TATER SecurityTATER Manage

TATER Manage

Platform administration + endpoint fleet management. For organization admins, MSPs, and SuperAdmins - the sister app where you govern who can do what and operate the device fleet.

What it is

TATER Manage consolidates administration and adds operational fleet capabilities that don't fit cleanly into Security or Ops: user and access management, integrations and intake channels, remote operations on devices (live shell, process/service control, file push, Wake-on-LAN, remote control), patching, software deployment, and endpoint policy. The TATER acronym for this product expands as Tenant Administration, Telemetry & Endpoint Remote-control.

Signing in & access tiers

Manage is reachable at manage.tatersecurity.com. Sign in with the same Microsoft account used across the platform. Access is tiered at boot:

  • SuperAdmin - the full app, including the SA-only pages (Organizations, Users, Subscriptions, Usage Analytics, MCP Feedback, QA Checklist, Agent Versions, Azure DevOps, Meeting Bot).
  • MSP OrgAdmin - cross-client visibility (Clients, MSP Licensing) plus their own org's admin tools.
  • OrgAdmin - their own organization's admin tools.
  • Anyone else sees an access-denied card with a diagnostic block (signed-in account + orgs/roles returned) to paste into a bug report, plus links back to Security/Ops.

The left icon rail groups the app into eleven modules; each opens with a module dashboard plus its pages. Items marked SA are SuperAdmin-only; MSP items show for MSP admins and SuperAdmins.

Overview

  • Dashboard - admin KPIs and cross-module tiles.
  • Calendar - unified GRC timeline (audits, override expirations, BCP/DR test windows, training due dates) across all orgs.
  • TATER Tips - the bite-sized tips library covering every TATER capability; the shared login popup pulls a random tip each session.

Tenant Admin

  • Organizations (SA) - all orgs with role + tenant ID, org features (incl. auto-provisioning), lifecycle state.
  • Users (SA) - registered platform users, global roles, org memberships; cross-links to Access Control per member.
  • Access Control - assign granular permission bundles to scope members to specific modules (Ops, Security, Audit, …), and build custom bundles. A member with no bundles keeps their role's default access; SuperAdmins are always unrestricted.
  • Subscriptions (SA) - per-org billing, license limits, MRR.
  • Clients (MSP) - MSP partner client roster with tier, effective role, seat ratio, engagement status.
  • MSP Licensing (MSP) - seat allocation and tier access (T1 Monitor / T2 Operate / T3 Manage).

Audit & Telemetry

  • All Reports - the reporting index across the platform.
  • Activity Log - cross-product audit trail; filter by action, channel (via: web / mcp / copilot / claude / agent / cron / api / ado-webhook), free-text search.
  • Usage Analytics (SA) - period selector (7/30/90 days), KPIs, Top Pages, Top Orgs.
  • MCP Feedback (SA) - all MCP feedback submissions; sentiment-coloured cards with ADO link badges. See MCP Feedback.
  • MCP Tool Policies - control which AI/MCP tools are available: globally, by role, or by group, with a preview tab. See MCP Tool Policies.
  • Approvals - the org's approval requests and approval groups (the engine behind My Approvals). See Approvals.
  • QA Checklist (SA) - the platform QA state: the recurring release checklist with per-item pass/fail tracking.

Connections

Integration and authentication surfaces (approval/finance and content workflows moved to their own modules below):

  • Integrations - connector cards (ADO, Jira, ServiceNow, Teams, Slack, Webhook) with "Used by" tags; config deep-links.
  • API Keys - the single canonical home for API key generation platform-wide. Per-org, SHA-256 hashed, shown once at creation, instant revoke.
  • SSO & SCIM - single sign-on and SCIM provisioning configuration. See SSO & SCIM.
  • Azure DevOps (SA) - TATER Ops ↔ ADO bi-directional sync; PAT and webhook secret encrypted at rest, redacted on display.
  • Meeting Bot (SA) - the meeting-bot integration configuration.
  • Task Notifications - fan-out alerts for new Ops tasks to staff email and a Teams channel (Power Automate Workflow webhook). See Task Notifications Setup.
  • Ops Event Webhooks - push Ops lifecycle events to your own endpoints. See Ops Event Webhooks.
  • Email-to-Ticket - mailbox intake that converts email into Ops tickets, with trusted-sender allowlisting. See Email Intake Setup.
  • File Storage - attachment storage configuration (where ticket/entity attachments live). See Attachment Storage.
  • Power Automate - flow-monitor configuration for catching disabled/suspended/failing cloud flows. See Power Automate Flow Monitor.

Approvals & Finance

  • License Rentals - configure rentable Microsoft licenses (Visio, Project, …) users request time-boxed from My TATER. See License Rentals.
  • Travel Exemptions - configure the travel-exemption workflow (CA exemption group, approval chain). See Travel Exemptions.

Content & Automation

  • Email Signatures - the org signature template users render from My TATER.
  • Branded Documents - generate polished, co-branded Word deliverables built from the org's actual configuration (categories, priorities, teams, catalog items). MCP agents produce the same via generate_branded_document.
  • Automations - org automation rules.
  • Power Platform Inventory - the GRC audit inventory of Power Platform assets. See Power Platform Inventory.

Service Management

  • Service Catalog (Admin) - design request types with form schemas, routing, approval flags, ETAs; seed the 13 starter items. See Service Catalog Administration.
  • Status Page Subscribers - who receives status-page notifications.

Knowledge

  • Policies / Documentation / TATERpedia - inline editing of the same records shared with TATER Security and Ops.

Devices

  • Devices - every TATER agent reporting in: platform, heartbeat status, agent version, identity/privilege, compliance, MDE risk. Each row carries the quick-action bar and opens the device detail drawer.
  • Agent Deployment - current version, download links for all platforms. See Agent Deployment.
  • Agent Versions (SA) - per-platform binary metadata with SHA256.
  • Multi-Screen - thumbnail grid of device screenshots (when capture is enabled in agent config); click to zoom.
  • BitLocker Keys - escrowed recovery keys with audited reveal.

Endpoint Health

  • Application Monitoring - OneDrive health, KEV exposure, and templated agent monitors as one findings surface. See Application Monitoring.
  • Vulnerabilities - fleet exposure summary with CISA KEV correlation; per-device known exposures + software inventory.
  • Patch Management - endpoint patch posture and deployments, with severity-based auto-approval policies. See Patch Policy Automation.
  • Software Deploy - package catalog + deployments to devices via the agent. See Endpoint Management (UEM).
  • Endpoint Policies - USB / app-allow / JIT-admin / power / browser / DNS policies applied through the agent.
  • Automated Remediations - admin-defined diagnose + fix scripts exposed to end users via the agent tray. See Self-Service Fixes.
  • Endpoint Profiles - named configuration profiles applied per device group.

Help

  • Release Notes - the consolidated change log for all sister apps + the agent (unified version history plus the full legacy history).
  • Feedback - in-app feedback submission.

Device quick actions

Every device row (and the detail drawer) carries a per-device action bar. All actions queue agent commands that are audit-logged and appear in the device's command history:

  • ↻ Restart Agent - queue a service restart of the TATER agent itself.
  • ▶ Run - queue an arbitrary PowerShell / bash script, as SYSTEM (default) or the logged-in user; live status modal captures stdout/stderr.
  • Shell - a live interactive shell session on the device.
  • ⚙ Process/Service - kill a process, or restart / stop / start a service, by name. Runs as SYSTEM (Windows) or root; one-shot, audit-logged.
  • ⇪ Push file - push a small file to a path on the device. The file is base64-encoded and queued as an agent command; cap 8 MB encoded (≈6 MB raw), written as SYSTEM/root.
  • ⏻ Wake (offline devices only) - send a Wake-on-LAN magic packet to the device's MAC address, relayed by an online peer agent on the same LAN. The target must have WoL enabled in firmware/NIC settings; the relay command shows in the peer's history.
  • History - the device's full remote-command history with per-command output.
  • Remote - a WebRTC remote-support session with PE-3 end-user consent and AU-14 session recording. See Interactive Remote Control.
  • + Ops ticket - create a TATER Ops ticket prefilled with the device's context and linked to the device.

Device detail drawer

Clicking a device opens a right-side drawer aggregating its cross-cutting context in one place: overview (platform, heartbeat, agent version, last user, last boot, identity/privilege, compliance, MDE risk), TATER Tuning applied levels with drift triage, full diagnostics health-checks, patch posture, remote-command history, endpoint-profile applied state, vulnerabilities/KEV detail, and monitoring findings + linked Ops tasks - with the same quick-action bar on top.

Agent communication channels

The TATER Go agent runs as a system service and talks to the API over several surfaces - scans (compliance posture), evidence collection, commands (remote operations above), vulnerabilities (weekly software inventory for KEV correlation), and screens (periodic screenshot upload when enabled). All use the same X-Api-Key auth bound to a per-org API key configured at install. Agent API keys are org-bound - an agent for org A cannot read or mutate commands/screens/inventory belonging to org B even within the same tenant.

Auto-Provisioning Entra users

By default, when a user authenticates via Microsoft Entra to any TATER app and has no existing OrgMembership, they hit a 403 Forbidden on every API call. That's the explicit allowlist model - safe for multi-tenant data, but high-friction for an org that just wants every employee to be able to file a self-service ticket or see their personal dashboard.

Auto-provisioning solves this: when an Entra user signs in with a token whose tid claim matches the org's configured Entra tenant, TATER silently creates an OrgMembership at a configured role - typically Viewer. The user lands as a basic-rights member with zero per-user admin work.

Configuring on an organization

TATER Manage → Tenant Admin → Organizations → pick an org → click ⚙ Features. The Org Features modal exposes two fields:

  • Default role for new sign-ins: dropdown with Off / Viewer / Auditor / OrgAdmin. New orgs default to Viewer. SuperAdmin can NEVER be auto-assigned - that would be a privilege escalation vector.
  • Entra tenant id: the token tid claim that must match for auto-provisioning to fire. Defaults to the org's home Cosmos partition tenantId (almost always what you want; most orgs are 1:1 with an Entra tenant).

What gets enforced

  • Only fires when memberships.length === 0 - existing users keep their explicit role.
  • Only fires when token tid matches the org's entraTenantId - outside-tenant guests and federated users still get 403.
  • Skips orgs marked suspended / cancelled / archived.
  • If multiple active orgs in the user's tenant have auto-provision configured, the match is ambiguous and the user gets 403 anyway - admin must assign explicitly.
  • Auto-provisioned memberships are tagged autoProvisioned: true for audit trail visibility.

Tip: pair auto-provisioning with permission bundles for members whose day-to-day access should be narrower than their role - e.g. auto-provision at Viewer, then bundle new help-desk hires to it-ops.

When to disable

  1. Sovereign / FedRAMP / IL5 deployments where every user must be explicitly enrolled by an administrator (no implicit access).
  2. Shared MSP tenants where the same Entra tenant hosts multiple client orgs and auto-routing-by-tenant would be ambiguous.

For everyone else (the typical "one company, one tenant" setup), leave it on Viewer. That's the entry surface for My TATER, Self-Service tickets, and dashboard read access.

Security model

  • Tiered access gate at boot (SuperAdmin / MSP OrgAdmin / OrgAdmin); SA-only and MSP-only pages hidden per tier
  • Granular per-member module scoping via permission bundles, enforced server-side across the API and MCP surfaces
  • Every action audit-logged with via: 'web' attribution to distinguish from MCP/agent activity
  • Integration secrets (ADO PAT, webhook secrets) encrypted at rest (AES-256-GCM); redacted to '[REDACTED]' on GET responses
  • Remote commands: script size cap (100KB), timeout cap (5–3600s), output cap (64KB stdout / 16KB stderr), 90-day TTL; file push capped at 8MB encoded; device-reported values (hostname/platform) are never trusted in the UI without escaping
  • Screen captures: 350KB cap per upload, one document per device (overwrites prior), 24h TTL
  • Vuln inventory: 1.5MB cap per upload, 4500-package cap, 30-day TTL
  • Remote-control sessions require end-user consent (PE-3) and are recorded (AU-14)

Direct URL

Bookmark manage.tatersecurity.com. Also reachable at app.tatersecurity.com/manage.html.