# Manager Insights Pro
We understand that our customers need to be confident using Manager Insights Pro, and be aware of our data collection practices. Manager Insights Pro is a Microsoft 365 Copilot declarative agent that provides managers with data-driven insights into team performance, employee engagement, meeting patterns, and collaboration metrics, enabling better decision-making and team management through natural conversation within Microsoft Copilot Chat.
Note
This section is subject to change and we recommend that you check back quarterly for updates.
For how managers use the agent day to day, see the Manager Insights Pro documentation.
# Licensing prerequisites
Microsoft 365 Copilot license required per user
A Microsoft 365 Copilot license is required per Manager Insights Pro user. Every manager who uses Manager Insights Pro must be assigned one. Without a Copilot license, users cannot invoke Manager Insights Pro through Microsoft 365 Copilot Chat.
The license is only needed for the people who actually use Manager Insights Pro, not for every user in the tenant.
| Requirement | Scope | Required |
|---|---|---|
| Microsoft 365 Copilot license | Per Manager Insights Pro user | Yes |
| Manager Insights Pro subscription (Microsoft AppSource) | Per tenant | Yes |
# Data Management Practices
Through the implementation of its different features, Manager Insights Pro accesses, processes and stores several kinds of data:
- User profiles and organizational hierarchy
- Manager team memberships and direct reports
- Email and Teams activity patterns (aggregated, anonymized)
- Meeting participation and frequency data
- Collaboration metrics and signals
- Conversation history with the agent
- User interaction logs (anonymized)
- Marketplace subscription metadata
Here is how we're managing data for these different categories:
| Data | Accessed | Cached | Stored | Backup | Notes |
|---|---|---|---|---|---|
| User profiles | ✔ | ✔ | 🚫 | 🚫 | Read at sign-in via Microsoft Graph (User.Read). Not persisted beyond the active session. |
| Manager team memberships | ✔ | ✔ | 🚫 | 🚫 | Resolved on-demand to identify direct reports. In-memory cache per request only; never written to durable storage. |
| Organizational hierarchy | ✔ | ✔ | 🚫 | 🚫 | Read on-demand from Microsoft Graph /users/{id}/directReports. Returned to the caller; not persisted. |
| Email activity patterns | ✔ | ✔ | 🚫 | 🚫 | Aggregated patterns only (sender frequency, message volume). Individual email content is never accessed or stored. |
| Meeting participation | ✔ | ✔ | 🚫 | 🚫 | Meeting frequency, duration, and attendees aggregated for patterns. Individual meeting details not persisted. |
| Collaboration metrics | ✔ | ✔ | 🚫 | 🚫 | Derived from Microsoft Graph collaboration signals (Teams activity, email frequency). Real-time, not cached beyond request. |
| Conversation history | ✔ | ✔ | ✔ | ✔ | Agent conversation turns stored for audit trail. Stored as long as the subscription is active. |
| User interaction logs | ✔ | ✔ | ✔ | ✔ | Anonymized logs of manager interactions with the agent for analytics and feature optimization. |
| Marketplace subscription metadata | ✔ | ✔ | ✔ | ✔ | Received via Microsoft commercial marketplace SaaS webhooks. Stored for plan, status, and trial tracking. |
| Copilot Conversations | 🚫 | 🚫 | 🚫 | 🚫 | No access to other Copilot conversations. No cache. No storage. |
No model training
No customer organizational or collaboration data is used to train any AI or machine-learning model. Manager Insights Pro only reads from Microsoft Graph APIs for aggregated analytics and generates insights based on patterns. No employee data is sent to any third-party model provider, and no Witivio model is fine-tuned, indexed, or otherwise enriched with customer organizational data.
# Tenant isolation
Tenant isolation is enforced in the data layer. Every record that belongs to a customer tenant (subscription, conversation history, preferences) carries the caller's tenant context, and every query is filtered by that tenant.
# Microsoft Graph
TIP
All permissions are delegated permissions. Manager Insights Pro operates only on behalf of the authenticated manager.
| Scope | Description | Justification | Admin Consent Required |
|---|---|---|---|
User.Read | Retrieve the properties and relationships of the signed-in user. | Allows Manager Insights Pro to identify the manager and read their profile. | No |
User.ReadBasic.All | Read basic profile information of all users in the tenant. | Allows Manager Insights Pro to resolve team members and colleagues in insights. | No |
Directory.Read.All | Read directory data (users, groups, organizational units). | Allows Manager Insights Pro to access organizational hierarchy, manager-direct report relationships, and team structures. | Yes |
TIP
The Microsoft Entra ID App ID is: df3f7b0b-4265-46c5-946f-cabad2d0981c
Manager Insights Pro signs in against the TeamsPro Admin Center Entra application. The scope it requests is the Admin Center Application ID URI, api://admin.teams-pro.com/df3f7b0b-4265-46c5-946f-cabad2d0981c/access_as_user. There is no separate Entra application for Manager Insights Pro.
# Microsoft Graph endpoints
Each Microsoft Graph endpoint that Manager Insights Pro's agent calls:
| Endpoint | Purpose |
|---|---|
GET /v1.0/users/{id} | Retrieve user profile and context for managers and team members. |
GET /v1.0/users/{id}/directReports | List direct reports of a manager. |
GET /v1.0/me/manager | Get the authenticated manager's manager. |
GET /v1.0/me/messages | Retrieve user's email message metadata for activity analysis. |
GET /reports/getTeamsUserActivityUserDetail(period='D7') | Get Teams activity metrics (conversations, calls, meetings). |
GET /v1.0/me/calendar/events | Retrieve meeting participation and frequency patterns (metadata only). |
All Graph calls are issued with a token acquired via the on-behalf-of (OBO) flow from the bearer token presented by Microsoft 365 Copilot. Manager Insights Pro never holds an application-only credential and cannot act outside the calling manager's permissions.
# Architecture and flow diagram
The agent receives manager queries through Copilot Chat and first calls its one plugin function to confirm that the tenant has an active subscription. If the subscription is not active, the agent shows an activation card and stops. Otherwise it reads aggregated organizational and collaboration data under the manager's delegated permissions and returns actionable insights in natural language.
No Manager Insights Pro backend service
Manager Insights Pro is a declarative agent only. It does not run a Witivio-hosted analytics service of its own: there is no managerinsights.teams-pro.com host to allow, and the analysis happens inside Microsoft 365 Copilot. The only Witivio endpoint the agent calls is the subscription check on the Admin Center host.
# Copilot Declarative Agent Configuration
Manager Insights Pro exposes its capabilities to Microsoft 365 Copilot as a declarative agent with the following configuration:
# Agent Definition
- File:
declarativeAgent.json - Schema: Microsoft Copilot declarative agent schema v1.5+
- Instructions: LLM instructions defining agent behavior for analyzing team dynamics, manager effectiveness, collaboration patterns
- Conversation Starters:
- Global Interaction Analysis
- Communication Tone Trend
- Collaboration Dynamics
- Hidden Team Structure
- Weekly Manager Brief
- Dashboard
# OpenAPI Plugin
- File:
ai-plugin.json - Schema: Microsoft Copilot plugin schema v2.4+
- Namespace:
managerinsightspro - Functions exposed: Subscription check only. The plugin does not perform the analysis.
# Plugin Runtime
- Type: OpenAPI
- Spec:
openapi.yaml(OpenAPI 3.0+ specification) - Host:
admin.teams-pro.com, the TeamsPro Admin Center. Manager Insights Pro has no service host of its own. - Authentication: OAuth 2.0 via
OAuthPluginVault- Uses delegated user tokens (on-behalf-of flow)
- Requests the Admin Center Application ID URI scope,
api://admin.teams-pro.com/df3f7b0b-4265-46c5-946f-cabad2d0981c/access_as_user
- Response Format: Either an empty success response, meaning the subscription is active, or an Adaptive Card prompting activation
# Plugin Functions
| Function | Description | Input | Output |
|---|---|---|---|
getApiExternalSubscription | Check whether the signed-in manager's tenant has an active Manager Insights Pro subscription. Called before any analysis. | Optional locale (for example en, fr) | Empty response when the subscription is active, or an Adaptive Card for activation |
The analysis itself does not run on a Witivio service. Once the subscription check passes, the agent uses Microsoft 365 Copilot's own capabilities (Email, Microsoft Teams messages, Meetings, People, and OneDrive and SharePoint) to read the manager's data under their existing permissions, then builds the insights, tables, and diagrams in its response.
# Trial subscriptions
A tenant on a Microsoft AppSource trial can invoke Manager Insights Pro with the following limitations:
- Insights limited to team-level analysis (not full organizational scope)
- Historical data capped to the most recent 30 days
- Recommendation features limited
- A banner in responses indicates trial mode and expiration date
- Trials run for seven days by default
Data handling is the same for trial and paid subscriptions.
# Resource Endpoints
All traffic uses HTTPS protocol on port 443. Here is a short description of each flow:
| Name | Comments |
|---|---|
graph.microsoft.com | Microsoft Graph: organizational hierarchy, Teams activity, meeting and email metadata, collaboration signals. |
login.microsoftonline.com | Microsoft Entra ID: token acquisition, validation, and on-behalf-of token exchange. |
*.applicationinsights.azure.com | Application Insights telemetry (optional). |
admin.teams-pro.com | Admin portal for subscription and configuration management, and the host of the subscription check the agent calls (/api/external/subscription). |
subscriptions.witivio.com | Subscription validation and licensing. |
Allowlists do not need a Manager Insights Pro host
Earlier versions of this page listed managerinsights.teams-pro.com as a plugin service endpoint. That service was removed and the host is not used. Do not add it to a firewall allowlist. The agent's only Witivio call goes to admin.teams-pro.com, which is already in the table above.
All plugin invocation and Microsoft Graph calls operate under the authenticated manager's delegated permissions. Manager Insights Pro cannot access data outside the manager's organizational visibility and cannot act with broader permissions than the manager holds.
# Security & Compliance
Manager Insights Pro follows Microsoft 365 Copilot agent security and compliance standards:
- Delegated permissions only: no application-wide Graph access; respects manager's organizational visibility
- On-behalf-of token flow: the agent presents the manager's delegated token, and no Witivio service holds an application-only credential
- Tenant isolation: all insights scoped to the tenant; conversation history private to the manager
- GDPR compliant: Azure-hosted in Europe, aggregated analytics only (no individual employee data persisted)
- No external training: organizational data never sent to external LLM providers or used for model fine-tuning
- Adaptive authentication: OAuth tokens refreshed per Microsoft Copilot's lifecycle