People, Users & Organizations

TATER uses three distinct concepts to manage access and accountability: People (compliance contacts who can be assigned controls), Users (authenticated accounts that log into the platform), and Organizations (multi-tenant isolation boundaries). Understanding how these relate to each other is essential for setting up TATER correctly.

People (Compliance Contacts)

The People page (navigate to Manage > People) is a directory of your organization's compliance stakeholders — the specific individuals who own, are accountable for, or are involved in compliance activities. This might include your CISO, your security engineers, your IT administrators, your data privacy officer, or key business unit contacts.

Person Record Fields

Adding a Person

Assigning Controls to a Person

Control assignments create accountability — they record that a specific person is responsible for addressing a specific compliance finding by a specific date.

Assigning a single control:

1. Open any failing control's detail panel (from the Controls page or Dashboard failing list).
2. Click Assign in the control detail panel.
3. Select a person from the People directory.
4. Set a due date and add any relevant notes or remediation guidance.
5. Click Save Assignment. An entry is created in the Assignments container and appears in the assignee's workload view.

Bulk assignment:

1. On the Scans page, use the checkboxes to select multiple failing controls.
2. Click Assign Selected in the action bar that appears.
3. Choose a person and due date that apply to all selected controls.
4. Click Assign. Individual assignment records are created for each selected control.

Workload View

Each person has a Workload view accessible by clicking their name on the People page. The workload view shows all controls currently assigned to that person across all frameworks and scan types, sorted by due date (most urgent first). This is a useful view for one-on-one meetings with team members to review their open compliance tasks.

People in Multi-Organization Environments

In environments where you manage multiple organizations (common for MSPs), people are scoped to a single organization. A consultant who works across multiple client organizations must be added as a separate Person record in each organization. This ensures that workload views and assignment reports are properly scoped and do not leak information between organizations.

Users (Authenticated Accounts)

Users are accounts that can sign in to the TATER platform. The Registered Users page (navigate to Admin > Registered Users — SuperAdmin only) provides a view of every account that has authenticated to the platform, along with their roles and activity.

Automatic User Registration

TATER registers users automatically on first sign-in. When a user authenticates via Microsoft Entra ID SSO or local password login for the first time, a User record is created in the database containing:

• The user's Entra Object ID (OID) — the stable identifier used internally
• User Principal Name (UPN) / email address
• Display name from Entra ID or the username from local auth
• Tenant ID from the JWT token
• First seen and last seen timestamps

No manual user provisioning is required. However, you must add the user to an organization (see Organization Members below) before they can access any data beyond the sign-in screen.

Role Hierarchy

TATER uses a five-level role hierarchy. Roles can be granted at two scopes:

• Global role: Stored in the Users container, applies across all organizations.
• Organization role: Stored in OrgMemberships, applies only within a specific organization.

Setting a Global Role

Global roles (SuperAdmin, ServiceProvider) are set on the Registered Users page (SuperAdmin only). Locate the user in the list and use the role dropdown to promote or demote them. Changes take effect on the user's next API request after their token expires (typically within 1 hour for Entra ID tokens).

Alternatively, use the Setup-SuperAdmin.ps1 PowerShell script to promote a user directly in the Cosmos DB Users container — useful if no existing SuperAdmin account is available:

.\Setup-SuperAdmin.ps1 -UserEmail "admin@yourorg.com"

Cross-Tenant Authentication

In environments where an MSP user's Entra ID account lives in a different Azure AD tenant than the client organization, TATER performs a cross-tenant membership lookup. When no org membership is found for the authenticating tenant, TATER searches OrgMemberships by email address as a fallback. This allows users to authenticate from their own tenant while accessing a client organization's data in TATER.

Organizations

Organizations are the primary multi-tenancy boundary in TATER. Every piece of data — scans, overrides, controls, people, policies, and GRC records — belongs to exactly one organization. Users can have memberships in multiple organizations and switch between them using the organization selector in the topbar.

Navigate to Admin > Organizations to manage organizations. This page is only accessible to SuperAdmins.

Organization Record Fields

Creating an Organization

Adding Members to an Organization

Organization membership is managed from the organization's detail panel. Click the organization name on the Organizations page to open its detail panel, then use the Members section.

Members can be added in two ways:

• By OID (after first login): If the user has already logged in, search by their display name or email. TATER resolves the search against the Registered Users list and adds the membership by Object ID.
• By email (before first login): Enter the user's email address directly. TATER creates a provisional membership record keyed by email. When the user signs in for the first time, TATER automatically upgrades the provisional record to an OID-keyed membership for efficient future lookups. The user's access takes effect immediately on first sign-in — no further action is needed.

For each member, assign one of the organization-level roles:

Organization-Level Settings

Each organization has its own configurable settings, accessible via Settings in the sidebar when an organization is selected. Key organization-scoped settings include:

• Branding: Company name, logo (dark and light variants), accent color, tagline. Displayed in reports and the application header.
• Compliance Zones: Which M365 applications are in-scope for this organization (Exchange, SharePoint, Teams, etc.).
• Scan Schedule: Configure recurring automated scan schedules (requires Azure Automation setup).
• Remediation: Enable automated remediation and configure the runbook webhook URL.
• SIEM: Configure syslog or webhook forwarding of audit events.
• Features: Enable optional features such as Predict the Unknown, AI Analyst, or beta capabilities.

Switching Between Organizations

If you have membership in multiple organizations, the organization selector appears in the topbar next to your user avatar. Click it to open a dropdown listing all your organizations. Selecting an organization switches all data views, filters, and settings to that organization's context. Your role within each organization may differ — for example, you might be OrgAdmin in your internal organization and Auditor in a client organization.

MSP Portal

The MSP Portal is an optional feature that elevates the capabilities of an organization's OrgAdmin users to behave more like a ServiceProvider — without requiring a global ServiceProvider role assignment for each individual.

Enabling the MSP Portal

Only SuperAdmins can enable the MSP Portal for an organization:

1. Open Admin > Organizations.
2. Click the organization you want to designate as an MSP organization.
3. Scroll to the MSP Portal section in the detail panel.
4. Check Enable MSP Portal and click Save.

When the MSP Portal is enabled (isMsp: true on the organization record), users with OrgAdmin or Admin role in that organization gain the following additional capabilities:

• Compliance Roadmap billing columns: Estimated hours, billing rate, and cost columns become visible in roadmap phase views.
• White-labeling access: Branding customization options that are normally restricted to SuperAdmin become available, allowing the MSP to apply client-specific branding.
• Cross-org visibility: OrgAdmin users in the MSP organization can view summary data for client organizations they have been added to as members — without needing a global ServiceProvider role.

Setting Up a Client Organization

For each client you manage, create a separate organization in TATER:

API Keys

API Keys provide programmatic access to the TATER API without using user authentication. They are primarily used by Azure Automation runbooks (for scan upload and remediation callbacks), the TATER Agent (for endpoint scan upload), and the Claude MCP integration.

Creating an API Key

API Key Security

API keys in TATER are designed with security in mind:

• SHA-256 hashed: The full key is never stored in the database — only a SHA-256 hash is persisted. TATER computes the hash of each incoming request's key and compares it against stored hashes.
• Prefix only after creation: After the initial creation dialog is closed, only the first 8 characters (prefix) are displayed. This lets you identify which key is which without exposing the secret.
• Per-organization scope: API keys are scoped to the organization in which they were created. A key created for Organization A cannot be used to access Organization B's data.
• Activity log: All API calls authenticated via API key are recorded in the Activity Log with the key prefix as the actor identifier.

Rotating API Keys

To rotate an API key (recommended at least annually, or immediately if you suspect compromise):

1. Create a new API key in Settings > API Keys.
2. Update the key in every system that uses it (Azure Automation variables, agent config, MCP settings).
3. Verify that each consuming system is working with the new key by checking the Activity Log for successful calls from the new key prefix.
4. Delete the old key from Settings > API Keys. Deleting the key immediately invalidates it — any system still using the old key will receive 401 Unauthorized responses.

Troubleshooting