ImmyBot Setup Beta

Connect ImmyBot to let Junto look up a customer's managed computers, read their Windows build, end-of-life and Windows 11 readiness, check detected software and pending Windows updates, see which maintenance items failed, and review the deployments ImmyBot enforces. With approval, the agent can also install, update, or remove software, run full maintenance, re-inventory a computer, cancel or rerun a maintenance session, and run a PowerShell script on a computer.

Junto supports one ImmyBot configuration per organization. Connect your ImmyBot instance once, then map ImmyBot tenants to Junto companies so the agent can retrieve each customer's computers.

ImmyBot tools are available in Explore and through your connected MCP client. They are not available to runbooks.

Prerequisites

• A Junto Admin or Owner account
• An ImmyBot instance hosted at yourcompany.immy.bot
• An ImmyBot MSP user with admin rights who can create a personal access token
• Customer companies in Junto, imported from your PSA, to map to ImmyBot tenants

Step 1: Create a Personal Access Token in ImmyBot

1. Sign in to ImmyBot as an MSP user with admin rights.
2. Open your profile and go to Personal Access Tokens.
3. Create a token for Junto.
4. Copy the token before leaving the page. ImmyBot shows it only once.

The token must belong to a user in the MSP tenant. A token created by a user in a customer tenant cannot see the other tenants, and Junto rejects it. The agent can only do what the token's user is permitted to do in ImmyBot.

Step 2: Configure in Junto

1. Go to Settings > Integrations > ImmyBot.

2. Click Add configuration.

3. Complete the form:

   Field	What to enter
   Instance	The name in the address you use to sign in, such as yourcompany for yourcompany.immy.bot
   Access token	The personal access token from Step 1
   Active	Leave enabled to make the integration available to the agent

4. Click Create configuration.

Junto checks the token against ImmyBot before saving. If ImmyBot rejects it, or it belongs to a customer tenant user, the configuration is not saved and the error explains why. On success, the confirmation names the instance and the account the token signs in as. Junto encrypts the token when stored.

The configuration card shows your MSP tenant name, the instance address, the token's account email, and an Active or Inactive badge. Click Test connection at any time to confirm that ImmyBot still accepts the token. A successful test reports Connection successful with the instance and account it connected as. Add configuration is disabled once a configuration exists.

Step 3: Map Companies to ImmyBot Tenants

1. Click Map companies on the configuration card to open Map companies to ImmyBot tenants.
2. For each Junto company, select its ImmyBot tenant, or leave it as Not mapped. A counter shows how many companies are mapped.
3. Click Save mappings and confirm Mappings saved appears.

You can also click Run auto-map. Exact name matches are applied automatically, and similar names are presented as suggestions for you to review and confirm.

Each Junto company maps to one ImmyBot tenant, and each tenant belongs to only one company. Your MSP's own tenant is listed too, so you can map it to your internal company. Map companies is available only while the configuration is Active. A saved tenant marked no longer in ImmyBot has been removed from your instance; choose another tenant or Not mapped before saving.

An unmapped company cannot use the ImmyBot tools. The agent reports this and points to the ImmyBot integration settings.

What the Agent Can Do

Capability	What Junto can do	Risk level
Computer lookup	List a customer's computers or find one by name, optionally only online computers; see OS, make, model, serial number, domain, primary user, last logged-on user, last boot, pending reboot, OS end-of-life, onboarding status, any running maintenance session, and IP addresses	Low
Computer detail	Read Windows build and edition, end-of-life date, last Windows Update scan and install, Windows 11 readiness, primary and additional persons, the RMM agents ImmyBot reaches the computer through, and optionally its five most recent maintenance sessions	Low
Detected software	List the software ImmyBot found on the computer's last inventory, with version, install date, and product codes, or search for one program	Low
Pending Windows updates	List the updates detected as missing, with KB numbers, MSRC severity, CVEs, release date, and whether each is overdue, downloaded, or needs a reboot	Low
Computer timeline	Read the last 30 days of agent connects and disconnects, online and offline events, maintenance actions, and remote sessions	Low
Compliance	See the latest result for every software and task assigned to a computer, with detected and desired versions, failed items first	Low
Maintenance sessions	List a customer's or a computer's sessions by status, and read one session's stages, per-item actions and results, and optionally its log	Low
Deployments	List the deployments that apply to a customer, both its own and your cross-tenant ones, with desired state, target, and enforcement	Low
Software catalog	Search ImmyBot's global catalog and your local catalog by name to find software to deploy	Low
Re-inventory computer	Re-run every inventory script on one online computer to refresh its software, updates, and hardware details; nothing is installed or changed	Low
Cancel maintenance session	Stop a running or pending maintenance session	Medium
Run maintenance	Install, update, or remove one piece of software, or run full, detection-only, or resolution-only maintenance, on up to 50 named computers of one customer	High
Rerun maintenance session	Start a new session with the same settings as a failed or missed one	High
Run script	Run a PowerShell script on one online computer as SYSTEM and return its output	High

All write actions require technician approval before execution. Read-only tools do not require approval. Every write tool ships with a Minimum role of Technician and Approval set to Always. Admins can change either setting per tool under Tool Policies.

Scope and Reporting

• Customer context: Every tool works on one mapped tenant at a time. A computer or maintenance session from another tenant is reported as not found. Junto confirms that the computer or session belongs to the mapped tenant before showing a request for approval, and again before running it.
• Inventory is a snapshot: Detected software, pending updates, and hardware details come from ImmyBot's last inventory pass. When a computer changed recently, ask Junto to re-inventory it, then read the data again a few minutes later.
• Deployments and catalog: Deployments and the software catalog are shared across your instance. The agent shows only deployments that target the customer's tenant or apply across tenants. The catalog is cached for 10 minutes, so newly added local software can take a few minutes to appear. Software hidden in ImmyBot is left out unless you ask for it.
• Result limits: Lists are returned 100 at a time; ask for more to continue. The computer timeline returns up to 100 events. A session's log is clipped to its most recent entries, and long log messages are shortened.
• Device card: Junto also syncs mapped customers' ImmyBot computers into its device inventory, so the triage note's device card can show a computer's online state, operating system, primary user, and failed maintenance items.

Maintenance, Scripts, and Approvals

The approval request names the customer, every computer, and exactly what will run. For a software run it names the software, its catalog, and the desired state: LatestVersion installs or updates, NotPresent uninstalls, AnyVersion installs only if missing, and NewerOrEqualVersion updates to at least the deployed version. Full maintenance enforces every deployment assigned to the selected computers, including Windows updates. Detection only reports what would change and changes nothing.

Reboots are suppressed by default. You can ask for Normal (reboot when needed), Prompt (ask the user), or Force. Offline computers are skipped by default, or the run can wait and apply when they next connect.

A successful run means ImmyBot started the sessions, not that they finished. Ask Junto to check the session for the outcome before treating the work as done. If a computer already has a session in progress, ImmyBot reports that session instead of starting another. Cancelling a session does not undo actions it already completed.

A script runs as SYSTEM through ImmyBot's Metascript context and can change anything on the computer. Scripts can be up to 20,000 characters, and Junto waits up to 120 seconds for the output by default and at most 10 minutes. The first 20,000 characters of output are returned. Use scripts for diagnosis and one-off fixes; to install or remove software, run maintenance instead so ImmyBot tracks the change.

If the connection, the company mapping, or the details of the run change after approval, including the software's install content, Junto stops the action and asks for fresh approval.

Example requests:

• "Is Acme's laptop ACME-LT-042 online in ImmyBot, and what Windows build is it on?"
• "Which of Acme's computers have a pending reboot?"
• "What Windows updates is ACME-LT-042 missing? Flag anything critical."
• "Why did last night's ImmyBot maintenance fail on ACME-FS01?"
• "Is ACME-LT-042 compliant? List the items that failed."
• "What does ImmyBot deploy to Acme's computers?"
• "Install the latest Google Chrome on ACME-LT-042 and ACME-LT-043 without rebooting."
• "Re-inventory ACME-LT-042, then check whether 7-Zip is still installed."
• "Run a PowerShell script on ACME-LT-042 that reports free disk space on every drive."

Managing the Connection

• Replace the token: Click Edit, paste the new token into Access token, and click Update configuration. Leave the field blank to keep the stored token. Junto checks the new token before saving.
• Change instances: Click Edit, enter the new Instance, and paste a token created on that instance. Tenant IDs belong to one instance, so connecting a different instance clears every company mapping. Map companies again after the change.
• Pause the integration: Click Edit, turn off Active, and click Update configuration. The configuration and mappings remain saved, the agent loses access, and Map companies is disabled until you reactivate.
• Remove the integration: Click Disconnect, then Disconnect in the confirmation dialog. This removes the stored token and every ImmyBot company mapping from Junto. Nothing changes in ImmyBot.

Troubleshooting

• Connection fails or the token is rejected: Confirm the Instance is only the name before .immy.bot, with no path, and that the token has not been deleted or expired in ImmyBot. Create a new token and update the configuration if needed.
• "The access token belongs to a customer tenant user": Create the token as a user in your MSP tenant, so it can see every tenant.
• Permission error on a tool: The token's user lacks permission for that area in ImmyBot. Grant it in ImmyBot under Show More > Users, then try again.
• Cannot add a second configuration: ImmyBot supports one configuration per organization. Edit the existing configuration to change the instance or token.
• Mapping dialog shows no tenants: Check that the token's user can view tenants in ImmyBot, then reload the dialog. If it shows no companies, import companies from your PSA first.
• Map companies is disabled: The configuration must be Active. Click Edit, turn on Active, and save.
• The agent says a company is not mapped: Open Map companies and assign that company's ImmyBot tenant.
• A computer is reported as not one of the customer's computers: The computer belongs to a different tenant than the one mapped. Check the mapping, or ask about the company that owns the computer.
• Rate limit reached: ImmyBot allows 120 requests per minute for each token. Wait a minute and try again.
• Software, updates, or hardware look out of date: Ask Junto to re-inventory the computer. The computer must be online.
• A session cannot be cancelled: Only running or pending sessions can be cancelled. Sessions that already passed, failed, or were cancelled are refused.
• A script run timed out: The script may still be running on the computer. Check the computer's recent maintenance sessions in ImmyBot before running it again.
• The action was stopped after approval: The connection, company mapping, or run details changed after approval. Request the action again to get a fresh approval.

Related

• Tool Policies
• Explore
• Triage Note