meeting in Microsoft. A quiet stream is not automatically broken; a recent sync run does not establish success for every organizer. Failed diagnostic reads remain unknown. History is bounded by capture enablement, supported Graph meeting types, organizer policy scope, and retention. Use the TATER bot or manual upload for meetings outside Graph coverage. An absent recording expiration date stays unknown.

SharePoint folder properties and move checks

SharePoint Folder Properties scans one folder link on demand and reports current item, file, and folder counts, total file size, and per-subfolder totals. Use Analyze version storage on the same folder to inspect current and prior-version bytes and the largest returned version histories. Scans are read-only and bounded; partial results and unavailable version histories are labeled. SharePoint Move Check compares a source folder with a destination folder at scan time. Matching paths and sizes are checked, and Graph hashes are compared when both sides provide one.

The organization’s Graph app needs permission to read the selected content, commonly Files.Read.All or Sites.Read.All; Sites.Selected works when the app has also been granted access to that site. Add the permission to the client ID configured under TATER Manage → Tenant IDs.

M365 Service Health

Shows Microsoft 365 service status and recent advisories, plus recent TATER-audited M365 configuration changes for context. It does not claim that a configuration change caused an incident. The configured Graph app needs the ServiceHealth.Read.All application permission with admin consent.

Teams Conversations

An OrgAdmin can enable capture after confirming organization policy authorizes tenant-wide capture. Capture covers new messages in all chats and channels after enablement; TATER does not import historical messages or copy attachments. Stored message text and sender/time metadata expire using the selected retention (30–365 days; default 90 days). OrgAdmins can turn capture off; captured records expire on schedule.

The Graph app configured under TATER Manage → Tenant IDs needs the Chat.Read.All and ChannelMessage.Read.All application permissions with admin consent. Microsoft may meter tenant-wide message notifications; check current Graph licensing and billing before enabling the feature. Captured messages are available to authorized Ops auditors in this page and through the TATER MCP tools. An MCP-connected AI can return general, technical, and emotional-language terms; emotional terms describe language patterns, not staff-level sentiment scores.

MCP message retrieval: Use list_teams_conversation_messages with format="json" for record IDs, the matched count, and next_cursor. Choose a since lower bound and optionally an until cutoff; continuation cursors retain the first page's time window. Repeat the original filters with each returned cursor until it is null. Pages contain at most 200 records and may be smaller to bound response size. Legacy numeric offsets are accepted, but new cursors bookmark the last returned message so equal timestamps and removal of earlier rows do not shift the next page.

Set include_full_text=true to read complete stored message text. The default is a 1,200-character preview with an explicit truncation flag; capture itself stores at most 20,000 characters per message. JSON includes IDs even when compact text output was requested, so a client can check unique records against the matched count. Queries use supported scoped reads and sort by timestamp and record ID without requiring a tenant index change. The window is at most 90 days. Cursors preserve a source-time cutoff, not an immutable database snapshot: edits, deletion, late imports and retention can change later reads.

The OrgAdmin's MCP read scope still controls access to all chats/channels or channels only. Empty/system filters, conversation filters, authorization and audit logging remain in force. Insights previews are bounded views rather than a complete message-reading fallback; reconcile totals only for identical dates, privacy scope and filters, within the report's source cap. An empty theme summary can mean no saved classifications or too few distinct senders; it does not establish an absence of captured messages.

Automatic meeting transcript capture

Open Ops → M365 Tools → Teams → Teams Meetings and Transcripts to configure automatic transcript capture, retention and history rescans. Teams Conversations configures chat and channel message capture.

An OrgAdmin can separately enable Graph transcript sync after confirming organization policy authorizes tenant-wide collection. TATER checks the connected Graph app for OnlineMeetingTranscript.Read.All and User.Read.All application permissions with admin consent. The latter is used to enumerate meeting organizers; transcript content is fetched through Graph's organizer-scoped transcript delta API. The tenant must also enable Graph transcript access in Teams meeting settings and assign an application access policy that covers every organizer to be collected.

When enabled, TATER performs an initial sync of transcripts Graph still exposes, then checks for newly available transcripts on a recurring schedule. TATER stores the transcript in the existing Meeting Records and Meeting Transcripts data model, with the configured retention period and an audit event. Review transcripts in Ops → Meetings → Transcript history or use the authorized MCP meeting tools for summaries, decisions, action items, and documentation.

Each Graph transcript artifact is retained separately under its existing meeting record. In Transcript history, choose a dated transcript; the current default is marked. Transcript creation/end dates are source metadata, not inferred meeting start times. Graph call IDs distinguish occurrences when available; artifacts without a call ID remain individually selectable. A manual or bot transcript stays the default when additional Graph history arrives.

An OrgAdmin can use Rescan available history to revisit enabled organizers and recover earlier artifacts Graph still supplies. Rescans run through normal sync batches, are audited, and can be requested at most once per hour. The request time is not a completion guarantee. Source exclusions and unavailable or expired Microsoft content remain gaps. Deleted or retention-expired artifacts are not resurrected by a rescan.

MCP clients can call list_meeting_transcripts with a meeting ID, then get_meeting_transcript with both meeting_id and the selected transcript_id. Listings are metadata only and paginated. Every history list and raw read applies the meeting's organization, visibility, consent, and sensitivity rules; raw reads are audited. Insights → Meeting Documentation Coverage links readable meetings to Ops for transcript review. Analysis remains in the connected AI session.

Transcript source links: Decisions and linked tasks can include a verified timestamp pointing to one retained transcript. Select a timed passage in Ops or supply the exact artifact ID, source hash and cue start through MCP. See Transcript source links for source validation, untimed-history limits and retention behavior.

M365 reporting: Insights includes Transcript Lifecycle, Capture Health & Exceptions, Meeting Knowledge Digest and Topic Trends. The knowledge reports provide copyable MCP prompts; opening a report does not generate analysis automatically. Review scope, permissions, filters and limits.

Transcript retention notices and records: the Meetings and Transcripts page shows policy deadlines due within seven days and overdue retained items. An OrgAdmin can preserve an individual transcript as a TATER record, then release preservation later without clearing other holds or resetting the retention clock. The weekly report notification uses retention metadata only. See Transcript expiration and preserved records. Microsoft source/video expiration is separate, and unreadable or expired source content cannot be recovered by preserving a record.

Graph imports record an immutable first-ingestion date separately from source dates. Retention evaluates each artifact using its own ingestion and source timestamps; newer history is preserved when an older artifact expires. Legacy dates are resolved from retained transcript ingestion metadata; an unknown ingestion date is kept for review. The meeting retention sweep honors holds and remains report-only unless the platform explicitly arms enforcement. Configuring capture retention alone does not arm that sweep.

This route does not require the TATER bot to join scheduled online meetings. Coverage still depends on Graph transcript access, the app access policy for each organizer, and Graph support for the meeting type. Microsoft currently documents channel-meeting limitations for the organizer transcript feed; use the TATER bot or manual upload when Graph cannot supply a transcript. The bot remains useful for meetings that need in-meeting capture or fall outside Graph coverage.

Transcript and recording-metadata warnings are shown separately. A temporary Microsoft 502, 503, throttle or network failure is queued for a later automatic retry. Optional recording failures preserve their feed cursor and do not delay the next successful transcript page. Open Diagnostic details for the Microsoft request reference and app ID; permission and organizer-policy failures still need the indicated setup correction. Capture Coverage reports transcript warnings separately from recording-metadata warnings. An enabled switch or recent attempt is not proof that every meeting was captured.

If the app also has OnlineMeetingRecording.Read.All, the organizer sync can attach Graph recording metadata to meeting records. Graph’s callRecording object provides a content endpoint, but not the OneDrive/SharePoint sharing URL or the file’s expiration date. Treat expiration as unknown until TATER resolves the underlying file metadata or the organizer supplies a verified location and date; do not infer an expiration date from the tenant default policy.

SharePoint Access Check

Paste one SharePoint or OneDrive folder link and choose Review folder access to review that folder’s effective permissions. TATER flags anonymous and organization-wide links, lists returned named recipients and link expiry, and records that the review was run. To inspect children, choose Scan subfolder sharing; this bounded recursive review reports returned sharing grants, likely guests, expiration and inheritance, with partial-result notices. Both actions are read-only. Graph may return a partial view depending on the connected app and caller’s relationship to the item. The app needs Files.Read.All or Sites.Read.All, or Sites.Selected with a grant to the selected site.

Exchange Inbox Rule Review

An OrgAdmin can enter one mailbox address under Ops → M365 Tools → Exchange → Exchange Inbox Rule Review. The connected Graph app needs MailboxSettings.Read application permission with admin consent. Review returned rule names, enabled status, forwarding or redirect destinations, and delete or move actions. TATER does not classify destinations as trusted or external, read message content, or save the rule results. The rule scan is bounded and reports truncation.

Pilot validation

1. Refresh Ops and confirm the expected release version in the footer. Open M365 Tools and confirm the product-area headings.
2. Use a known SharePoint folder for Folder Properties, then Analyze version storage. Review the subfolder breakdown, current versus prior-version totals, and completeness notices. Use Move Check with a known source and destination when validating a move.
3. Use Access Check on that folder, then Scan subfolder sharing. Compare a known sharing grant and its inheritance with Microsoft. Treat partial or unavailable results as incomplete evidence.
4. Review a mailbox whose rules you can compare in Exchange. If permission is missing, use the App ID in the error to identify the registration that needs consent.
5. In Teams Conversations, review subscription expiry, the last notification and processing timestamps, and queued notifications. Compare a known new captured message with Teams. Silence alone does not establish a collection failure.

M365 Usage Reports

OrgAdmins can load SharePoint site, OneDrive account, Teams team, and Teams user activity reports from Microsoft Graph for supported periods. The connected app needs Reports.Read.All. Microsoft may hide user-identifying fields according to the tenant’s report privacy setting. Use these reports for service capacity and adoption review, not as a measure of individual productivity.

Teams Call Quality

OrgAdmins can request a short-window call and meeting diagnostics summary using CallRecords.Read.All. TATER does not persist raw call records or participant identities. Microsoft retains call records for 30 days and may take up to 150 minutes to make a record available; this is a troubleshooting view, not a complete historical archive.

M365 Audit Search

OrgAdmins can submit a Microsoft Purview audit query for Teams, SharePoint, OneDrive, and Power Automate event types. The connected app needs AuditLogsQuery.Read.All, and the tenant must have the corresponding Microsoft auditing capability enabled. Queries are limited to seven days in TATER, subject to Microsoft’s query quotas, and results are not stored in TATER.

Read the TATER Ops overview →