Skip to content

Admin handover — everything a new administrator needs

This page is a plain-English checklist for whoever runs the Cove Backup Audit Reporter after you. It assumes no access to the source code — everything here is done in the app, the Cloudflare dashboard, or Microsoft Entra. Keep it current when things change.

What the app does

Each month it reads every device from Cove Data Protection, builds a per-company backup audit (PDF + Excel), and emails it from a shared mailbox to your recipient list. It runs entirely on Cloudflare.

The monthly rhythm:

  • 1st of the month — the app automatically captures last month's report and saves it.
  • Your chosen day (Schedule screen) — it emails that saved report to recipients.

The 5 things a new admin should check first

  1. You're an admin. The current admin adds you in the app: Admin → Add admin by email. Owners are fixed in the config file (below); added admins can do everything else.
  2. Who sends the email. Open Admin → Microsoft 365. The Connected as line shows the account whose sign-in authorizes sending. If that person has left, click Reconnect Microsoft 365 and sign in with a durable account (see below).
  3. The schedule. Schedule screen — the day/time the report is emailed and the timezone.
  4. The recipients. Recipients screen — who receives it (TO/CC/BCC).
  5. It's alive. Dashboard → Next scheduled run → Last automated check should update at least daily. Red banners at the top of the dashboard tell you if something needs attention.

Configuration (set in server/config/app.config.ts, applied on deploy)

You don't need to read code, but you should know these values exist and who can change them (they require a re-deploy):

Setting What it is Current value
adminEmails Permanent owner accounts (can't be removed in the app) robertbettencourt@totlcom.com
m365.senderUpn The shared mailbox reports are sent from report@totlcom.com
m365.tenantId Your Microsoft 365 directory (tenant) ID (in Entra → app registration)
m365.clientId The mail app registration's client ID (in Entra → app registration)
cove.partnerName Default Cove partner/company name. Only a fallback — the live value is set in Admin → Cove API (your Cove company name)
report.defaultTimezone Fallback timezone for timestamps America/Los_Angeles
report.staleDays Days without a backup before a device is "stale" 7
report.retentionMonths Default months of history to keep 24

To change any of these, edit that file and run npm run deploy (see Deployment). Adding/removing admins and changing retention can be done live in the app without editing the file (Admin screen).

Secrets (stored in Cloudflare, never in the app or code)

These are set once with npx wrangler secret put <NAME> and are never displayed. If one leaks or an account changes, rotate it and re-run that command:

Secret Purpose
TOKEN_ENC_KEY Encrypts the stored Microsoft 365 token and the stored Cove API token
CF_ACCESS_TEAM_DOMAIN / CF_ACCESS_AUD Cloudflare Access login protection

The Cove login is not one of these

It used to be. It's now managed in the app at Admin → Cove API and stored encrypted in the database, so changing it needs no terminal access — see Cove API setup. Older deployments may still have COVE_API_USER / COVE_API_PASSWORD set as a fallback; they're harmless, and updating them has no effect once credentials are saved in the app.

There is no Microsoft client secret — M365 uses the in-app Connect button. See Microsoft 365 connection.

Keeping the Microsoft 365 connection healthy

  • The connection is tied to the account someone signed in with when they clicked Connect. Use a Global Administrator or a dedicated service account — not a personal account — so it survives staff changes. Reconnect with a different account any time via Admin → Reconnect Microsoft 365 (Microsoft shows an account picker).
  • The app runs a daily health check that refreshes the connection (keeping it from expiring) and, if it ever can't, emails the admins and shows a red banner: "Microsoft 365 needs reconnecting." The Admin card shows Daily health check: Healthy / Needs reconnect.
  • That account also needs Send As permission on the report@totlcom.com mailbox (Exchange admin center → the mailbox → Delegation).

Where everything lives

When something looks wrong

  • Red banner "Microsoft 365 needs reconnecting" → Admin → Reconnect Microsoft 365.
  • Report didn't arrive → Dashboard → Next scheduled run → Last result explains what the scheduler did (captured / waiting / sent / error). You can also resend any saved month from Reports or History.
  • Numbers look wrong → use Reports → Live (now) → Preview to see current Cove data, and compare with the Cove console.
  • Need to clean up test runs → Reports or History → Delete on a row (admins only).