Portal Administration

Web Portal → Portal Administration

Manage

Teams permissions

Authorise (or de-authorise) individual teams for deep Teams analytics. The page lists your Teams through Microsoft Graph as you; when it has no Graph access for you yet, it offers Connect to Microsoft Teams, which asks Entra ID for the optional delegated permissions Team.ReadBasic.All and ChannelMessage.Read.All. Authorising a team stores your delegated refresh token for it in the TeamsAuth partition of the solution's AnalyticsState Azure table, for the importer to use. Teams that are not authorised here are not deeply analysed. See Portal permissions → Teams deep analytics.

Since Stable 1856 (PR #768): if Microsoft Entra ID can't be reached to refresh your connection, the page says Couldn't reach Microsoft Entra ID to refresh your Teams connection. Try again in a few minutes. and offers Try again rather than Connect to Microsoft Teams, which would fail the same way. The importer also deletes a Team's stored authorisation far less often; see Teams and calls troubleshooting → when a Team's authorisation is kept or removed.

Leadership group

Available in 1852; off by default. Name the Entra group whose direct members the Analyst view compares with the tenant. Saving or requesting a read queues a durable importer request; the admin HTTP request does not query Graph membership or SQL. Check status reads the cached outcome. The importer refreshes after 6 hours on success or 1 hour after failure, with a 10,000-member cap. Storage/Table access is required. See Leadership comparison.

Copilot Studio billing connection

Available in 1852. Connect/reconnect the same authorised account used to sign in, or disconnect the deployment's shared consumption connection. Exact Web callback, delegated Power Platform consent and durable Storage/Table access are required; no app-only consumption fallback is attempted. Credentials are encrypted and are not returned by the status API. See setup and symptoms.

Prompt categories

Available in 1852; off by default. Review processing governance, choose an administrator taxonomy and per-cycle cap, then explicitly save durable opt-in. Provisioning an OpenAI service alone does not enable it. Saved versions remain immutable; the model does not infer Directing/Supervising metadata. Review run counters and failures, and pause the importer for immediate halt. See Prompt categories.

Since Stable 1856 (PR #768): Save and Reset apply only to the settings the page loaded. If another administrator saved or reset them in the meantime, nothing is saved, and the page says The prompt categorisation settings were changed after this page loaded them, so nothing was saved. Reload to see the current settings, then make your changes again. with a Reload button. Builds before 1856 let the later save silently overwrite the earlier one, which could switch categorisation back on or undo a spending cap.

Agent 365 catalogue

Available in 1852; optional and off. Read documented package metadata and aggregate usage from the latest completed licensed/consented catalog import; failed/incomplete runs preserve the previous completed snapshot. Explicit null last-use is Never used; absent metrics are Usage not reported. This requires Administration, not See PII, and is not a billing/owner report.

User data lookup

Enter a user's UPN to see everything the solution holds about that person in SQL: their profile, per-category record counts broken down by workload, a drill-down to the most recent rows, and which import workloads are enabled (so a legitimate zero count is explained rather than mysterious). Because it is about one person, it needs See PII as well as Administration.

This is the page to use for a data-subject access request, or to answer "why is this person missing from a report?".

Licence and data diagnostics (1854). Below the profile, compare stored licences, the seat rule, live Graph evidence, the selected report's verdict and per-source freshness. Refresh this person from the directory queues correction of this person's stored profile/licences, not a tenant-wide crawl or an activity replay. Troubleshoot this person carries the report context into lookup without putting the UPN in the URL. Both Administration and See PII are required; see User licence diagnostics for queue limits, incomplete answers and cache invalidation.

User organisations

Your own ways of grouping people that Entra ID doesn't track reliably, such as a cost centre, a business unit or a team from an HR export. Each organisation type takes its values either from a custom Microsoft Entra attribute, read on every user import, or from a CSV file you upload on the page, and a person has at most one value per type. The types can then be filtered on, like any Entra ID attribute, in the user filter and the report filter. Changing which Entra attributes are in use makes the next import cycle read every user once, so that cycle takes longer than usual.

User import

Whether the Graph user import has a stored checkpoint, and a way to clear it.

After its first full read, the user import saves a checkpoint, a Microsoft Graph /users/delta token, so each later run reads only the users that changed. It is kept in the UserImport partition of the solution's AnalyticsState Azure table. The page shows:

• whether the user import is switched on (GraphUsersMetadata);
• where the checkpoint is kept, whether one is stored, and its partition and row key (the token itself is never shown);
• when the user import last completed, and how often it runs (GraphMetadataImportIntervalHours).

Clear checkpoint makes the next run read every user again, exactly as a first install does. Use it when user details in the reports look out of date, or after the user import has been switched off or failing for weeks. Nothing is deleted from the database, but on a large tenant the full read takes much longer than a normal run. By default the import then runs on the next import cycle; untick Run the user import on the next import cycle to let it wait for its normal interval instead.

It is safe to clear the checkpoint while a user import is running: that run does not save its checkpoint over yours, so the full read still happens on the next cycle.

Since Stable 1856 (PR #768):

• The full read that follows Clear checkpoint also marks as disabled every user whose Entra account no longer exists, after checking the read against Microsoft Graph's own count of the directory's users. The first one after upgrading catches up every leaver since the database began storing Entra object IDs, so expect a one-off drop in enabled users. See Troubleshooting → Leavers still show as enabled.
• When user organisation types are in use, the checkpoint's row key depends on them. If the database can't be read to find them (a timeout, say), the page now reports an error (Couldn't clear the user import checkpoint (503).) and clears nothing. Builds before 1856 cleared the row they could work out and reported success, while the checkpoint the importer actually uses survived.

Without Azure Storage (no Storage connection string) there is nothing to clear: the checkpoint is never saved, and every run already reads every user.

Report filter

Conditions that every Insights report applies for everyone, on top of any filter a reader adds. A condition can compare with the person viewing, such as Management chain includes the viewer, so one filter gives each manager their own slice. The page previews your draft against your own account before you save. Because its value picker lists people, it needs See PII as well as Administration. See Report filter.

Copilot audit backfill

Preview. A one-off import of Copilot interactions from up to 180 days ago that the normal audit import could never reach: after a new install, after switching the Copilot import on, or after an importer outage of more than about a week. Start a backfill here, follow it day by day, and cancel it if you need to. It works a few minutes at a time during the importer's cycles, and needs the optional Microsoft Graph permission AuditLogsQuery.Read.All, which the installer doesn't grant. Administration on its own is enough. See Copilot → Backfilling older Copilot history.

Copilot Adoption settings

1854 ships 33 governed fields, covering score weights/bands, engagement targets, habit buckets, opportunity/Cowork decisions, agent lifecycle, reclaim grace and segment privacy. Administration is required; See PII is independent. Activation windows and performance caps are not controls. Conditional saves/history/reset use durable Table storage, and unreadable effective settings refuse reports instead of silently using defaults. Seat-impact changes need explicit confirmation. See Copilot Adoption Settings.

Copilot investment assumptions

Since Stable 1857 (PR #787). Open Administration → Copilot & reporting → Copilot investment assumptions to set the figures the Copilot investment report models money with: a currency, a licence price, an hourly cost, optional credit prices, and three values each for the minutes Copilot gives back on an active day and the share of that time that becomes value. Nothing is set by default, and the report withholds every money figure until they are. Administration is required; See PII is independent. Saves are versioned, the last 50 changes are kept with who made them, and a second administrator's save is refused rather than overwritten. The figures live in the CopilotInvestmentAssumptions partition of the AnalyticsState table, so a Storage connection string is required. See Copilot Investment Assumptions.

Service configuration

What this deployment is actually pointed at, in one place:

• Azure resources — SQL server, storage account, Cognitive Services, Service Bus and the web app URL.
• Imports and schema — which import workloads are enabled, and whether the database schema matches the deployed build. If migrations are pending it says so and names them; run the upgrader (see Updating the solution).
• Teams calls — whether the calls import is on, the Graph call-records webhook endpoint, and the state of its subscription. There is a test webhook action that sends a live validation POST, which is the quickest way to prove the endpoint is reachable from Microsoft Graph.
• Dead-lettered Teams calls — Since Stable build 1860 (PR #870). How many call notifications the calls queue has dead-lettered, with Reprocess and Clear... actions that the importer WebJob carries out. See Reprocessing or clearing from the portal.

Connection strings are never shown — only the resolved host names.

Copilot credit history (preview)

Since Stable 1856 (PR #784): connection management uses the existing Portal.Administration role, with no separate cost-connection operator role. The panel explains the four Microsoft Graph delegated read permissions and admin consent, the reader's active tenant-wide Global Reader role, the separate application permission for directory inventory, Table access and the callback registration.

Select Check connection, then Connect reader or Reconnect same reader. A read-only probe and scheduled-collection status report coverage separately. These readings are credit quantities, not invoices or daily monetary spend; the connection does not modify policies or grant source permissions. See Copilot credit connection for setup and retention.

---

Return to Web Portal · All topics in this guide

Next: User Scope and Purge