Before you begin
- An Enterprise plan or above. The hub is locked below Enterprise, and the server checks the plan on every integration request, not only in the menu
- The Administrator role. Integrations appears in the sidebar only for users who can manage the tenant
- A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own accounts
- An API key or API client from the tool you are connecting, created by someone with admin rights in that tool
Find the Integrations hub
In the sidebar, go to Administration → Integrations. The page is titled Integrations: Manage external services connected to Atlas. Totals at the top show how many connectors are available and how many are connected. Below them, the list can be searched, filtered by status, category or provider, sorted, and switched between grid and list view. Each card shows the connector's status (Connected or Not connected) and, once connected, when it last synced.
- Not connected: click Connect to open the connector's form on the card.
- Connected: click Manage to open the connector's own page, or Disconnect to remove its stored credentials. Disconnecting asks you to confirm, stops the sync for the selected tenant, and you can reconnect at any time.
Connectors in the hub
The hub groups its connectors by what they do:
- PSA: ConnectWise Manage, for ticket automation, ticket updates from ConnectWise, configuration sync, company mappings and service boards.
- RMM: Tactical RMM, Datto RMM, NinjaOne, ConnectWise Automate, Tanium, N-able N-central and Level. Each shows that tool's device inventory alongside your AVD infrastructure, linked to your session hosts, with its own hierarchy (clients and sites, organizations and locations, groups). Tactical RMM, Datto RMM, NinjaOne, ConnectWise Automate and Tanium also show alerts you can act on from Atlas; N-central and Level are read-only.
- EDR: CrowdStrike Falcon, offered as two cards, CrowdStrike Falcon (Government) and CrowdStrike Falcon (Commercial). Both show Falcon sensor health, Spotlight vulnerabilities and detections for your session hosts.
- DNS security: DNS Filter, Cisco Umbrella, and Cisco Umbrella for Gov Cloud (the FedRAMP-authorized Umbrella service for U.S. government workloads).
How connecting works
Fill in the connector's form and click Connect. Atlas tests the credentials against the tool before saving anything: if the tool rejects them or cannot be reached, you see why and nothing is stored. Once the test passes, the credentials are encrypted and saved for the selected tenant, and the card changes to Connected. To change credentials later, disconnect and connect again with the new ones. ConnectWise Manage is the exception: it saves the credentials first, and you check them with Test Connection on its Settings view, where you can also replace them in place.
Create a dedicated API key or service account for Atlas in each tool rather than reusing a person's credentials. That way you can rotate or revoke it without affecting anyone's sign-in.
What each connector needs
The connect form tells you where to create the credential in each tool. In summary:
- ConnectWise Manage: Site URL, Company ID, Public Key, Private Key and Client ID. Create the key pair for an API Member under System → Members → API Members; the Client ID (a GUID) comes from the ConnectWise Developer Portal.
- Tactical RMM: your self-hosted Server URL and an API Key, created under Settings → API Keys.
- Datto RMM: the Platform URL (https://{platform}.centrastage.net) and an API Key, created under Setup → API Settings.
- NinjaOne: the Instance URL, plus a Client ID and Client Secret from an API client app created under Administration → Apps → API with the client-credentials grant.
- ConnectWise Automate: the Server URL plus a Username and Password for a dedicated service account without two-factor sign-in. The Client ID (a GUID) is optional, and needed for Automate 2020.1 and later.
- Tanium: the Server URL and a persistent API Token, created under Administration → Permissions → API Tokens. Alerts need the Tanium Threat Response module.
- N-able N-central: the Server URL and a User-API Token (JWT), created under Administration → User Management → Users → API Access.
- Level: an API Key, created under Settings → API Keys. Level is cloud-hosted, so there is no server URL.
- CrowdStrike Falcon: pick the Falcon cloud / region your CID is homed in, then enter an OAuth2 API client's Client ID and Client Secret, created under Support and resources → API clients and keys with read scopes for Hosts, Spotlight vulnerabilities and Alerts. A Flight Control member CID is optional.
- Cisco Umbrella and Cisco Umbrella for Gov Cloud: an API Key and API Secret, created under Admin → API Keys in the matching Umbrella dashboard.
- DNS Filter: an API Key from your DNS Filter dashboard's API settings.
CrowdStrike Falcon: Government or Commercial
The two CrowdStrike cards connect the same Falcon account for the tenant; they differ only in which Falcon clouds they offer. CrowdStrike Falcon (Government) offers US-GOV-1 (FedRAMP High) and US-GOV-2 (IL5), and defaults to US-GOV-1. CrowdStrike Falcon (Commercial) offers US-1, US-2 and EU-1, and defaults to US-1. A tenant has one Falcon connection, and it shows as connected on the card whose cloud matches the region you saved.
Once connected, the CrowdStrike page adds tabs for Hosts, Vulnerabilities, Detections, Onboarding (sensor install commands for your session hosts and golden images), Exclusions (including recommended FSLogix exclusions), Host groups, Sensor updates and Remediation.
ConnectWise Manage
ConnectWise Manage has its own page with tabs for Overview, Boards, Companies, Priorities, Config Sync, Automation, Webhooks, Activity, Health Status and Settings. Map your Atlas tenants to ConnectWise companies, choose the service boards and priorities tickets use, and turn on the automation rules that open tickets from Atlas events. On the Settings tab, Test Connection re-checks the saved credentials and shows the round-trip time, and Webhook Configuration shows the inbound webhook address for ticket updates from ConnectWise. See ConnectWise Manage (PSA) Integration for the full setup.
DNS Filter and Cisco Umbrella
Click Manage on a connected Cisco Umbrella card to see the last 24 hours of DNS activity right on the card: total requests, blocked requests, and malware and phishing blocks. DNS Filter has its own page (/integrations/dnsfilter), opened with Manage on its card, with tabs for Overview, Policies, Sites, Allow / Block Lists, Query Logs and Reports.
- Cisco Umbrella is read-only: Atlas shows its totals but does not change anything in Umbrella.
- DNS Filter can register, edit and remove sites, edit policy allow and block lists, rename policies and switch safe search. To filter a new host pool, add its NAT Gateway's public IP as a site on the Sites tab after it deploys: the AVD Auto-Registration settings save your choice but do not register sites yet.
Atlas Resolve vs. DNS Filter and Cisco Umbrella
Atlas Resolve is Atlas AVD's own DNS filtering, built into the Atlas Reach agent and managed under Atlas Operations → Resolve. It needs no third-party account, and it filters each device wherever it is, because the agent applies the policy on the machine itself. The DNS Filter and Cisco Umbrella connectors are for organizations that already run those services: Atlas reads their policies and activity, and DNS Filter can register your AVD networks, but the filtering itself happens in DNS Filter or Umbrella. See Set Up DNS Filtering with Atlas Resolve.
GCC High tenants
On a tenant in Azure Government (GCC High), the hub shows an Azure Government (GCC High) egress boundary notice. The RMM and PSA connectors can send VM, host-pool and tenant names to a third-party service outside the Government boundary, so those sends are blocked by default. An operator must approve each destination as inside the boundary, or as approved to receive that data, before the connector can be used. Until then, Connect fails and nothing is stored. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.
Troubleshooting
- Integrations is missing from the sidebar: your plan is below Enterprise, or your role is not Administrator.
- The page shows Enterprise Feature: the hub needs an Enterprise plan. Your account owner can change plans from the plan picker.
- Connect is unavailable or warns Select a tenant before connecting: pick a tenant in the tenant picker first. Credentials are stored per tenant.
- Connect fails saying the credentials were rejected: the key, token or secret is wrong, expired or missing a permission. Create a new one in the tool and try again.
- Connect fails saying it could not connect: check the server, platform or instance URL, and that the tool can be reached from the internet.
- A connector's page says it is not connected: connect it from the Integrations hub first.