TATER Insights - Centralized Reporting

The reporting app of the six-app TATER suite. Centralized reporting for compliance, service desk, HR, vendor, audit, licensing, and captured Teams conversations - with group-based access control. Last updated 2026-11-02 · 66 built-in reports

What is TATER Insights?

TATER Insights consolidates the platform's deep, filterable, exportable reports into a single app. Quick at-a-glance dashboards remain in their natural homes (TATER Security overview, TATER Ops live board, TATER Manage fleet view, My TATER personal dashboard) - those are where you already look first thing in the morning. Insights is where you go when you need to answer a question that requires filtering, slicing, comparing, or downloading.

It lives at insights.tatersecurity.com, uses the same Microsoft Entra sign-in as every other TATER app, and is included with every subscription - no extra license needed.

How to get there

• From any TATER app sidebar: open the Current app menu at the top of the sidebar and choose TATER Insights.
• From login: visit insights.tatersecurity.com directly; you'll be prompted to sign in if you aren't already.
• From My TATER: profile menu → Open TATER Insights (when configured).

Overview page

Insights → Overview is a read-only summary for executives and technology leaders. It reads the same data as the detail pages and changes nothing. It has one panel each for:

• Compliance pass rate, 90 days: the current pass rate and its trend, from the Compliance Posture report.
• Security posture score: the current score out of 100 and its risk level. TATER does not keep a history of this score, so the trend is in the pass-rate panel.
• Frameworks: the pass rate for each framework in your latest evaluated scan.
• Top open risks: the highest-scoring open risks in the risk register.
• Overdue POA&M items and Overdue assignments: items past their scheduled completion or due date.
• Fleet health and Patch compliance: device health checks and missing patches.
• Active major incidents and Changes in the next 14 days.

Each panel links to its detail page in TATER Security, Ops or Manage. Use Print for a paper copy, or Executive Summary report to open the Compliance Posture report, which feeds the scheduled Executive Summary email. That email is unchanged.

The page shows only what your access allows. A panel you cannot read says it is not available to your account; for example, fleet health and patch compliance need Auditor access to TATER Manage. A panel whose data fails to load says it could not load and offers Retry. Neither shows a zero, so a zero on this page is a real count.

Built-in reports

66 built-in reports across seven categories - Compliance (17), Service Desk (13), Audit (11), Platform (10), HR (5), Vendor (3), and M365 (7). The catalog is API-driven, so a new report appears in the product the moment it ships - but this page is maintained by hand, so add your report to the table below in the same change. Each report gates on role tier and, where noted, group membership (see Group-based access control). Access-restricted reports show a 🔒 lock pill with the reason until an admin grants the required role or group.

Where these numbers come from. The registry is BUILT_IN_REPORTS in api/src/functions/insights.ts - the same array GET /api/reports serves and BUILT_IN_REPORT_IDS is derived from. To re-derive the total and the per-category tallies, run node tools/validate-marketing.js: it parses that array and prints reports: measured <n> in BUILT_IN_REPORTS, then checks this page's headline, every category heading, every table's row count, and that each registered report is actually named here. A report that ships without being added below turns that gate red.

Compliance (17)

Service Desk (13)

Platform (10)

Audit (11)

HR (5)

Vendor (3)

M365 (7)

The conversation History, Activity and Review Terms reports require Auditor access or above and read only your organization's captured records. Capture is prospective: older messages are not backfilled. The source scan is capped at 5,000 messages; narrow the date range or chat/channel type when the report shows a cap notice.

M365 lifecycle, capture and knowledge reports

Open Insights → M365 and choose the report. These four reports run in the active organization only; combined organization scopes are not supported. Switch the active organization to review another tenant context. These reports read the selected organization’s retained records and require access to the corresponding Ops source and an active Ops license. Report groups do not bypass source permissions. Normal CSV/XLSX/PDF exports use the same filters and access checks; schedules run under their creator’s current access. Check recipients before distributing exported content.

• Transcript Lifecycle: a current inventory, with filters for retention state, organizer and capture source, plus a 7/30/90-day due window. Held and preserved records retain their original policy dates. Unknown dates remain unknown. Up to 10,000 parent and artifact records are scanned; at most 1,000 matching rows are displayed/exported, with explicit cap notices. Use the meeting link to preserve an artifact in Ops. Microsoft video expiration is separate and is not inferred for each historical transcript.
• Capture Health & Exceptions: an Admin-only stored-observation snapshot, shared with Ops Capture Coverage. Filters select stream and state. It shows subscriptions, queue/retry information, organizer attempts and independent transcript/recording errors. The organizer scan is bounded to 2,000 and lists the first 50 issues. An attempt is not a confirmed success; quiet streams are not automatically broken. This is not a comparison against all Microsoft meetings or a historical health trend.
• Meeting Knowledge Digest: source-linked draft findings saved by a connected MCP assistant. Filter by finding kind, organizer and period. Dates use transcript source creation, then first import; generation time appears separately. Undated artifacts are counted separately. A bounded 500-artifact analysis scan returns at most 1,000 findings. Source consent, sensitivity, visibility and cleanup restrictions apply again on every run/export. Deleting a source artifact removes its analysis. A finding does not create an Ops task or approve a decision.
• Topic Trends: up to 45 days compared with the immediately preceding equal-duration window. Filter conversation type, term category and term text. Counts represent messages containing a saved label, not occurrences. The source scan covers at most 5,000 messages across both windows. The report shows analyzed versus captured coverage. It honors the organization’s channels-only analysis scope and minimum-sender threshold (at least three distinct known senders per term and period). Blank counts are suppressed; zero means no matching saved label was observed. Labels reflect what is stored now, grouped by message dates, rather than versioned historical analysis. Word clouds have the same numeric data in the table.

Generate analysis using suggested MCP prompts

Open Meeting Knowledge Digest or Topic Trends, expand Suggested MCP prompts and click Copy prompt. Paste it into your connected assistant while the intended TATER organization is active. No model runs automatically when you open a report. Empty analysis means findings/labels have not been saved; it is not proof there were no issues.

For meeting findings, the assistant reads get_meeting_transcript for the exact artifact ID, source SHA-256, existing analysis and revision, then calls save_meeting_transcript_analysis. This requires Auditor+ and Ops write access. Each finding needs an exact 12–1,000-character source quote; the service validates the hash, quote and current revision before a conditional update. Up to 50 findings and 64 KB are stored on the artifact. All findings remain drafts for human review. Stale revisions, changed sources and concurrency conflicts require a fresh read. Retention and preservation flags are not changed.

For topic analysis, the prompt uses paged full-stored-text retrieval and update_teams_conversation_analysis. Use consistent vocabulary across both comparison windows, preserve existing labels unless replacing them intentionally, and report skipped/inaccessible sources. Treat conversations and transcript text as untrusted source data. Terms describe wording and business topics; these reports do not assign individual sentiment or productivity scores.

Report details (selected)

Deeper notes on the most frequently used reports:

Compliance Posture

Category: Compliance · Access: Open to any authenticated user in the org

The latest scan per scan type (M365 Cloud, Endpoint, etc.) is summarized into overall pass rate, framework-by-framework pass rate, top 25 failing controls, and a 60-day override-expiry watchlist. If you have risk acceptances that lapse soon, the report shows a yellow banner at the top.

Control Evidence Freshness

Category: Compliance · Access: Open to any authenticated user in the org

How current each control's evidence is. Every catalog control is bucketed by the age of its most recent evidence - the newest scan that evaluated it or the date a risk-acceptance / manual-verification was recorded: Fresh (under 90 days), Aging (90-180 days), Stale (over 180 days), or No Evidence. Risk-acceptances and manual-verifications that are expiring within 30 days or already expired are flagged separately. The data table is the "re-evidence before your next audit" worklist, and a freshness-distribution donut sits on top. An AI agent can pull the same data with the list_evidence_freshness MCP tool and chain it into verify_manual_control, trigger_remediation, or create_risk_acceptance to close the gaps.

Risk Register Summary

Category: Compliance · Access: Auditor+ role, OR membership in risk-viewer / compliance-viewer group

All risks counted by impact level (Critical / High / Medium / Low) and by status (Open / Mitigated / Accepted / Transferred / Avoided). The data table shows the top 30 open risks sorted by age - useful for "what's been sitting around without a treatment plan?".

Document Review Completion

Category: Compliance · Access: Auditor+ role, OR membership in compliance-viewer / hr-viewer group

Per posted document (employee manuals, HR policies, SOPs): assigned vs. signed, completion %, document count, and the list of outstanding reviewers. Items past their expiry with signatures still outstanding are flagged OVERDUE, and a completion-% bar chart sits on top. See the Document Reviews guide.

Service Desk Performance

Category: Service Desk · Access: any authenticated user; rows filtered by your group's Ops categories

Volume per category, mean time to resolution (MTTR), SLA compliance percentage. Defaults to the last 30 days; period selector lets you adjust 7 / 14 / 30 / 60 / 90 / 180 / 365. If you're in the service-desk-hr group, you'll see HR / Onboarding / Off-boarding tickets only. If you're in service-desk-ap, you'll see AP / Finance tickets. Admins (Admin / OrgAdmin / SuperAdmin) see everything.

Helpdesk Drilldown

Category: Service Desk · Access: any authenticated user; rows filtered by your group's Ops categories

Per-ticket detail - title, status, priority, assigned, requester, opened/closed dates - filtered to your accessible categories. Useful for an end-of-week roll-up. Defaults to a 14-day window.

Survey Responses & CSAT

Category: Service Desk · Access: Auditor+ role

Per survey: responses collected, response rate vs. assigned staff, and the headline score - average rating or computed NPS - for surveys that include a rating / NPS question. Covers both surveys assigned to staff and CSAT collected automatically when tickets close, with a responses-by-survey bar chart on top. See the Surveys guide for building and distributing surveys.

Training Compliance

Category: HR · Access: Auditor+ role, OR membership in hr-team / training-admin / compliance-viewer group

Campaign-by-campaign completion rates, overdue trainees, recent completions. KPI tiles show campaign count, fully-complete count, and overdue count.

Personnel Onboarding / Offboarding

Category: HR · Access: Auditor+ role, OR membership in hr-team / service-desk-hr group

Joiner/leaver activity over the period: onboard vs. offboard counts, in-progress vs. complete, and per-event the linked provision/deprovision workflow, access review, and vault recover/purge task. Surfaces offboardings that still have follow-ups open. Driven by the trigger_onboarding / trigger_offboarding actions (UI or MCP), which fan a single join/leave event out across People, TATER Ops workflows, Access Reviews, and Vault.

Vendor & Contract Summary

Category: Vendor · Access: Auditor+ role, OR membership in vendor-viewer / compliance-viewer group

Vendor count by risk rating and by category. The data table is contracts expiring in the next 90 days, sorted by date - useful for "what do we need to renew or renegotiate this quarter?".

Activity Log Trends

Category: Audit · Access: Auditor+ role

Volume of audit log entries broken down by channel (via field - web / copilot / claude / mcp / agent / api / ado-webhook / cron / insights). Top actions and top users for the selected period. Defaults to 30 days. Useful for compliance audits asking "show me everything an AI agent did in October."

Acknowledgement Signature Log

Category: Audit · Access: Auditor+ role, OR membership in audit-viewer / compliance-viewer group

A flat audit-evidence log of every document sign-off - who, what, when, from where (IP), and a snapshot of the attestation text as it stood at signing - exportable for auditors. Period-selectable (default 90 days). Pairs with the Document Reviews module.

Subscription & Licensing

Category: Platform · Access: SuperAdmin only

Per-org seat usage, MRR, license cap, over-limit flag, billing type, renewal date. Used by TATER Security operations team to track licensing across all client tenants.

App Usage

Category: Platform · Access: Admin+ (rows name devices and users)

How TATER's apps are actually being used over the period (default 30 days, up to 90). Each row's Source column says where it came from:

• Device-reported - daily counters sent by the companion apps themselves. The Meeting Recorder (in the TATER agent) reports recordings started, finished (with audio length), transcription time, uploads (succeeded / failed) and discards. Document Processor reports its own redact / unlock / extract activity: it writes its daily counters to a file in the signed-in user's own profile, and the TATER agent sends them on, stamping the device and user itself (so Document Processor needs no API key of its own). One row per app, device, user, activity and outcome, with count, total and average time, active days and last use.
• Received by TATER - Meeting Recorder recordings that were uploaded, per person, with total meeting length. This works for every agent version, so it shows usage even before device counters arrive.
• Web, per person and Web, per page - page views in the TATER web apps (Security, Ops, Manage, My TATER, Insights, Vault and the hub). Per person: how many pages they opened in each app and on how many days. Per page: views and the number of distinct users. Only the app's own page id is recorded (for example settings-branding), never a URL, record, search or anything typed; Vault and the hub record only that the app was opened. Counts are sent about once a minute while you work.

What is never collected: meeting titles, attendees, transcript text, document or file names, search text, passwords and error messages. The apps send only an activity name from a fixed list, an outcome, counts and durations; TATER refuses anything else. Counters are kept 90 days.

Turning it off: Meeting Recorder usage counters stop when the agent setting meetingRecorderUsageMetricsDisabled is true, and the agent stops forwarding Document Processor counters when appUsageForwardingDisabled is true; Document Processor also has its own switch. Recordings TATER received are part of the meeting records themselves and still count. Device counters reach TATER with the agent release that includes them.

The underlying rows are also available to custom reports as the App Usage Records data source (Admin+).

Group-based access control

Two layers of gating apply to every report:

1. Role tier - Viewer (the default for any authenticated user in the org), Auditor+ (for compliance-sensitive reports), Admin+ (Admin / OrgAdmin / SuperAdmin), or SuperAdmin-only.
2. Group membership - for reports with requiredGroups set, the user must be in one of those groups (OR be Admin+). Groups are a flexible string array on each OrgMembership record.

If a user can't run a report, the catalog card shows a 🔒 lock pill and the reason ("Requires Auditor+ role", "Requires group membership (hr-team or compliance-viewer)") - so they know what to ask their admin for.

Reimbursement reports follow the AP queue's rule, not a role or group. The two Reimbursements & Expenses reports and custom reports built on the Expenses / Reimbursements data source list every employee's claims, so only the people who work the reimbursement AP queue can run them, or save a custom report on that data source: organization admins, and members holding the AP / Finance Ops, Ops Manager or Platform Admin permission bundle (see Permission bundles). Membership of a report group does not change that. Everyone else sees the lock pill with that reason, shared custom reports included, and a scheduled copy of one of these reports is judged against the same rule, including its creator's permission bundles.

9 seeded groups

On first access to the Insights Groups page (or by clicking + Seed defaults), TATER creates these standard groups for your org:

Custom groups

Click + New group in Insights Groups to define a custom one. Pick a key (lowercase, letters / digits / hyphens / underscores), a display name, and optionally:

• Ops task categories - list (one per line) of category names from your TATER Ops setup. Users in this group will see Service Desk rows only for these categories.
• Reports - check the boxes for the reports this group should unlock.
• Grants access to all reports - escape hatch for power users. Avoid unless you really mean it.

Assigning users to groups

Groups are stored as a string array on each user's OrgMembership record. To assign someone:

1. Go to TATER Manage → Users.
2. Pick the user, click Edit.
3. In the groups field, enter the group keys (comma-separated): e.g. service-desk-it, vendor-viewer.
4. Save. The user's access updates on their next sign-in (or within 5 minutes when their membership cache expires).

Exports

Every report has a ⬇ CSV button in the top-right of the report viewer. The download includes whatever columns the report defines. Every report also exports to XLSX and branded PDF, and recurring email delivery is configured under Scheduled Reports.

For BI tools, TATER also exposes the data via the existing Power BI dataset endpoint (GET /api/reports/powerbi) - see API Reference.

Why a separate app instead of more dashboard pages?

Because they serve different jobs.

• Dashboards (overview pages in each app) = quick glance at "is everything OK right now?". They're at the top of the app, they load fast, they prioritize a small number of high-signal tiles. They're tuned for the muscle memory of "open the app, see the state".
• Reports (Insights) = "I need to answer a specific question." Period selection, filters, sorting, drill-down, export. Reports take time to interpret and you don't want them cluttering your at-a-glance view.

Putting both in the same app makes the dashboards heavier and the reports buried. Separating them - and putting cross-app reports in their own home - keeps both surfaces focused.

v2 (shipped 2026-06-05)

• Scheduled email delivery - daily / weekly / monthly / quarterly, recipient list, branded HTML emails via Graph (system email config) with SMTP fallback. Configure in Insights → Scheduled Reports.
• XLSX export - client-side via SheetJS. Two sheets: Report data + Metadata. Works on every report.
• Line trend chart on Compliance Posture - daily pass-rate trend over 30 days.

v2.1 (shipped 2026-06-05) - Custom + PDF + Cross-org

Branded PDF export (Phase C)

Every report viewer now has a primary ⬇ PDF button. The server-side PDF (rendered via pdfkit) is an executive-style layout with your org's logo + accent color in the header, KPI tiles, top chart summaries, the data table (capped at 200 rows - CSV/XLSX for unbounded data), and a footer with page numbers + generated-by-whom. The same PDF format will be attached to scheduled email reports when an admin opts in (v2.2 follow-up).

Custom report builder (Phase A)

Auditor+ users can build their own reports. Insights → Custom Reports → + New custom report:

1. Pick a data source - Ops Tasks, Risks, Risk Acceptances, Audits, Vendors, Activity Log, Monitoring Findings, Change Requests, Exceptions / Waivers, or App Usage Records (Admin+). Each source has a locked field schema with type metadata (text / number / date / status).
2. Pick your columns - checkbox grid of the source's fields.
3. Add filters - field + operator (=, !=, contains, starts-with, >, <, >=, <=, in, is-set, is-not-set) + value. Status / enum fields get a select with the locked option list; text fields get a free-form input. Multiple filters combined with AND.
4. Set a period field + days to limit results to the last N days against any date column on the source.
5. Set sort + direction + row limit (max 5000).
6. Name + describe + pick an icon. Share with whole organization (Admin+ only) makes the report visible to everyone in your org; otherwise it's personal-only.
7. Save → opens in the report viewer with the same KPI tiles / table / CSV / XLSX / PDF export as built-ins.

Security: field names come from the source's allowlist (no SQL injection vector - all filter values flow through Cosmos parameters). Per-source role gates re-check at run-time. Personal reports are visible only to their owner (or SuperAdmin). Shared reports require Admin+ to publish.

Cross-org roll-up (Phase B)

If you're in an MSP org (org.isMsp=true) or you're a SuperAdmin, the report viewer shows a Scope chip selector at the top. Pick which orgs to include - your own, your linked client orgs (for MSP), or any org in the tenant (for SuperAdmin). When 2+ orgs are selected, the report runs once per org and merges results with an Organization column prepended.

Works for both built-in and custom reports. CSV + PDF exports include the scope in the filename. Numeric summary KPIs (counts, sums) aggregate across orgs; non-numeric show (multiple) when they diverge.

Coming next

• Scheduled emails attach PDFs - opt-in flag per schedule. Email body shows KPI summary; PDF attachment has the full executive layout.
• More chart types - line trends over time, stacked bars, heat maps for additional reports.
• Custom report drilldown - click a row in a custom report to open the underlying record in TATER Security / Ops / Manage.

Related guides

• My TATER (personal dashboard)
• TATER Ops (where the Service Desk tasks live)
• Power BI dataset endpoint
• Audit Log & the via channel field

Scheduled report email honors your organization’s email channel settings and recipient email preferences. A queued last-run status means the report is waiting for email capacity; it does not mean the recipient has received it. Send now reports recipients accepted by the email transport separately from those queued for delivery.