Ctrl+K
tatersecurity.com Open App

Setup Wizard

Two surfaces, one checklist. The built-in Setup Wizard (TATER Manage → Overview → Setup Wizard) tracks and guides your environment setup with live detection. The downloadable executable configures a TATER organization end to end — pick the features you want, and it downloads the right scripts, prompts you for the variables, runs the logins it needs, and writes the results back, all locally, so your credentials never leave your machine.

Local-first, zero-knowledge by design

The wizard runs on your machine and authenticates with your interactive logins (Microsoft Graph, Exchange Online, and Azure CLI device-code by default). Secrets — client secrets, tokens, certificate private keys — never transit TATER. Only non-secret results (app registration IDs, resource names, webhook URLs) are written back to your organization record, and only through a strict server-side allow-list.

The built-in Setup Wizard (track & guide)

Open TATER Manage → Overview → Setup Wizard for a phase-grouped checklist of your organization’s environment setup — Identity & Access, Scanning, Endpoints, Communications, Governance, and Extras — with an overall completion percentage. It is the same engine behind TATER Security’s Get Started page, so both surfaces always agree. The built-in wizard tracks and guides; provisioning itself happens on the linked settings pages, via the downloadable executable below, or conversationally over MCP.

  • Live detection. Most steps are detected automatically from your organization’s real state — a scan exists, an agent heartbeated, SSO is configured. Work you completed outside TATER is recognized without any bookkeeping.
  • Status badges. Each step shows one of: Detected (auto-verified), Attested (marked complete by an admin), Pending, Broken (was working, now unhealthy — for example a lapsed email-intake subscription), Unknown (the check itself could not run — not necessarily un-configured), or N/A.
  • Mark complete / Undo. Admins can attest steps TATER cannot observe (such as enforcing MFA in your tenant). Attestations are recorded in the Activity Log, and a live detection always wins over an attestation when they disagree.
  • Verify now. Steps with an expensive live check — Graph admin consent, email-intake connectivity, SIEM and integration test connections — are verified on demand with a button rather than on every page load.
  • Configure links. Every step deep-links to the page where you actually set it up, in TATER Manage, TATER Security, or your Microsoft tenant, plus a Help link to the matching guide.

AI assistants connected over MCP read the same checklist with the get_setup_status tool and can attest genuinely unobservable steps with mark_setup_step_complete (Admin-only, audit-logged).

Download & launch

Get the wizard from TATER Security → Get Started (the “TATER Setup Wizard” card), or directly:

Already running the TATER agent on the machine? You don’t need a separate download — just run tater-agent.exe -setup.

On launch the wizard starts a small local web server on 127.0.0.1 and opens your browser to it. (Headless box? It prints the URL; open it from any browser that can reach that machine, or set TATER_SETUP_NO_BROWSER=1.)

1. Connect

Paste an organization API key (generate one in TATER Manage → Connections → API Keys). The wizard validates it by loading the Setup Catalog for your org. The API base defaults to https://api.tatersecurity.com/api.

2. Pick a feature

The catalog shows every configurable feature as a card with its estimated time and which logins it needs. Click one to open its form. Available features:

  • M365 Cloud Compliance Scanning — the full per-client scanning stack: an Entra app registration with the Graph + Exchange permissions, a sign-in certificate in Key Vault, an Azure Automation Account running the scan runbooks, and a webhook wired back to your org. Automates the entire 10-step provisioning checklist.
  • Endpoint Agent Deployment — generates an org-bound agent API key and the install command/package (MSI / Intune / install.sh).
  • Email-to-Ticket Intake — a shared mailbox, the Graph subscription, and the RBAC-for-Applications grant that turn email into Ops tickets.
  • SIEM Forwarding & Integrations — syslog (CEF) or HMAC-signed webhook forwarding, with a test-connection step.
  • Automated Remediation — the Run-Remediation runbooks + webhook so the Remediate button and MCP can dispatch fixes.
  • Power Automate Flow Monitoring — an app-only management app + saved connection so TATER watches your cloud flows.
  • Documentation Import — bulk-imports a folder of docs into Configuration Documentation.
  • M365 Authentication & User Lookup — read-only tenant credentials for the People picker, assignment search, and vendor discovery.

3. Fill the variables

Each feature has a typed form — tenant IDs, resource names, regions, mailbox addresses. Most fields come pre-filled with sensible defaults (auto-generated resource names, the TATER Security subscription, etc.); edit them if you have a naming standard. Fields marked “secret” (like a pasted client secret) stay on your machine and are never written back to TATER.

4. Run

Click Run setup. For each step the wizard:

  1. downloads the script and verifies its SHA-256;
  2. performs the login it needs — a device-code prompt appears in the live log; open the URL shown and enter the code (you complete the actual sign-in in your IdP);
  3. runs the script with your variables, streaming output live;
  4. posts only the non-secret results back to TATER.
Hybrid auth: device-code by default, paste as fallback

By default the wizard drives interactive device-code logins, so you never paste a long-lived secret. If interactive login is blocked (a locked-down jump box, CI), some features accept a pre-created client secret in the form instead.

Prerequisites

Run the wizard on a machine with the tooling each feature needs:

  • PowerShell 7+ (recommended) and the Microsoft Graph / Exchange Online / Az PowerShell modules for the scanning + email + identity features.
  • Azure CLI (az) for the features that create Azure resources (Automation Account, certificate, webhooks).
  • The appropriate admin roles in the target tenant (Global Administrator or Application + Privileged Role Administrator for app registrations; Exchange Administrator for email intake; Contributor on the subscription for the Automation Account).

Security model

The wizard never asks TATER for anything sensitive and never sends anything sensitive back. The result write-back is double-gated: a feature can only set the org fields it declares, and each of those must be on the server’s allow-list (scan + remediation resource names and webhook URLs). Every wizard step is recorded in your Activity Log under the setup-wizard channel. Scripts are downloaded over HTTPS from www.tatersecurity.com/Setup/ and SHA-256-verified before they run.