TATER TATER Insights - Centralized Reporting
The reporting app of the six-app TATER suite. Centralized reporting for compliance, service desk, HR, vendor, audit, and licensing - with group-based access control. Last updated 2026-07-14 · 54 built-in reports
What is TATER Insights?
TATER Insights consolidates the platform's deep, filterable, exportable reports into a single app. Quick at-a-glance dashboards remain in their natural homes (TATER Security overview, TATER Ops live board, TATER Manage fleet view, My TATER personal dashboard) - those are where you already look first thing in the morning. Insights is where you go when you need to answer a question that requires filtering, slicing, comparing, or downloading.
It lives at insights.tatersecurity.com, uses the same Microsoft Entra sign-in as every other TATER app, and is included with every subscription - no extra license needed.
How to get there
- From any TATER app sidebar: the bottom row of icons (5-app switcher) - click the bar-chart icon.
- From login: visit insights.tatersecurity.com directly; you'll be prompted to sign in if you aren't already.
- From My TATER: profile menu → Open TATER Insights (when configured).
Built-in reports
54 built-in reports across six categories - Compliance, Service Desk, HR, Vendor, Audit, and Platform. The catalog is API-driven, so new reports appear automatically the moment they ship; the complete list below is generated from the live report definitions. Each report gates on role tier and, where noted, group membership (see Group-based access control). Access-restricted reports show a 🔒 lock pill with the reason until an admin grants the required role or group.
Compliance (15)
| Report | What it answers |
|---|---|
| Compliance Posture | Latest scan pass rate overall and per framework, top failing controls, 60-day override-expiry watchlist. |
| Control Evidence Freshness | Every control bucketed by evidence age - Fresh / Aging / Stale / No Evidence - plus expiring risk-acceptances. |
| Control Gap Remediation | Failing-control remediation coverage: what's in flight, what's unaddressed. |
| Review & Attestation Status | Control review and attestation completion across the framework set. |
| Risk Register Summary | Risks by impact level and status; oldest open risks without a treatment plan. |
| Document Review Completion | Per posted document: assigned vs. signed, completion %, outstanding reviewers, overdue flags. |
| BCP / DR Readiness | Business-continuity / disaster-recovery plan coverage and test recency. |
| SOC 2 Readiness (Trust Services Criteria) | Readiness across the five Trust Services Criteria for a SOC 2 engagement. |
| AI Governance Posture | AI systems inventory by EU AI Act risk tier and review status. |
| Data Classification Inventory | Classified data assets by sensitivity label and owner. |
| Governance Meeting Compliance | Governance / committee meeting cadence and documentation completeness. |
| Endpoint Hardening Drift | Drift from the endpoint hardening baseline across the fleet. |
| OneDrive Health (Fleet) | OneDrive Known Folder Move and sync health across devices. |
| Application Monitoring Findings | Trend of application / monitoring findings over the period. |
| BitLocker / FileVault Escrow Coverage | Disk-encryption key escrow coverage - which devices have recovery keys escrowed. |
Service Desk (13)
| Report | What it answers |
|---|---|
| Service Desk Performance | Volume per category, mean time to resolution, SLA compliance %; period-selectable. |
| Helpdesk Drilldown | Per-ticket detail (title, status, priority, assignee, requester, dates) filtered to your categories. |
| Ticket Triage & Routing | Triage and routing accuracy - where tickets land and how often they're re-routed. |
| Major Incidents & MTTR | Major incidents declared and mean time to resolve. |
| Change & Release Throughput | Change requests and releases moving through the pipeline. |
| Service Catalog Demand | Demand per service-catalog item. |
| Self-Service Deflection | Share of requests resolved via self-service instead of an agent. |
| Survey Responses & CSAT | Response rate and headline score / NPS / CSAT per survey and on ticket close. |
| KB Match Relevance Feedback | Knowledge-base suggestion relevance from the feedback loop. |
| Information Requests (RFI) | RFI intake and completion status. |
| Reimbursements & Expenses (Service Desk) | Expense-request volume, approval, and payment from the service-desk angle. |
| License Rental Activity | Time-boxed Microsoft license rentals (Visio, Project…): active, pending, expiring, cost. |
| Meeting Documentation Coverage | Meetings flagged for documentation vs. actually documented. |
Platform (9)
| Report | What it answers |
|---|---|
| Device Vulnerability Posture | Device CVE exposure, KEV-linked findings, severity breakdown across the fleet. |
| Patch Compliance | Patch state across devices - how current the fleet is. |
| Patch Deployment Status | Software-update deployment progress by ring / device. |
| Network Speed Tests | Per-device download / upload throughput and latency from the endpoint agent, newest reading per device, with a slowest-devices watchlist. |
| Remediation Throughput | Remediation jobs triggered vs. succeeded over time. |
| CMDB Inventory | Configuration items by type and criticality; the critical-CI watchlist. |
| Power Platform Inventory | Documented Power Apps / Power Automate assets. |
| Project Portfolio | Active projects, milestones, and workload. |
| Subscription & Licensing | Per-org seats, MRR, license cap, renewal date. SuperAdmin only. |
Audit (11)
| Report | What it answers |
|---|---|
| Activity Log Trends | Audit-log volume by channel (via), top actions, top users - "show me everything an AI agent did last month." |
| Acknowledgement Signature Log | Flat evidence log of every document sign-off - who, what, when, IP, attestation snapshot. |
| Approval Activity & Bottlenecks | Universal-approval requests, decision latency, and where approvals stall. |
| Access Review (UAR) | User access review campaigns: completion and revocations. |
| POA&M Status | Plan of Action & Milestones: open items, due dates, overdue flags. |
| Audit Engagement Coverage | Audit engagements, scope coverage, and status. |
| Questionnaire Gap Analysis | Security-questionnaire responses vs. unanswered gaps. |
| Independence - Attestation Completion & Conflicts | Auditor independence attestations and flagged conflicts. |
| Travel Exemption Activity | Travel-policy exemptions requested and approved. |
| NHI Inventory Hygiene | Non-human-identity inventory: stale, over-privileged, or unrotated secrets. |
| JIT Admin Elevation Grants | Just-in-time admin elevations granted, duration, and approver. |
HR (3)
| Report | What it answers |
|---|---|
| Training Compliance | Campaign-by-campaign completion rates, overdue trainees, recent completions. |
| Personnel Onboarding / Offboarding | Joiner / leaver activity and the linked provision, access-review, and vault follow-up tasks. |
| Reimbursements & Expenses | Per-employee submitted / pending / paid plus company-card spend, period totals, top spenders. |
Vendor (3)
| Report | What it answers |
|---|---|
| Vendor & Contract Summary | Vendor count by risk rating and category; contracts expiring in the next 90 days. |
| Vendor Contracts & Renewals | Contract expirations and the renewal pipeline. |
| Vendor External Posture | External security-posture scores for your vendors. |
Report details (selected)
Deeper notes on the most frequently used reports:
Compliance Posture
Category: Compliance · Access: Open to any authenticated user in the org
The latest scan per scan type (M365 Cloud, Endpoint, etc.) is summarized into overall pass rate, framework-by-framework pass rate, top 25 failing controls, and a 60-day override-expiry watchlist. If you have risk acceptances that lapse soon, the report shows a yellow banner at the top.
Control Evidence Freshness
Category: Compliance · Access: Open to any authenticated user in the org
How current each control's evidence is. Every catalog control is bucketed by the age of its most recent evidence - the newest scan that evaluated it or the date a risk-acceptance / manual-verification was recorded: Fresh (under 90 days), Aging (90-180 days), Stale (over 180 days), or No Evidence. Risk-acceptances and manual-verifications that are expiring within 30 days or already expired are flagged separately. The data table is the "re-evidence before your next audit" worklist, and a freshness-distribution donut sits on top. An AI agent can pull the same data with the list_evidence_freshness MCP tool and chain it into verify_manual_control, trigger_remediation, or create_risk_acceptance to close the gaps.
Risk Register Summary
Category: Compliance · Access: Auditor+ role, OR membership in risk-viewer / compliance-viewer group
All risks counted by impact level (Critical / High / Medium / Low) and by status (Open / Mitigated / Accepted / Transferred / Avoided). The data table shows the top 30 open risks sorted by age - useful for "what's been sitting around without a treatment plan?".
Document Review Completion
Category: Compliance · Access: Auditor+ role, OR membership in compliance-viewer / hr-viewer group
Per posted document (employee manuals, HR policies, SOPs): assigned vs. signed, completion %, document count, and the list of outstanding reviewers. Items past their expiry with signatures still outstanding are flagged OVERDUE, and a completion-% bar chart sits on top. See the Document Reviews guide.
Service Desk Performance
Category: Service Desk · Access: any authenticated user; rows filtered by your group's Ops categories
Volume per category, mean time to resolution (MTTR), SLA compliance percentage. Defaults to the last 30 days; period selector lets you adjust 7 / 14 / 30 / 60 / 90 / 180 / 365. If you're in the service-desk-hr group, you'll see HR / Onboarding / Off-boarding tickets only. If you're in service-desk-ap, you'll see AP / Finance tickets. Admins (Admin / OrgAdmin / SuperAdmin) see everything.
Helpdesk Drilldown
Category: Service Desk · Access: any authenticated user; rows filtered by your group's Ops categories
Per-ticket detail - title, status, priority, assigned, requester, opened/closed dates - filtered to your accessible categories. Useful for an end-of-week roll-up. Defaults to a 14-day window.
Survey Responses & CSAT
Category: Service Desk · Access: Auditor+ role
Per survey: responses collected, response rate vs. assigned staff, and the headline score - average rating or computed NPS - for surveys that include a rating / NPS question. Covers both surveys assigned to staff and CSAT collected automatically when tickets close, with a responses-by-survey bar chart on top. See the Surveys guide for building and distributing surveys.
Training Compliance
Category: HR · Access: Auditor+ role, OR membership in hr-team / training-admin / compliance-viewer group
Campaign-by-campaign completion rates, overdue trainees, recent completions. KPI tiles show campaign count, fully-complete count, and overdue count.
Personnel Onboarding / Offboarding
Category: HR · Access: Auditor+ role, OR membership in hr-team / service-desk-hr group
Joiner/leaver activity over the period: onboard vs. offboard counts, in-progress vs. complete, and per-event the linked provision/deprovision workflow, access review, and vault recover/purge task. Surfaces offboardings that still have follow-ups open. Driven by the trigger_onboarding / trigger_offboarding actions (UI or MCP), which fan a single join/leave event out across People, TATER Ops workflows, Access Reviews, and Vault.
Vendor & Contract Summary
Category: Vendor · Access: Auditor+ role, OR membership in vendor-viewer / compliance-viewer group
Vendor count by risk rating and by category. The data table is contracts expiring in the next 90 days, sorted by date - useful for "what do we need to renew or renegotiate this quarter?".
Activity Log Trends
Category: Audit · Access: Auditor+ role
Volume of audit log entries broken down by channel (via field - web / copilot / claude / mcp / agent / api / ado-webhook / cron / insights). Top actions and top users for the selected period. Defaults to 30 days. Useful for compliance audits asking "show me everything an AI agent did in October."
Acknowledgement Signature Log
Category: Audit · Access: Auditor+ role, OR membership in audit-viewer / compliance-viewer group
A flat audit-evidence log of every document sign-off - who, what, when, from where (IP), and a snapshot of the attestation text as it stood at signing - exportable for auditors. Period-selectable (default 90 days). Pairs with the Document Reviews module.
Subscription & Licensing
Category: Platform · Access: SuperAdmin only
Per-org seat usage, MRR, license cap, over-limit flag, billing type, renewal date. Used by TATER Security operations team to track licensing across all client tenants.
Group-based access control
Two layers of gating apply to every report:
- Role tier -
Viewer(the default for any authenticated user in the org),Auditor+(for compliance-sensitive reports),Admin+(Admin / OrgAdmin / SuperAdmin), orSuperAdmin-only. - Group membership - for reports with
requiredGroupsset, the user must be in one of those groups (OR be Admin+). Groups are a flexible string array on eachOrgMembershiprecord.
If a user can't run a report, the catalog card shows a 🔒 lock pill and the reason ("Requires Auditor+ role", "Requires group membership (hr-team or compliance-viewer)") - so they know what to ask their admin for.
9 seeded groups
On first access to the Insights Groups page (or by clicking + Seed defaults), TATER creates these standard groups for your org:
| Group key | Display name | Grants access to |
|---|---|---|
service-desk-it | Service Desk - IT | Service Desk reports filtered to IT / Hardware / Software / Network / Endpoint / Workstation categories |
service-desk-hr | Service Desk - HR | Service Desk + Training Compliance, filtered to HR / Onboarding / Off-boarding / Personnel / Access Request |
service-desk-ap | Service Desk - Accounts Payable | Service Desk filtered to AP / Accounts Payable / Finance / Invoicing / Vendor Payment |
service-desk-ar | Service Desk - Accounts Receivable | Service Desk filtered to AR / Accounts Receivable / Billing / Collections |
vendor-viewer | Vendor Management Viewer | Vendor & Contract Summary report |
risk-viewer | Risk Register Viewer | Risk Register reports |
training-admin | Training Admin | Training Compliance report |
compliance-viewer | Compliance Viewer | Compliance Posture, Risk, Training, Vendor reports |
all-reports | All Reports (administrator) | Every non-SuperAdmin report - use sparingly |
Custom groups
Click + New group in Insights Groups to define a custom one. Pick a key (lowercase, letters / digits / hyphens / underscores), a display name, and optionally:
- Ops task categories - list (one per line) of category names from your TATER Ops setup. Users in this group will see Service Desk rows only for these categories.
- Reports - check the boxes for the reports this group should unlock.
- Grants access to all reports - escape hatch for power users. Avoid unless you really mean it.
Assigning users to groups
Groups are stored as a string array on each user's OrgMembership record. To assign someone:
- Go to TATER Manage → Users.
- Pick the user, click Edit.
- In the
groupsfield, enter the group keys (comma-separated): e.g.service-desk-it, vendor-viewer. - Save. The user's access updates on their next sign-in (or within 5 minutes when their membership cache expires).
Exports
Every report has a ⬇ CSV button in the top-right of the report viewer. The download includes whatever columns the report defines. Every report also exports to XLSX and branded PDF, and recurring email delivery is configured under Scheduled Reports.
For BI tools, TATER also exposes the data via the existing Power BI dataset endpoint (GET /api/reports/powerbi) - see API Reference.
Why a separate app instead of more dashboard pages?
Because they serve different jobs.
- Dashboards (overview pages in each app) = quick glance at "is everything OK right now?". They're at the top of the app, they load fast, they prioritize a small number of high-signal tiles. They're tuned for the muscle memory of "open the app, see the state".
- Reports (Insights) = "I need to answer a specific question." Period selection, filters, sorting, drill-down, export. Reports take time to interpret and you don't want them cluttering your at-a-glance view.
Putting both in the same app makes the dashboards heavier and the reports buried. Separating them - and putting cross-app reports in their own home - keeps both surfaces focused.
v2 (shipped 2026-06-05)
- Scheduled email delivery - daily / weekly / monthly / quarterly, recipient list, branded HTML emails via Graph (system email config) with SMTP fallback. Configure in Insights → Scheduled Reports.
- XLSX export - client-side via SheetJS. Two sheets: Report data + Metadata. Works on every report.
- Line trend chart on Compliance Posture - daily pass-rate trend over 30 days.
v2.1 (shipped 2026-06-05) - Custom + PDF + Cross-org
Branded PDF export (Phase C)
Every report viewer now has a primary ⬇ PDF button. The server-side PDF (rendered via pdfkit) is an executive-style layout with your org's logo + accent color in the header, KPI tiles, top chart summaries, the data table (capped at 200 rows - CSV/XLSX for unbounded data), and a footer with page numbers + generated-by-whom. The same PDF format will be attached to scheduled email reports when an admin opts in (v2.2 follow-up).
Custom report builder (Phase A)
Auditor+ users can build their own reports. Insights → Custom Reports → + New custom report:
- Pick a data source - Ops Tasks, Risks, Risk Acceptances, Audits, Vendors, Activity Log, Monitoring Findings, Change Requests, or Exceptions / Waivers. Each source has a locked field schema with type metadata (text / number / date / status).
- Pick your columns - checkbox grid of the source's fields.
- Add filters - field + operator (=, !=, contains, starts-with, >, <, >=, <=, in, is-set, is-not-set) + value. Status / enum fields get a select with the locked option list; text fields get a free-form input. Multiple filters combined with AND.
- Set a period field + days to limit results to the last N days against any date column on the source.
- Set sort + direction + row limit (max 5000).
- Name + describe + pick an icon. Share with whole organization (Admin+ only) makes the report visible to everyone in your org; otherwise it's personal-only.
- Save → opens in the report viewer with the same KPI tiles / table / CSV / XLSX / PDF export as built-ins.
Security: field names come from the source's allowlist (no SQL injection vector - all filter values flow through Cosmos parameters). Per-source role gates re-check at run-time. Personal reports are visible only to their owner (or SuperAdmin). Shared reports require Admin+ to publish.
Cross-org roll-up (Phase B)
If you're in an MSP org (org.isMsp=true) or you're a SuperAdmin, the report viewer shows a Scope chip selector at the top. Pick which orgs to include - your own, your linked client orgs (for MSP), or any org in the tenant (for SuperAdmin). When 2+ orgs are selected, the report runs once per org and merges results with an Organization column prepended.
Works for both built-in and custom reports. CSV + PDF exports include the scope in the filename. Numeric summary KPIs (counts, sums) aggregate across orgs; non-numeric show (multiple) when they diverge.
Coming next
- Scheduled emails attach PDFs - opt-in flag per schedule. Email body shows KPI summary; PDF attachment has the full executive layout.
- More chart types - line trends over time, stacked bars, heat maps for additional reports.
- Custom report drilldown - click a row in a custom report to open the underlying record in TATER Security / Ops / Manage.