Web Portal

The web portal

The solution ships a web portal — the ASP.NET Web app service — that everyone signs in to with Entra ID (Azure AD). It serves two very different audiences, so it is split into two areas that you switch between in the header:

Area	Who it's for	What it answers
Insights	Adoption / business owners, report consumers	What is the data telling us?
Administration	IT operators, whoever installed the solution	Is the service running, and what is it pointed at?

The portal opens on Insights. Each area has its own left-hand navigation; switching areas keeps you signed in and does not reload the page.

Access to the portal is controlled by Entra ID. We recommend restricting it to specific administrators — see Verify the deployment. There is no separate permission for the two areas: anyone who can sign in can see both. The new Licence activity report additionally requires an application role for its individual-user drill-down and exports; this does not change other portal permissions.

---

Insights

Overview

The landing page. How much of each workload is in the database (audit events, web hits, Copilot interactions, users, and so on) and how fresh it is — the newest audit event and the newest web hit.

Use it as a quick "is data still arriving?" check. If the counts look wrong or the newest event is old, go to Administration → Service health for the reason.

Reports

An in-app version of the Power BI reports, with a sub-area per workload. Workload charts appear when their import is enabled — confirm which imports are on under Administration → Service configuration.

Each area charts usage over a configurable window (the last 3 months by default).

Licence activity (unreleased, available in dev only) is always visible, including when its user-metadata prerequisite is disabled. It provides an executive SKU overview, separate workload activity distributions, department/country breakdowns, and role-protected administrative drill-down with ranking, UPN/email search and bounded paging. Its own date controls support presets and a validated custom UTC range. Export to Excel saves the current bounded snapshot with coverage and interpretation notes. See Licence activity for access, prerequisites and important data limitations.

Copilot Adoption

Answers the two questions that decide Copilot spend:

• which licensed users are not getting value from their licence (as a graded score, not a yes/no); and
• which unlicensed heavy Microsoft 365 users have the strongest case for one.

Both lists export to CSV so they can be handed to department leads or attached to a licence request.

For a walkthrough of the page and how to run a licence review with it, see the Copilot Adoption user guide.

---

Administration

Monitoring

Service health

The at-a-glance green board, and the first place to look when something seems wrong. It has its own sub-sections, each loading on demand and auto-refreshing while open:

Sub-section	What it tells you
Overview	Overall traffic light plus a per-section status grid.
Import liveness	When each web-job last completed a cycle, and per-section import times.
Exceptions	Exception volume over the last 24 hours and the most common exception types — a cheap early warning of failures no specific check anticipates.
Component health	Runtime credential, Service Bus and Application Insights connectivity.
Data overview	Record counts, recent volumes and data freshness, plus database size.

This complements the Azure Monitor alert rules described in Health alerts: alerts tell you when something breaks, Service health is what you look at.

Install log

Every configuration that has been applied to the solution (the sys_configs table): when, by whom, the install messages, and the config JSON for each entry. The most recent entry is the current configuration — which makes this the fastest way to answer "what changed, and when?".

Profiling

The current state of the profiling data: earliest and latest dates for each compiled profiling table and for the source activity tables that feed it, plus a paged view of the profiling runbooks' own trace log. Use it to confirm the runbooks have actually run and to spot errors. See Runbook schedules.

Manage

Teams permissions

Authorise (or de-authorise) individual teams for deep Teams analytics. Granting access stores a delegated refresh token in Redis for the importer to use. Teams that are not authorised here are not deeply analysed.

User data lookup

Enter a user's UPN to see everything the solution holds about that person in SQL: their profile, per-category record counts broken down by workload, a drill-down to the most recent rows, and which import workloads are enabled (so a legitimate zero count is explained rather than mysterious).

This is the page to use for a data-subject access request, or to answer "why is this person missing from a report?".

Service configuration

What this deployment is actually pointed at, in one place:

• Azure resources — SQL server, Redis, Cognitive Services, Service Bus and the web app URL.
• Imports and schema — which import workloads are enabled, and whether the database schema matches the deployed build. If migrations are pending it says so and names them; run the upgrader (see Updating the solution).
• Teams calls — whether the calls import is on, the Graph call-records webhook endpoint, and the state of its subscription. There is a test webhook action that sends a live validation POST, which is the quickest way to prove the endpoint is reachable from Microsoft Graph.

Connection strings are never shown — only the resolved host names.

---

Notes

• The portal is a single-page app, so its addresses look like https://<your-web-app>/#/insights/overview. These are safe to bookmark and to share with colleagues.
• Addresses changed when the portal was split into two areas. Older links such as #/health or #/reports are no longer recognised and land you on the Insights overview instead of erroring. Update any saved bookmarks or runbooks to the new addresses above.