IT setup guide
This guide is for the IT and Microsoft Entra ID (formerly Azure AD) administrators deploying Tato. It covers the admin consent grants, the Microsoft Graph permissions Tato requests and why, the Tato service account, and the controls you keep to review or revoke access.
Looking for what Tato connects to and how teams use it day to day? See Integrations. For the data access model, see Data sharing & security and our Trust Center.
How Tato connects to Microsoft 365
Tato is the AI co-pilot for the world's largest projects. Each customer runs on a dedicated single-tenant instance hosted on Azure, with nothing shared between customers. Tato connects to your Microsoft 365 environment through Entra ID applications that Tato publishes and maintains.
Granting admin consent through a pre-generated URL adds these applications to your tenant as enterprise applications (service principals), where you can inspect, audit, and revoke them like any other app. There's nothing to build on your side: no app registration, redirect URI, or client secret.
There are two applications, plus one optional per-user grant:
| Consent | What it does | Acts as |
|---|---|---|
| Single sign-on | Lets users in your organization sign into Tato with their Microsoft account | Each signed-in user |
| Tato Assistant | The agent that joins meetings, reads chats, and sends updates | The tato@yourcompany.com service account |
| User calendar access | Lets individual users connect their own calendar so Tato knows which meetings to join | Each user who connects their calendar |
The Tato Assistant uses delegated permissions only. Its Microsoft Graph calls run in the security context of the tato@yourcompany.com service account, so its effective access is the granted scopes intersected with what that account is a member of. If the service account isn't invited to a meeting or added to a chat, channel, or site, Tato can't read it. See Data sharing & security for how this maps to access inside Tato.
The Tato service account
The Tato agent works through a standard member account you create in your tenant, for example tato@yourcompany.com. It shows up in meetings and chats like any other team member, and your team scopes its access the same way: invites and memberships.
You'll need:
- A member user account (not a guest), typically
tato@yourcompany.com - A license that includes an Exchange Online mailbox and Microsoft Teams (web-only plans like Microsoft 365 Business Basic are enough; no desktop apps needed)
Share the credentials with us as soon as the account exists, through a secure channel (1Password or similar preferred). We verify the account and set up MFA with a TOTP authenticator.
MFA for the service account uses a TOTP code, enrolled in Entra as a third-party software OATH token. If your authentication methods policy only allows the Microsoft Authenticator app, permit software OATH tokens for the service account; an automated account can't approve push notifications.
Setup checklist
Your team can't sign into Tato until single sign-on is granted, so the Tato team sends both consent links to you at kickoff: one for single sign-on, one for the Tato Assistant. The person granting consent doesn't need a Tato account.
- Create the service account:
tato@yourcompany.comwith Exchange Online and Teams licenses - Share the service account credentials with us securely. We verify the account and set up MFA
- Grant single sign-on: open its consent link as a Global Administrator and accept. Your team can now sign in with their Microsoft accounts
- Grant the Tato Assistant permissions with its consent link. It only requests scopes for the features your organization needs (permissions reference)
Optional grants
Everything else is self-serve from Organization settings → Integrations: permission status per feature, consent URLs, and the rest of the admin configuration (the MCP server, for example).
- User calendar access pre-approves the calendar permissions tenant-wide, so users can connect their own calendars without per-user admin approval.
- More Tato Assistant features: click Grant consent next to Tato Assistant, pick the integrations to include (calendar write access, Teams chat, emails, SharePoint), then grant the consent URL it builds. Already-granted scopes are unaffected; new ones are added.
Permissions reference
Every permission the Tato Assistant requests is delegated. Several of its scopes require admin consent by Microsoft policy, which is why consent is granted once, tenant-wide, by an administrator.
Single sign-on
Sign-in uses standard OpenID Connect scopes and pulls name, email address, and profile photo:
| Scope | What it's for |
|---|---|
openid | Sign users in with their Microsoft account |
profile | Display name and profile photo |
email | Email address, to match the user's Tato account |
Sign-in doesn't come with mailbox, file, chat, or calendar access.
Tato Assistant default permissions
Always required. They cover meeting transcription, calendar access, and Teams messaging for the service account:
| Scope | Why Tato needs it |
|---|---|
openid, profile, email, offline_access | Sign in as the service account and keep the session refreshed without re-prompting |
User.Read | Read the service account's own profile |
User.ReadBasic.All | Resolve the names and email addresses of meeting and chat participants |
Calendars.Read | Read the service account's calendar to know which meetings it's invited to |
OnlineMeetings.Read | Look up details and join information for Teams meetings the service account is invited to |
OnlineMeetingTranscript.Read.All | Read transcripts of Teams meetings the service account attends |
Chat.ReadWrite | Read and reply in chats where the service account is a member |
Optional features
Each feature you select adds its scopes to the consent URL. Enable only what you need:
| Feature | Scopes | What it enables |
|---|---|---|
| Teams chat | Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMember.Read.All, ChannelMessage.Read.All, ChannelMessage.Send | Read and post in Teams channels the service account has been added to |
| Send emails | Mail.Send | Send emails as the service account |
| Receive emails | Mail.ReadWrite | Read and manage the service account's own mailbox |
| Calendar write access | Listed in your consent URL | Create and manage calendar events and groups on behalf of your organization |
| SharePoint access | Listed in your consent URL | Read and process SharePoint sites and files the service account has access to |
Reading the consent URL
Every consent link Tato generates targets Microsoft's standard admin consent endpoint. The scope parameter enumerates each permission being requested; what you see in the URL is exactly what Entra ID shows on the consent screen.
https://login.microsoftonline.com/organizations/v2.0/adminconsent
?client_id=<Tato application ID>
&redirect_uri=https://yourcompany.tato.co/...
&scope=<space-separated list of Microsoft Graph scopes>
The redirect_uri points back to your organization's Tato instance and is pre-registered on Tato's application. You never configure it yourself.
Security and governance
You stay in control after consent is granted:
- Review: both Tato applications appear in the Entra admin center under Enterprise applications, with granted permissions visible under Permissions.
- Audit: the service account's activity shows up in standard sign-in and audit logs, like any other user.
- Scope: Tato's reach is governed by membership. Remove the service account from a meeting, chat, channel, or site and its access ends immediately, no consent change required.
- Revoke: remove granted permissions or delete the enterprise application at any time. Disabling the service account or removing its licenses also stops the agent.
Frequently asked questions
Do we need to create an app registration in our tenant?
No. Tato registers and maintains its own Entra ID applications. Granting admin consent adds them as enterprise applications in your tenant, so there's no redirect URI, client ID, or secret to configure on your side.
What API permissions does Tato require?
Sign-in uses OpenID Connect scopes (openid, profile, email) to pull name, email address, and photo. The Tato Assistant requests delegated Microsoft Graph permissions covering calendar read, Teams meetings and transcripts, and chat, plus optional scopes for the features you enable. See the permissions reference; the exact set for your organization is listed in your consent URL.
Does the Tato Assistant use application permissions?
No. Its permissions are delegated, so it acts as the service account and can never access data beyond what that account is a member of.
What role do I need to grant consent?
Tenant-wide admin consent requires a Global Administrator or Privileged Role Administrator role.
How do we limit what Tato can access?
Through membership. The service account only sees the meetings it's invited to, the chats and channels it's added to, and the sites it's given access to. Unselected optional features are never included in the consent request.
How do we revoke access?
In the Entra admin center under Enterprise applications: review granted permissions, remove them, or delete the application. Removing the service account's memberships or disabling the account takes effect immediately.
Where is our data stored?
Each customer runs on a dedicated single-tenant instance hosted on Azure. Tato is SOC 2 compliant. See Data sharing & security and our Trust Center.
Questions? Reach out at support@tato.co. We're happy to walk through setup live with your IT team.