Running Scans

TATER supports M365 cloud audits, Windows OS compliance scanning, and endpoint vulnerability scanning. This guide covers all scan types, execution methods, grouping, deduplication, and export.

Scan Overview

TATER evaluates compliance across three primary scan types:

Importing Scans

Scan results can be imported into TATER through several methods:

File Upload

Automatic Upload (Runbooks)

When using Azure Automation runbooks, scan results are automatically uploaded to the TATER API using the POST /scans/upload endpoint. The runbook authenticates using an API key configured in Azure Automation variables.

# Runbook auto-uploads results to TATER API
# No manual import needed when using Azure Automation
# Configure these Automation Variables:
#   ApiBaseUrl = "https://api.tatersecurity.com"
#   ApiKey     = "your-api-key"
#   OrganizationId = "your-org-id"

Server-Side Cloud Scan Trigger

If you have stored tenant credentials in TATER, you can trigger a cloud scan directly from the browser without needing Azure Automation:

1. Navigate to Scans and click Run Scan
2. Select the tenant credentials to use (configured in Settings > Tenants)
3. Choose the scan scope (full or specific applications)
4. Click Start Scan to begin the server-side scan
5. Monitor progress in the scan status panel; results appear automatically when complete

Scan Grouping

The Scans page always groups scans by type, with the following group order:

1. Cloud Runbook -- Scans from Azure Automation runbooks
2. Cloud -- Server-side or manual cloud scans
3. Endpoint -- MDE/Intune vulnerability scans
4. Speed Test -- Network speed test results from agents

Within each group, scans are sorted by the user-selected sort column (date, pass rate, etc.). The primary sort is always by type group, with user-selected sorting applied as a secondary sort within each group.

Each scan row displays the date (including time), scan type, machine name, framework, pass count, fail count, and compliance percentage.

Scan Comparison

Compare two scans side-by-side to identify what changed between scan cycles:

1. Select two scans using the checkboxes on the scan list
2. Click Compare in the toolbar
3. The comparison view shows controls that changed status (Pass to Fail, Fail to Pass, new controls, removed controls)
4. Use this to investigate compliance drift and understand the impact of configuration changes

Scan Deduplication

TATER automatically detects and consolidates duplicate scans at upload time. When a scan with identical results is uploaded:

• The system compares the scan summary plus 100 randomly-sampled controls from the existing scan
• If the data matches, the existing scan record is updated with an incremented scanCount and updated lastScannedAt timestamp
• No new scan document is created, preventing database bloat from repeated identical scans
• The scan count badge shows how many times the same results were uploaded

M365 Compliance Audit

The M365 cloud audit evaluates your Microsoft 365 tenant for compliance with CIS Benchmarks, CISA SCuBA baselines, and DISA STIGs across seven cloud application areas, plus the endpoint and Intune benchmark sets.

Running the Audit Script

M365-ComplianceAudit.ps1 is the same engine the Azure Automation runbook calls; running it by hand is for ad-hoc scans and troubleshooting. Two things to know before the first run:

• It is not a standalone script. At startup it dot-sources its Modules\ folder and loads every control from Controls\ relative to its own location, so it must be run from the complete audit script folder. Lifting the single .ps1 out of that folder makes it fail on the first module load.
• Install the PowerShell modules once with .\Install-Prerequisites.ps1 -Products AllCloud (or a narrower -Products list). This pulls the Graph, Exchange Online, Teams, and SharePoint modules the audit depends on; it is safe to re-run.

# Basic usage - interactive authentication
.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -Products AllCloud -OutputPath "C:\ScanResults"

# App-only authentication with certificate
.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -AppId "app-client-id" -CertificateThumbprint "thumbprint" -Organization "contoso.onmicrosoft.com" -OutputPath "C:\ScanResults"

# Scope to specific products
.\M365-ComplianceAudit.ps1 -TenantId "your-tenant-id" -Products Exchange,SharePoint,Defender -OutputPath "C:\ScanResults"

Script Parameters

Applications Scanned

These are the cloud values accepted by -Products. The Control prefix column is the product code used on the control IDs themselves in the TATER catalog - it is not a value you pass on the command line.

-Products AllCloud expands to all seven above plus Intune. Endpoint benchmarks (Windows 11, Windows Server, Edge, Chrome, Defender AV, and the Intune benchmark sets) are separate -Products values - see the parameter table above for the full list.

Skip vs. Manual vs. Not Applicable

Three different statuses can be applied automatically when a control cannot be evaluated by the scanner, and they mean different things:

The Not Applicable flip is conservative: only license-gated controls the scanner couldn't evaluate are affected, a real Pass/Fail result is never changed, and if service-plan data is unavailable for the tenant nothing is flipped — no false N/A.

Endpoint Vulnerability Scanning

The endpoint scan collects vulnerability, software inventory, and compliance data from Microsoft Defender for Endpoint (MDE) and Microsoft Intune.

Data Sources

• MDE Devices: Full device inventory with health status, risk score, and exposure level
• MDE Vulnerabilities: Per-device CVE data queried individually to avoid memory limits
• MDE Software: Installed software inventory with weakness counts
• CISA KEV: Known Exploited Vulnerabilities catalog cross-referenced with MDE CVEs
• Intune Devices: Managed device compliance status and configuration profiles

Schedule

The Scan-Endpoints runbook runs daily at 3:00 AM ET via the daily-endpoint-scan Azure Automation schedule. Results are automatically uploaded to the TATER API.

Speed Test

The TATER Agent includes a built-in network speed test that measures download bandwidth. Results are uploaded alongside compliance scan data.

• Uses self-hosted test files at /Agent/speedtest/100mb.bin and 50mb.bin hosted on the TATER marketing SWA
• No dependency on third-party services (Cloudflare speed test caps at ~25MB)
• Results include download speed in Mbps and latency measurements
• Speed test scans appear in their own group on the Scans page

CSV Export

Export scan results to CSV format for use in external tools, SIEMs, or data warehouses:

1. Navigate to a specific scan's detail view
2. Click the Export CSV button in the toolbar
3. The CSV includes all control evaluations with: Control ID, Title, Status, Severity, Framework, Application, Description, and Remediation guidance

You can also export from the Controls page to get a cross-scan view of all controls and their current status.

Scan data freshness & source health

TATER tracks how recently each scan source last produced data, so old results don't quietly masquerade as current compliance. Each source is rated one of four states:

• Fresh — the source ran within its expected cadence.
• Aging — overdue but not yet stale; worth a look.
• Stale — well past cadence; treat its data as unreliable until you re-scan.
• Never — the runbook for this source has never completed. This means no scan has finished yet, not that a connector or Entra permission is missing — that is a different signal (see the connector-skip banner in the Dashboard guide).

Cadence SLAs by source:

To remediate an aging/stale/never source, trigger its runbook (or check the last job's status for a failure) — see Scan Scheduling below. The health of every source is available from the GET /scan-source-health API (Viewer and above) and the get_scan_source_health MCP tool, so an AI session can answer “why is my compliance data old?” directly.

Scan Scheduling

Configure recurring scan schedules using the Azure Automation scheduling system:

TATER also supports server-side scan scheduling through the GET/POST /scan-schedule API endpoints for organizations that prefer to manage schedules within the TATER application.