Kaseya VSA 10 Setup Beta

Connect Kaseya VSA 10 to let Junto look up a customer's devices, check whether they are online, read hardware, disk, network, and security details, list installed software and pending updates, review open notifications, antivirus status, applied policies, custom fields, and the device audit log, and summarize a customer's whole fleet. With approval, the agent can also run your saved scripts, tasks, and workflows on named devices, read their output, and cancel running workflows.

Junto supports one Kaseya VSA 10 configuration per organization. Connect your VSA server once, then map VSA organizations to Junto companies so the agent can retrieve each customer's devices.

Kaseya VSA 10 tools are available in Explore and through your connected MCP client. They are not available to runbooks.

Prerequisites

• A Junto Admin or Owner account
• A Kaseya VSA 10 server, such as yourcompany.vsax.net, reachable over HTTPS
• A VSA administrator who can create third-party API tokens
• Customer companies in Junto, imported from your PSA, to map to VSA organizations

Step 1: Create an API Token in Kaseya VSA

1. Sign in to VSA 10 as an administrator.
2. Go to Configuration > API Access > Third-Party Tokens and create a token for Junto.
3. Allow the endpoints you want the agent to use. Environment is required, because Junto uses it to verify the connection. Organizations is needed to map companies. Allow the device, script, task, and workflow endpoints for the capabilities you want the agent to have.
4. Copy the Token ID and Token secret. VSA shows the secret only once, so copy it before leaving the page.

If you leave an endpoint out, the related agent capability reports a permission error until you allow it on the token.

Step 2: Configure in Junto

1. Go to Settings > Integrations > Kaseya VSA 10.

2. Click Add configuration.

3. Complete the form:

   Field	What to enter
   Server address	The address you use to sign in to VSA 10, with no path, such as yourcompany.vsax.net
   Token ID	The token ID from Step 1
   Token secret	The token secret from Step 1
   Active	Leave enabled to make the integration available to the agent

4. Click Create configuration.

Junto checks the token against VSA before saving. If VSA rejects it, or the token cannot read Environment, the configuration is not saved and the error explains why. On success, the confirmation names the VSA instance the token belongs to. Junto encrypts the token secret when stored.

The configuration card shows your VSA instance name, the server address, the last four characters of the token ID, and an Active or Inactive badge. Click Test connection at any time to confirm that VSA still accepts the token. A successful test reports Connection successful with the instance name. Add configuration is disabled once a configuration exists.

Step 3: Map Companies to VSA Organizations

1. Click Map companies on the configuration card to open Map companies to VSA organizations.
2. For each Junto company, select its VSA organization, or leave it as Not mapped. A counter shows how many companies are mapped.
3. Click Save mappings and confirm Mappings saved appears.

You can also click Run auto-map. Exact name matches are applied automatically, and similar names are presented as suggestions for you to review and confirm.

Each Junto company maps to one VSA organization, and each organization belongs to only one company. Sites and groups stay under their organization; the agent can list them and filter devices by site or group without any extra mapping. Map companies is available only while the configuration is Active. A saved organization marked no longer in Kaseya VSA has been removed from VSA; choose another organization or Not mapped before saving.

An unmapped company cannot use the Kaseya VSA tools. The agent reports this and points to the Kaseya VSA integration settings.

What the Agent Can Do

Capability	What Junto can do	Risk level
Sites and groups	List the sites under a customer's organization, with contact and address details, and the device groups in each site	Low
Device lookup	List a customer's devices or find one by name; filter by site or group; see whether the agent is installed or the device is MDM enrolled	Low
Device status	Check whether a device is online, its uptime or time offline, OS, device type, maintenance mode, external IP, network adapters, agent version, and open notification counts by priority	Low
Device assets	Read make, model, CPU, operating system, last boot, last logged-on user, CPU and memory use, disks and free space, network details, security products, firewall, antivirus, and UAC state, pending update counts, tags, and a link to the device in VSA	Low
Installed software	List installed software with publisher and version, or search for one program	Low
Updates	List available updates with KB number, severity, CVSS score, CVEs, and release date, or the installed updates and when they were installed	Low
Notifications	List a device's open notifications, newest first, optionally by priority	Low
Antivirus	Read a device's managed antivirus protection, definitions, scan and update status, and policy	Low
Policies	List the policies applied to a device, and read its patch management, antivirus, or ransomware detection policy, including schedules, reboot behavior, and approval rules	Low
Custom fields	Read the custom field values stored on a device, such as asset tags or warranty dates	Low
Audit log	Read who did what on a device, including remote control sessions, script and task runs, commands, and file transfers	Low
Fleet summary	Count a customer's devices by type and by firewall, antivirus, and UAC state, and name devices with the firewall off	Low
Script, task, and workflow library	List and read your saved scripts (inputs, outputs, and script text), tasks (the scripts they run, in order), and workflows (trigger, variables, and steps)	Low
Run history and output	Read past script runs on a device with exit code and output, a task run's result on each of the customer's devices, and a workflow run's step-by-step outcome	Low
Run saved script	Run one saved script on one device, with values for its input variables	High
Run saved task	Run a saved task on up to 50 named devices of one customer	High
Run saved workflow	Run an enabled saved workflow on up to 50 named devices of one customer, optionally overriding its constant variables	High
Cancel workflow runs	Stop up to 20 running workflow executions on a customer's devices	High

All write actions require technician approval before execution. Read-only tools do not require approval. Every write tool ships with a Minimum role of Technician and Approval set to Always. Admins can change either setting per tool under Tool Policies.

Scope and Reporting

• Customer context: Every tool works on one mapped organization at a time. A device from another organization is reported as not found. Junto confirms that every device belongs to the mapped organization before showing a request for approval, and again before running it.
• Shared library: Scripts, tasks, and workflows are shared across your VSA instance, so every customer sees the same library. Runs always target the devices named in the request. A task's or workflow's own scope or schedule is never used, so a run cannot reach another customer's devices.
• Saved items only: The agent runs saved scripts, tasks, and workflows. It cannot run an ad hoc script. To restart a machine or run on several devices, use a saved script or task built for it.
• Updates are read-only: The agent can list pending and installed updates but cannot install them. Ask about the device's patch management policy to see why it did or did not patch.
• Result limits: Lists are returned 100 at a time; ask for more to continue. Script text is shown up to 6,000 characters and script output up to 20,000 characters. A task run shows script output for the first 20 scripts on a device; ask about a specific script for the rest. A workflow run shows its first 100 steps. The fleet summary names up to 50 devices with the firewall off.
• Secrets: Windows product keys are never returned.
• Device card: Junto also syncs mapped customers' VSA devices into its device inventory, so the triage note's device card can show a device's online state, IP addresses, and open notifications.

Runs and Approvals

The approval request names the customer, every device, and what will run: the script and the variable values sent, the task and the scripts it runs in order, or the workflow and any variable overrides. Variable names must match the inputs the script declares, and each value can be up to 2,000 characters. Tasks and workflows that run more than 25 scripts cannot be run by the agent. Disabled workflows cannot be run.

A successful run means VSA accepted it, not that it finished. Ask Junto to check the script, task, or workflow execution for the outcome and output before treating the work as done. VSA starts one workflow execution per device and will not start a second while one is still running there; the existing execution is reported instead. Cancelling a workflow does not undo steps that already finished, and VSA cancels asynchronously, so check the execution again to confirm.

If the connection, the company mapping, or the run details change after approval, including edits to the saved script or to any script behind a task or workflow, Junto stops the action and asks for fresh approval.

Example requests:

• "Is Acme's server ACME-FS01 online in Kaseya VSA, and how long has it been up?"
• "What notifications are open on ACME-LT-042?"
• "How full are the disks on ACME-FS01?"
• "Which of Acme's devices have the firewall off?"
• "What updates is ACME-LT-042 missing, and what does its patch policy allow?"
• "Who remoted into ACME-LT-042 this week?"
• "Run the Clear Print Queue script on ACME-LT-042, then show me its output."
• "Run the Monthly Cleanup task on ACME-LT-042 and ACME-LT-043 and tell me how it went on each."

Managing the Connection

• Replace the token: Click Edit, enter the new Token ID and Token secret, and click Update configuration. Leave a field blank to keep its stored value. Junto checks the new token before saving. A token for a different VSA instance clears every company mapping.
• Change servers: Click Edit, enter the new Server address, and enter the token secret again. Organization IDs belong to one VSA instance, so connecting a different instance clears every company mapping. Map companies again after the change.
• Pause the integration: Click Edit, turn off Active, and click Update configuration. The configuration and mappings remain saved, the agent loses access, and Map companies is disabled until you reactivate.
• Remove the integration: Click Disconnect, then Disconnect in the confirmation dialog. This removes the stored token and every Kaseya VSA company mapping from Junto. Nothing changes in Kaseya VSA.

Troubleshooting

• Connection fails or the token is rejected: Recheck the Server address (HTTPS, host only, no path), the Token ID, and the Token secret. Confirm the token still exists in VSA.
• "The token cannot read Environment information": Allow the Environment endpoint in the token's permissions under Configuration > API Access > Third-Party Tokens, then try again.
• Permission error on a tool: The token is not allowed to use that endpoint. Allow it in the token's permissions under Configuration > API Access.
• Cannot add a second configuration: Kaseya VSA 10 supports one configuration per organization. Edit the existing configuration to change the server or token.
• Mapping dialog shows no organizations: Check that the token can read Organizations, then reload the dialog. If it shows no companies, import companies from your PSA first.
• Map companies is disabled: The configuration must be Active. Click Edit, turn on Active, and save.
• The agent says a company is not mapped: Open Map companies and assign that company's VSA organization.
• A device is reported as not one of the customer's devices: The device belongs to a different VSA organization than the one mapped. Check the mapping, or ask about the company that owns the device.
• Rate limit reached: VSA limits API requests per token each hour. Wait a few minutes and try again.
• Script run reports unknown variables: Use the input variable names the saved script declares. Ask Junto to show the script's inputs first.
• A task or workflow cannot be run: It runs more than 25 scripts, or the workflow is disabled in VSA.
• No antivirus details for a device: The device has no managed antivirus. Ask for the device's security assets to see every security product Windows reports.
• The action was stopped after approval: The connection, company mapping, or run details changed after approval, or a script behind the run was edited. Request the action again to get a fresh approval.

Related

• Tool Policies
• Explore
• Triage Note