Integrations at a glance

1. 1

   Setup wizards

   Five step-by-step wizards: Connect Microsoft, Make Northwind Managed Services Portal my PSA, Set up Microsoft 365, Set up Google Workspace, and Connect QuickBooks. Not now dismisses a wizard card without changing anything already set.

2. 2

   Microsoft Graph isn't connected

   A warning banner that shows while Microsoft Graph has no connection at all: no Microsoft 365 user sync, mailboxes, Out-of-Office awareness, or identity actions until it's connected. Connect Graph jumps straight to the Microsoft Entra ID page.

3. 3

   Identity

   Identity providers used for sign-in and directory sync: Microsoft Entra ID, shown here Not Configured. Google Workspace is the other identity provider, though it has no card of its own on this instance yet. Each needs OAuth credentials and admin consent before it can sync. Once a provider is connected and consented, the sign-in page shows its SSO button; anyone who signs in that way is auto-provisioned as a client user linked to their organization by email domain, never promoted to staff automatically.

4. 4

   PSA

   Autotask and HaloPSA, the two PSA platforms wired today, both Not Configured. Connecting one reads in tickets, customer records, contacts, and time entries from the PSA. Write-back is permanently off: the portal never pushes a change back to the PSA, and a mirrored ticket stays read-only here until you disconnect the PSA (that disconnect is the cutover; every ticket goes native from then on). Only one PSA is active at a time; the provider factory routes all sync work to whichever one is configured.

5. 5

   RMM

   NinjaOne, the one RMM platform card, Not Configured. Connecting it feeds device management, alerts, and scripts into the portal; the devices, policies, and script library it feeds live under the RMM item in the main sidebar, not here.

6. 6

   Security

   ThreatLocker, the one security and EDR card, Not Configured. It covers zero-trust application control, ringfencing, and endpoint security.

7. 7

   Billing

   Three billing platforms: Pax8 for distributor subscription sync, QuickBooks Online for invoice generation and customer records, and Stripe for card vaulting and off-session charges on the platform billing rail. Once connected, QuickBooks syncs customers, invoices, estimates, payments, and products automatically, on a schedule or triggered manually; fields ezCyber itself owns, like product categories, are never overwritten by that sync.

8. 8

   Documentation

   Five documentation and warranty providers: Dell TechDirect, HP Warranty, and Lenovo Warranty for hardware warranty lookups, Hudu (the live documentation platform), and IT Glue (scaffolded, not yet implemented). Hudu and IT Glue surface a client's articles, password vaults, procedures, assets, domains, and networks into one unified per-client view once connected.

9. 9

   AI

   Four AI provider cards. Anthropic (Claude) is Configured here, the only card on this whole page that is; the green dot on its logo and the Configured badge both mark that. OpenAI is the alternative provider; Cohere and Voyage AI upgrade knowledge-base search to hybrid vector retrieval. This tab only connects providers; which model tier each portal feature uses is set under Settings, AI Assistant, not here. Without any key configured, AI features stay completely inactive rather than erroring, so a missing key can look like a missing feature.

10. 10

    Remote Access

    One remote-access provider: Splashtop, shown here Not Configured. It takes no API key, just the team's own Splashtop owner email; the agent reads Splashtop's own registry on each device to show coverage and launch a session, so no Splashtop password is ever stored here. Turning it on is what lights up the Control column on the RMM device roster and the direct-connect option from a device's own page.

A provider detail page: Anthropic (Claude)

1. 11

   Provider header

   Icon, name, status badge, category tag, and description: the same shape every provider detail page opens with. Configured here because a key is already saved; Re-test replaces the plain Test Connection button once credentials exist.

2. 12

   API Credentials

   Where a saved key lives, masked, with a note to leave the field blank to keep it. Anthropic's own key is billed directly to the MSP's own Anthropic account; nothing here marks it up. Get one at console.anthropic.com under Settings, then API Keys, then Create Key; Anthropic requires its own small prepaid billing balance before the key works. Without a key saved, every AI-dependent feature (chat, ticket triage, drafting, auto-summaries, dispatch suggestions) stays completely inactive rather than erroring.

3. 13

   Connection Test

   Test Connection (Re-test once already saved) makes one lightweight API call to verify the saved credentials actually work. The card only appears once credentials are saved; save first, then test.

4. 14

   Sync health

   The scheduled background jobs this integration owns: last run, next run, and a 7-day pass/fail trend strip, one segment per day. AI Model Sync shows a green segment for a run that completed. AI Retry Queue reads "runs automatically in the background; there's no per-run history for this job": it still runs on schedule, it simply never writes a row to plot.

Microsoft Entra ID: app creation and mail connections

1. 15

   Initial Microsoft Setup

   A Configured pill sits above this card: the connection details are saved and can be read, but nothing has tested them yet (a Connected pill instead means the last test succeeded; an Incomplete pill names the missing field). Connect Microsoft as Admin creates three app registrations in the MSP's own Microsoft tenant in one step: MSP Runtime, Client Access, and (right after) Mail Auth. It requires a Global Administrator, or another consent-capable admin role; an Application Administrator can create the apps but can't grant the consent, and sign-in is blocked outright. Prefer PowerShell? Generate a script instead runs the same setup by hand.

2. 16

   Mail Connections

   Where a help-desk, billing, or training mailbox gets authorized, once the Mail Auth app exists. This instance reads "The mail sending app isn't set up yet": the Initial Microsoft Setup connection above has to succeed first.

3. 17

   What we access & why

   Every one of the 44 permissions the MSP-owned Microsoft apps request, broken out by app: MSP Runtime (25 permissions, the MSP's own tenant) and Client Access (19 permissions, each client tenant that consents). Nothing here can work until the Initial Microsoft Setup connection above succeeds.

A warranty provider's credential form: Dell TechDirect

1. 18

   API Credentials

   Warranty lookups need their own API keys, made on each maker's own site, one maker at a time, and each optional. Dell and HP both ask for an API Client ID and an API Client Secret from their own developer portals. Lenovo issues one key instead, sent in a header literally named ClientID. Nothing is looked up until at least one card is set up, and each maker has its own daily lookup cap (Dell's default is 5,000 a day for the whole portal), set under Settings, then Administration, then Integration Sync; setting a cap to 0 stops asking that maker without undoing its setup.

Stripe: card vaulting for the platform billing rail

1. 19

   API Credentials

   Card data never reaches this portal: a client's card goes straight to Stripe's own hosted form, and this system only ever keeps a reference plus the network, last four digits, and expiry. Capturing client cards needs Customers, Payment Methods, and Setup Intents at write, plus Account at read for your statement descriptor. Turning on automatic card billing needs Payment Intents at write too, since that is the call that takes the money. The management instance that also runs platform billing needs the same key scoped wider, to Charges and Invoices too, because that rail actually moves money.

2. 20

   Client card capture

   Let clients save a card, and charge it, off by default, adds a My Payment page to the client portal; the card vaults onto the MSP's own Stripe account, and now charges that card when one of the client's invoices comes due. Billed-by identity line names the legal entity clients are authorizing, shown verbatim above the card form; leaving it blank omits the line rather than guessing from the company name. One step in your Stripe dashboard adds this page's own webhook URL and three events (setup_intent.succeeded, payment_method.attached, payment_method.detached) to Stripe by hand; without it cards still save and still show, because the page reads Stripe live, but the audit trail of cards arriving and leaving stays empty.

Matching: linking one external record to one portal client

1. 21

   Matched / Unmatched / Create tabs

   Matched lists clients where every connected integration already has a linked external record. Unmatched lists synced records still waiting to be linked, each with a suggested portal client based on name and domain similarity. Create turns a confirmed new external record into a pre-filled new-client form.

2. 22

   Content pane

   This instance has nothing connected yet, so every tab reads empty: "No integrations are configured. Connect a PSA, RMM, accounting system, or documentation tool to start matching." When multiple systems (M365, PSA, RMM, docs) each hold their own record of the same company, Matching is where that gets confirmed as one portal client rather than staying as separate, unlinked records.

Why it works this way

Questions this page answers