TATER Manage

Platform administration + endpoint fleet management. For organization admins, MSPs, and SuperAdmins - the sister app where you govern who can do what and operate the device fleet.

What it is

TATER Manage consolidates administration and adds operational fleet capabilities that don't fit cleanly into Security or Ops: user and access management, integrations and intake channels, remote operations on devices (live shell, process/service control, file push, Wake-on-LAN, remote control), patching, software deployment, and endpoint policy. The TATER acronym for this product expands as Tenant Administration, Telemetry & Endpoint Remote-control.

Manage is reachable at manage.tatersecurity.com. Sign in with the same Microsoft account used across the platform. Access is tiered at boot:

SuperAdmin - the full app, including the SA-only pages (Organizations, Users, Subscriptions, Usage Analytics, MCP Feedback, QA Checklist, Agent Versions, Azure DevOps, Meeting Bot).
MSP OrgAdmin - cross-client visibility (Clients, MSP Licensing) plus their own org's admin tools.
OrgAdmin - their own organization's admin tools.
Anyone else sees an access-denied card with a diagnostic block (signed-in account + orgs/roles returned) to paste into a bug report, plus links back to Security/Ops.

The left icon rail groups the app into eleven modules; each opens with a module dashboard plus its pages. Items marked SA are SuperAdmin-only; MSP items show for MSP admins and SuperAdmins.

Overview

Dashboard - admin KPIs and cross-module tiles.
Calendar - unified GRC timeline (audits, override expirations, BCP/DR test windows, training due dates) across all orgs.
TATER Tips - the bite-sized tips library covering every TATER capability; the shared login popup pulls a random tip each session.

Tenant Admin

Organizations (SA) - all orgs with role + tenant ID, org features (incl. auto-provisioning), lifecycle state.
Users (SA) - registered platform users, global roles, org memberships; cross-links to Access Control per member.
Access Control - assign granular permission bundles to scope members to specific modules (Ops, Security, Audit, …), and build custom bundles. A member with no bundles keeps their role's default access; SuperAdmins are always unrestricted.
Subscriptions (SA) - per-org billing, license limits, MRR.
Clients (MSP) - MSP partner client roster with tier, effective role, seat ratio, engagement status.
MSP Licensing (MSP) - seat allocation and tier access (T1 Monitor / T2 Operate / T3 Manage).

Audit & Telemetry

All Reports - the reporting index across the platform.
Activity Log - cross-product audit trail; filter by action, channel (via: web / mcp / copilot / claude / agent / cron / api / ado-webhook), free-text search.
Usage Analytics (SA) - period selector (7/30/90 days), KPIs, Top Pages, Top Orgs.
MCP Feedback (SA) - all MCP feedback submissions; sentiment-coloured cards with ADO link badges. See MCP Feedback.
MCP Tool Policies - control which AI/MCP tools are available: globally, by role, or by group, with a preview tab. See MCP Tool Policies.
Approvals - the org's approval requests and approval groups (the engine behind My Approvals). See Approvals.
QA Checklist (SA) - the platform QA state: the recurring release checklist with per-item pass/fail tracking.

Connections

Integration and authentication surfaces (approval/finance and content workflows moved to their own modules below):

Integrations - connector cards (ADO, Jira, ServiceNow, Teams, Slack, Webhook) with "Used by" tags; config deep-links. Saved credential fields (tokens, keys, passwords, secrets) are never shown again: leave one blank to keep it, and re-enter it whenever you change where the connector connects (see Connector credentials).
Older saved credential fields absent from the current form are preserved unless you select the unchecked removal choice. It lists the affected fields and applies when changed settings are saved with a newly entered credential. Switching organizations invalidates the open editor; reopen it before saving or testing.
Test connection - failed checks show the provider error and next steps. A not verified warning means no live test is available; save separately to keep configuration changes. Green results follow the API test metadata; Microsoft built-in configuration acknowledgements retain their existing behavior.
API Keys - the single canonical home for API key generation platform-wide. Per-org, SHA-256 hashed, shown once at creation, instant revoke.
SSO & SCIM - single sign-on and SCIM provisioning configuration. See SSO & SCIM.
Azure DevOps (SA) - TATER Ops ↔ ADO bi-directional sync; PAT and webhook secret encrypted at rest and never returned once saved, to any role; leave a field blank to keep it.
Meeting Bot (SA) - the meeting-bot integration configuration.
Task Notifications - fan-out alerts for new Ops tasks to staff email and a Teams channel (Power Automate Workflow webhook). See Task Notifications Setup.
Ops Event Webhooks - push Ops lifecycle events to your own endpoints. See Ops Event Webhooks.
Email-to-Ticket - mailbox intake that converts email into Ops tickets, with trusted-sender allowlisting. See Email Intake Setup.
File Storage - attachment storage configuration (where ticket/entity attachments live). See Attachment Storage.
Power Automate - flow-monitor configuration for catching disabled/suspended/failing cloud flows. See Power Automate Flow Monitor.

Approvals & Finance

License Rentals - configure rentable Microsoft licenses (Visio, Project, …) users request time-boxed from My TATER. See License Rentals.
Travel Exemptions - configure the travel-exemption workflow (CA exemption group, approval chain). See Travel Exemptions.

Content & Automation

Email Signatures - the org signature template users render from My TATER.
Branded Documents - generate polished, co-branded Word deliverables built from the org's actual configuration (categories, priorities, teams, catalog items). MCP agents produce the same via generate_branded_document.
Automations - org automation rules.
Power Platform Inventory - the GRC audit inventory of Power Platform assets. See Power Platform Inventory.

Service Management

Service Catalog (Admin) - design request types with form schemas, routing, approval flags, ETAs; seed the 13 starter items. See Service Catalog Administration.
Status Page Subscribers - who receives status-page notifications.

Knowledge

Policies / Documentation / TATERpedia - inline editing of the same records shared with TATER Security and Ops.

Devices

Devices - every TATER agent reporting in: platform, heartbeat status, agent version, identity/privilege, compliance, MDE risk. Each row carries the quick-action bar and opens the device detail drawer.
Agent Deployment - current version, download links for all platforms. See Agent Deployment.
Agent Versions (SA) - per-platform binary metadata with SHA256.
Multi-Screen - thumbnail grid of device screenshots (when capture is enabled in agent config); click to zoom.
BitLocker Keys - escrowed recovery keys with audited reveal.

Endpoint Health

Application Monitoring - OneDrive health, KEV exposure, and templated agent monitors as one findings surface. See Application Monitoring.
Vulnerabilities - fleet exposure summary with CISA KEV correlation; per-device known exposures + software inventory.
Patch Management - endpoint patch posture and deployments, with severity-based auto-approval policies. See Patch Policy Automation.
Software Deploy - package catalog + deployments to devices via the agent. See Endpoint Management (UEM).
Endpoint Policies - USB / app-allow / JIT-admin / power / browser / DNS policies applied through the agent.
Automated Remediations - admin-defined diagnose + fix scripts exposed to end users via the agent tray. See Self-Service Fixes.
Endpoint Profiles - named configuration profiles applied per device group.

Help

Release Notes - the consolidated change log for all sister apps + the agent (unified version history plus the full legacy history).
Feedback - in-app feedback submission.

Device quick actions

Every device row (and the detail drawer) carries a per-device action bar. All actions queue agent commands that are audit-logged and appear in the device's command history:

↻ Restart Agent - queue a service restart of the TATER agent itself.
▶ Run - queue an arbitrary PowerShell / bash script, as SYSTEM (default) or the logged-in user; live status modal captures stdout/stderr.
Shell - a live interactive shell session on the device.
⚙ Process/Service - kill a process, or restart / stop / start a service, by name. Runs as SYSTEM (Windows) or root; one-shot, audit-logged.
⇪ Push file - push a small file to a path on the device. The file is base64-encoded and queued as an agent command; cap 8 MB encoded (≈6 MB raw), written as SYSTEM/root.
⏻ Wake (offline devices only) - send a Wake-on-LAN magic packet to the device's MAC address, relayed by an online peer agent on the same LAN. The target must have WoL enabled in firmware/NIC settings; the relay command shows in the peer's history.
History - the device's full remote-command history with per-command output.
Remote - a WebRTC remote-support session with PE-3 end-user consent and AU-14 session recording. See Interactive Remote Control.
+ Ops ticket - create a TATER Ops ticket prefilled with the device's context and linked to the device.

General Health Checks

In Endpoint Health > General Health Checks, users with Auditor access can browse the latest stored health-check report per device in the selected organization. This is separate from the device drawer's agent diagnostics. Refresh reads existing reports; it does not run checks or dispatch fixes.

Checks run when someone requests them on the endpoint. Devices without a report are not included, and missing reports do not mean healthy devices. By default, reports older than 30 days or with invalid dates are excluded; the include-stale option shows those reports too. A partial-coverage notice means safety limits were reached, so the results may miss devices or newer reports.

The check table shows unique failing devices, their share of counted reported devices, and how many devices assessed that check. Open a check to see its complete returned device list, then select a device for up to 20 stored runs and check details. A widespread result suggests reviewing check criteria before remediation; it does not establish that the check is miscalibrated.

Device detail drawer

Clicking a device opens a right-side drawer aggregating its cross-cutting context in one place: overview (platform, heartbeat, agent version, last user, last boot, identity/privilege, compliance, MDE risk), TATER Tuning applied levels with drift triage, full diagnostics health-checks, patch posture, remote-command history, endpoint-profile applied state, vulnerabilities/KEV detail, and monitoring findings + linked Ops tasks - with the same quick-action bar on top.

Agent communication channels

The TATER Go agent runs as a system service and talks to the API over several surfaces - scans (compliance posture), evidence collection, commands (remote operations above), vulnerabilities (weekly software inventory for KEV correlation), and screens (periodic screenshot upload when enabled). All use the same X-Api-Key auth bound to a per-org API key configured at install. Agent API keys are org-bound - an agent for org A cannot read or mutate commands/screens/inventory belonging to org B even within the same tenant.

Creating an organization and retrying safely

In Organizations, select New Organization, enter its name and optional slug, and select Create. Your initial role is OrgAdmin. The organization becomes active only after that membership is saved.

If creation is not confirmed, keep the dialog open and retry with the same details. The dialog retains the original request identity and blocks duplicate submissions. Review the organization list before closing the dialog, reloading, or deliberately starting a different creation: those actions can start a new request. Changing account or organization stops a stale submission.

If an older open page asks for a creation key, review the organization list and reload TATER before creating again.

API callers must supply an idempotencyKey in the JSON body or an Idempotency-Key header (8–128 letters, digits, dots, colons, underscores or hyphens). Reuse the same key and creation details to recover an uncertain response. A confirmed new organization returns HTTP 201; a recovered receipt returns HTTP 200. A changed request under the same key returns HTTP 409. Missing or malformed keys return HTTP 400. Retries never overwrite an existing organization or restore a creator membership that was later changed or removed. A recovered response repeats the original creation snapshot; use the ordinary authorized organization reads for current settings.

Unconfirmed preparation is retained for recovery and audit attempts are recorded. Audit delivery remains best effort. Recovery applies to new keyed requests; it does not automatically repair organizations left incomplete by older software.

Organization lifecycle status

Changes to an organization's lifecycle status require a platform SuperAdmin. Organization admins can still save other organization settings while leaving that status unchanged.

If the organization changes while you are saving, the save is refused with a conflict message. Reload the organization, review its current settings and retry your intended changes.

Auto-Provisioning Entra users

By default, when a user authenticates via Microsoft Entra to any TATER app and has no existing OrgMembership, they hit a 403 Forbidden on every API call. That's the explicit allowlist model - safe for multi-tenant data, but high-friction for an org that just wants every employee to be able to file a self-service ticket or see their personal dashboard.

Auto-provisioning solves this: when an Entra user signs in with a token whose tid claim matches the org's configured Entra tenant, TATER silently creates an OrgMembership at a configured role - typically Viewer. The user lands as a basic-rights member with zero per-user admin work.

Configuring on an organization

TATER Manage → Tenant Admin → Organizations → pick an org → click ⚙ Features. The Org Features modal exposes two fields:

Default role for new sign-ins: dropdown with Off / Viewer / Auditor / OrgAdmin. New orgs default to Viewer. SuperAdmin can NEVER be auto-assigned - that would be a privilege escalation vector.
Entra tenant id: the token tid claim that must match for auto-provisioning to fire. Defaults to the org's home Cosmos partition tenantId (almost always what you want; most orgs are 1:1 with an Entra tenant).

What gets enforced

Only fires when memberships.length === 0 - existing users keep their explicit role.
Only fires when token tid matches the org's entraTenantId - outside-tenant guests and federated users still get 403.
Skips orgs marked suspended / cancelled / archived.
If multiple active orgs in the user's tenant have auto-provision configured, the match is ambiguous and the user gets 403 anyway - admin must assign explicitly.
Auto-provisioned memberships are tagged autoProvisioned: true for audit trail visibility.

Tip: pair auto-provisioning with permission bundles for members whose day-to-day access should be narrower than their role - e.g. auto-provision at Viewer, then bundle new help-desk hires to it-ops.

When to disable

Sovereign / FedRAMP / IL5 deployments where every user must be explicitly enrolled by an administrator (no implicit access).
Shared MSP tenants where the same Entra tenant hosts multiple client orgs and auto-routing-by-tenant would be ambiguous.

For everyone else (the typical "one company, one tenant" setup), leave it on Viewer. That's the entry surface for My TATER, Self-Service tickets, and dashboard read access.

Security model

Tiered access gate at boot (SuperAdmin / MSP OrgAdmin / OrgAdmin); SA-only and MSP-only pages hidden per tier
Granular per-member module scoping via permission bundles, enforced server-side across the API and MCP surfaces
Every action audit-logged with via: 'web' attribution to distinguish from MCP/agent activity
Integration secrets (ADO PAT, webhook secrets, connector API keys and tokens) encrypted at rest (AES-256-GCM) and write-only: every GET response returns '[REDACTED]' in their place, for every role including OrgAdmin and SuperAdmin
A saved credential is only ever sent to the destination it was saved with: changing where a connector connects (its URL, host, domain, instance, tenant or account, or a region other than the Zoho, PingOne or Veracode region; on a save, clearing one counts, while a test with a field left blank uses the saved value) requires re-entering its credential in the same save or test, or the request is refused (SECRET_DESTINATION_CHANGED). A saved credential's box is left blank to keep it; Remove saved value removes it. See Connector credentials.
Remote commands: script size cap (100KB), timeout cap (5–3600s), output cap (64KB stdout / 16KB stderr), 90-day TTL; file push capped at 8MB encoded; device-reported values (hostname/platform) are never trusted in the UI without escaping
Screen captures: 350KB cap per upload, one document per device (overwrites prior), 24h TTL
Vuln inventory: 1.5MB cap per upload, 4500-package cap, 30-day TTL
Remote-control sessions require end-user consent (PE-3) and are recorded (AU-14)

Release Notes

Manage › Help › Release Notes is the platform changelog: every shipped change across all six apps and the agent, merged with the full legacy version history. It answers "what changed, and when" for the whole suite.

It is not the same thing as Release Management, which is the ITIL practice of bundling changes into a release, scheduling it and recording its outcome. Release Notes is the published record of what went out; Release Management is the process that decides what goes out together.

Entries are grouped newest-first and tagged with the app they affect.
The agent's own version history is merged in, so an endpoint's reported AgentVersion can be traced to the changes it carries.
Read-only. Entries are published as part of a release, not authored here.

Direct URL

Bookmark manage.tatersecurity.com. Also reachable at app.tatersecurity.com/manage.html.