HaloPSA / HaloITSM Integration

Connect HaloPSA or HaloITSM to Atlas AVD: see your Halo clients and open tickets alongside your AVD environment, log a Halo ticket by hand, and more.

Before you begin

  • A Atlas AVD plan. The Integrations hub is not available on Community
  • The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
  • A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
  • A HaloPSA or HaloITSM instance reachable from the internet over HTTPS: Halo-hosted (https://yourcompany.halopsa.com or https://yourcompany.haloitsm.com) or self-hosted
  • A Halo API application using Client ID and Secret (Services) authentication, whose permissions let it read clients, tickets and assets and create tickets

What you can do

  • See your active Halo clients and how many tickets are open, on the HaloPSA / HaloITSM page.
  • List every open Halo ticket, newest first, with its number, summary, client and when it was logged, and search them.
  • Log a ticket in Halo by hand on the client you choose, with an optional ticket type.
  • Sync Halo assets into Atlas Vault, by asset type.

Step 1: Create an API application in Halo

In Halo, go to Configuration → Integrations → Halo API and add a new application for Atlas. Set its authentication method to Client ID and Secret (Services), and choose the agent it logs in as. Give it permission to read customers, tickets and assets and to create and edit tickets. Atlas asks Halo for the all scope, so the application's own permissions are what limit what Atlas can do. Copy the Client ID and Client Secret; the secret is shown once.

Step 2: Connect in Atlas

Once connected, the card shows Manage, which opens the HaloPSA / HaloITSM page, and Disconnect. The Client ID and Client Secret are stored encrypted.

  1. Select the tenant in the tenant picker.
  2. Go to Administration → Integrations and click Connect on the HaloPSA / HaloITSM card.
  3. Enter the Instance URL (the address you open Halo at, for example https://yourcompany.halopsa.com), the Client ID and the Client Secret.
  4. Fill in Halo tenant only if your Halo instance tells you to use one: some Halo-hosted instances share a sign-in server and need the tenant name. Leave it empty otherwise.
  5. Click Connect. Atlas signs in to Halo and reads your clients before saving anything; if Halo rejects the credentials or cannot be reached, nothing is stored.

The HaloPSA / HaloITSM page

The page header shows the instance URL you connected. It has four tabs:

  • Overview: how many tickets are open and how many active clients the instance has.
  • Open Tickets: every open ticket, newest first, with its number, summary, client and when it was opened. Search by number, summary, client or user, and sort by any column.
  • Clients: every active Halo client with its Halo ID, searchable by name. Inactive clients are not shown.
  • Create Ticket: log a ticket in Halo (see below).

Log a ticket by hand

On Create Ticket, choose the Client, optionally a Ticket type (Halo's active ticket types, such as Incident or Service Request), enter a Summary of up to 300 characters and an optional Description, and click Create Ticket. Atlas logs the ticket in Halo and shows its Halo ticket number. A double-click or a retry does not log a second ticket. Without a ticket type, Halo applies its own default; Halo also applies its own defaults for status, priority, team and agent.

Sync assets into Atlas Vault

With HaloPSA / HaloITSM connected, open Atlas Vault → Assets → RMM & PSA sync and click Add sync: pick HaloPSA / HaloITSM as the source, a Halo asset type (such as Workstation or Server), and the asset template each asset becomes, then map fields. Atlas then creates and updates a Vault asset for each active Halo asset of that type every hour, or when you click Run now. Inactive assets are skipped. Fields you can map include the asset name, Halo ID, asset tag, the asset's second and third key fields, asset type, user, client and site. Values someone edits by hand in Vault are never overwritten.

What the integration does not do

  • It does not open Halo tickets automatically from Atlas alerts, Atlas Reach devices or failed deployments yet, and it has no automation rules. Automatic Halo tickets are on the roadmap. ConnectWise Manage, N-able MSP Manager and Tigerpaw open tickets automatically today.
  • It does not map Atlas tenants to Halo clients: you choose the client each time you log a ticket.
  • It does not add notes to, update or close Halo tickets, and it does not sync ticket status back into Atlas.
  • It does not sync time entries, contracts, invoices, quotes, contacts or sites, and it does not create or change clients.
  • Asset sync only reads Halo, and reads the chosen asset type across every client the API application can see; it never creates or changes assets in Halo.
  • It connects one Halo instance per Atlas tenant. Credentials cannot be edited in place: disconnect and connect again with the new ones.

GCC High tenants

On a tenant or deployment in Azure Government (GCC High), calls to Halo are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from Halo stay empty. The operator who runs your Atlas deployment can approve Halo as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.

Disconnecting

Click Disconnect on the card and confirm. Atlas deletes the stored instance URL and credentials for the selected tenant and pauses any Atlas Vault asset sync from Halo. Tickets already logged stay in Halo. Delete or disable the API application in Halo too if you no longer need it. You can reconnect at any time.

Troubleshooting

  • HaloPSA rejected the supplied credentials: the Client ID or Client Secret is wrong, the application was disabled, or it does not use Client ID and Secret (Services) authentication. Check the application in Halo and connect again.
  • Could not connect to HaloPSA: check the Instance URL opens from outside your network, and whether your instance needs a Halo tenant name.
  • instanceUrl must be a valid https:// URL: enter the address starting with https://.
  • tenant may contain only letters, digits, '-' and '_': enter just the tenant name, not a URL.
  • The HaloPSA server URL is not allowed: the address points to a private or internal network, which Atlas cannot reach.
  • Clients or tickets do not load, or a ticket is not created although the connection works: the API application's permissions do not cover reading clients or tickets, or creating tickets. Widen them in Halo.
  • Failed to create ticket: Halo refused the ticket, for example because the chosen ticket type requires fields Atlas does not send. Try another ticket type or none.
  • A page says HaloPSA is not connected: connect it from the Integrations hub first.

Next steps