Before you begin
- A Atlas AVD plan. The Integrations hub is not available on Community
- The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
- A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
- Fireboxes and access points added to a WatchGuard Cloud account
- WatchGuard Cloud API access from Administration → Managed Access: the Account ID, the read-only Access ID and its password, and the API Key
- To sync into Vault: a Vault admin and at least one asset template (the Network Device template is a good fit)
What you can do
- Document every Firebox, FireCluster and WatchGuard access point as an Atlas Vault asset, with no manual data entry.
- Connect once with your Service Provider account to cover every customer account you manage in WatchGuard Cloud.
- Map each WatchGuard Cloud account to the customer company it belongs to.
- Keep the documentation current: every hour Atlas adds new devices, updates changed details and archives devices WatchGuard Cloud no longer reports.
- See what changed and when: name, model, public IP and firmware changes, each with the previous value kept.
- Ask Atlas Advisor about documented equipment, for example "What firmware are our WatchGuard devices running?"
Step 1: Get your WatchGuard Cloud API credentials
- Sign in to WatchGuard Cloud with the account that manages your customers (your Service Provider account), or with the customer's own account if it is not managed by one.
- Go to Administration → Managed Access.
- Copy the Account ID, for example WGC-1-123abc456 or ACC-1234567.
- Under API access, copy the read-only Access ID and set or copy its password. Atlas only reads accounts and device inventory, so the read-only access is enough.
- Copy the API Key, and note the region in the API URL: api.usa, api.deu or api.jpn.
- A Service Provider account reaches its own account and every account it manages. A Subscriber account reaches only itself.
Step 2: Connect in Atlas
Once connected, the card shows Manage, which opens Atlas Vault → Assets, and Disconnect. The Access ID, password and API key are stored encrypted and are never shown again. The password is only ever sent to WatchGuard Cloud, which exchanges it for a token that lasts an hour; Atlas never stores that token.
- Select the tenant in the tenant picker.
- Go to Administration → Integrations and click Connect on the WatchGuard Cloud card.
- Pick the WatchGuard Cloud region, then paste the Account ID, the Access ID, its password and the API key.
- Click Connect. Atlas signs in and lists the accounts it can read before saving anything; if it is rejected, nothing is stored.
Step 3: Map each account to a company
Add one sync per customer account. Each account can be mapped only once in an Atlas tenant, so its equipment never ends up under two companies.
- Open Atlas Vault → Assets → RMM & PSA sync and click Add sync.
- Source: WatchGuard Cloud.
- Device type: pick an account.
- Template: pick Network Device. Atlas fills in the field mappings for you: Name, Type, Manufacturer, Model, Serial Number, Management IP and Firmware Version. You can change or add any mapping.
- Company: the customer this account belongs to.
- Leave Sync automatically every hour on, click Save Changes, then click Run now to document it straight away.
What gets documented
- Identity: name, manufacturer (WatchGuard), model (for example M390, T45 or AP330), serial number and the device's WatchGuard Cloud ID.
- Type: Firewall for a Firebox or FireCluster, Access Point for a WatchGuard access point, and the product line (Firebox T Series, M Series, FireboxV, Firebox Cloud or WatchGuard AP).
- Network: the public IPv4 address WatchGuard Cloud sees the device on.
- Software: the Fireware or access point firmware version.
- Operational: online, offline, never connected or inactive, when it went offline, and whether WatchGuard Cloud manages its configuration.
- Placement: the WatchGuard Cloud account.
Devices are matched by serial number, so renaming a Firebox or changing its IP updates the same asset instead of creating a new one. A FireCluster that WatchGuard Cloud reports without a serial number is matched by its cluster ID instead. Atlas does not keep a device's uptime. Firewall policies, VPNs, users and wireless clients are not documented.
Your own documentation is kept
Atlas only fills the fields you map. Notes, attachments, custom fields and anything else you add in Vault are yours and are never touched. If you edit a mapped field by hand, Atlas keeps your value; if WatchGuard Cloud later reports something different, the field is flagged under Drift to review so you can choose which to keep. A device WatchGuard Cloud stops reporting is archived, not deleted, and comes back automatically if it returns. Atlas archives a device only after a complete read, so an outage or a rejected credential never empties your documentation.
Change history
Open an asset's ⋯ menu and choose History to see what changed: when the device was first documented, a new name, model, public IP, firmware or account (each with the previous and new value), when it was no longer reported, and when it came back. Routine online and offline changes are not recorded. The same entries appear on the Operations Timeline.
Ask Atlas Advisor
Atlas Advisor answers questions from the documented assets, read-only and limited to what you can see in Vault, with or without an AI provider. For example: "list our WatchGuard Fireboxes", "What firmware are our WatchGuard devices running?" or "Is WatchGuard Cloud connected?".
What the integration does not do
- It is read-only. It never deploys a configuration, takes or restores a backup, reboots a device or upgrades firmware.
- It does not document firewall policies, VPNs, users or wireless clients.
- It reads devices added to WatchGuard Cloud only.
- It syncs every hour or when you click Run now; the interval cannot be changed.
- It connects one WatchGuard Cloud account's API access per Atlas tenant. Credentials cannot be edited in place: disconnect and connect again with the new values.
GCC High tenants
On a tenant or deployment in Azure Government (GCC High), calls to WatchGuard Cloud are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from WatchGuard Cloud stay empty. The operator who runs your Atlas deployment can approve WatchGuard Cloud as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.
Disconnecting
Click Disconnect on the card and confirm. Atlas deletes its stored copy of the API credentials and pauses every Atlas Vault sync from WatchGuard Cloud. The documented assets and their history stay in Vault; turn the syncs back on after you reconnect. Nothing changes in WatchGuard Cloud. Reset the Access ID's password in Managed Access too if you no longer want Atlas to use it.
Troubleshooting
- The connection test fails: the Access ID, password or API key is wrong or was reset, the Account ID is mistyped, or the region does not match the API URL on the Managed Access page. Check them and connect again.
- An account is missing from the Device type list: the API access cannot see it. A Subscriber account only lists itself, and a managed account that has turned off its Service Provider's access is left out.
- A device is missing: it has not been added to that WatchGuard Cloud account.
- WatchGuard Cloud is temporarily rate limiting requests: scheduled syncs wait and retry on their own; try again in a few minutes.
- A sync reports the integration is not configured: WatchGuard Cloud was disconnected. Connect it again, then turn the sync back on.