NetBird Setup Beta

Connect NetBird to let Junto see each customer's users and their enrolled devices, check whether a device is on the overlay network right now, explain why one peer cannot reach another, and review groups, access policies, networks, DNS, and the audit log. With approval, the agent can also approve or block users, invite new users, approve or remove devices, change group membership, and create or revoke setup keys.

Junto supports one NetBird configuration per organization. Connect a personal access token once, then map each Junto company to the NetBird account that holds its network: your own account, or one of your MSP tenants.

Prerequisites

• A Junto Admin or Owner account
• A NetBird account with admin or owner access to the networks you want to connect
• For MSP tenant access, a personal access token created by a real admin user; NetBird does not allow service users to reach MSP tenants
• For a self-hosted deployment, the public HTTPS URL of your management server
• Customer companies in Junto, imported from your PSA, to map to NetBird accounts

Step 1: Create a Personal Access Token

1. Sign in to the NetBird dashboard with an admin or owner user.
2. Open Users, select Me, and go to Access tokens.
3. Create a new token with a name such as Junto and copy its value. NetBird shows the token only once; store it securely.

If you manage customer tenants through NetBird's MSP features, create the token from the MSP account's admin user. A single token from that account reaches every tenant. A token from a service user authenticates, but can only be used with the token owner's own account.

Step 2: Configure in Junto

1. Go to Settings > Integrations > NetBird.

2. Click Add configuration.

3. Complete the form:

   Field	What to enter
   Personal access token	The token from Step 1
   API URL	Leave as https://api.netbird.io for NetBird Cloud. For a self-hosted deployment, enter your management URL, usually on port 33073

4. Click Create. Junto validates the token before saving by reading the token's account, its MSP tenants, and its peers. The token is encrypted when stored.

5. Click Test connection on the configuration card. A successful test reports the connected account, its peer count, and the number of MSP tenants found.

The configuration card shows the connected Account and API URL. If the test reports Connected with a warning, the token belongs to a service user. Only the token's own account can be mapped until you replace it with a token from a real admin user.

For a self-hosted deployment, use the public HTTPS URL of your management server.

Step 3: Map Companies

1. Click Company mapping on the configuration card.
2. For each Junto company, select its NetBird account. Your own account is listed first as (own account), followed by MSP tenants.
3. Click Save mappings.

You can also click Run auto-map. Exact name matches are applied immediately; similar names are shown as suggestions. Select the suggestions you want and click Confirm, or click Dismiss. Save any manual selections before running auto-map.

Each Junto company maps to one NetBird account, and each NetBird account can be selected only once. An account already assigned to another company is marked already mapped. To remove a mapping, return the row to Select NetBird account... and save. An unmapped customer cannot use the NetBird tools.

If the table has no Junto companies, import them from your PSA first. If Could not load mapping data appears, resolve the reported issue and click Retry. If a save is rejected because an account is no longer reachable from the current token, reopen the dialog to load the current account list.

What the Agent Can Do

Capability	What Junto can do	Risk level
Peers (devices)	List enrolled devices with hostname, OS, NetBird IP, connected state, last seen, owner, and groups; filter by name, user, group, OS, or connection state; inspect one peer and list the other peers it can reach under current policies	Low
Users	List users with role, status, last login, blocked and pending-approval flags; filter by role, status, or pending approval	Low
User and peer report	Every user with the devices they own, their last login, and each device's connection state; filter to users with no activity in a given number of days for access reviews and offboarding checks	Low
Groups	List groups with peer and resource counts; inspect a group's member peers and attached resources	Low
Access policies	List policies and their rules: action, protocol, ports, direction, and source and destination groups	Low
Posture checks	List the client version, OS, geolocation, private network, and process requirements that policies can enforce	Low
Setup keys	List enrollment keys with type, state, expiry, usage count, and auto-join groups; key values are never shown	Low
Networks and routes	List networks with their exposed resources and routing peers; list legacy routes on older accounts	Low
DNS	Read nameserver groups, groups with DNS management disabled, hosted zones, and the records in a zone	Low
Audit log	List who added or removed a peer, user, group, policy, route, setup key, or token, filtered by time window, activity, actor, or affected record	Low
EDR bypass review	List devices allowed to connect despite being reported non-compliant by the account's EDR integration	Low
Create group	Create a group, optionally with initial member peers	Low
Resend invitation	Resend the invitation email to a user who has not yet accepted	Low
Update peer	Rename a peer, enable or disable SSH access, turn login or inactivity expiration on or off, or approve a device waiting for admin approval	Medium
Update group members	Add peers to or remove peers from a group, which grants or removes the access that group's policies allow	Medium
Create setup key	Create a one-off or reusable enrollment key with expiry, auto-join groups, usage limit, and ephemeral option; the key value is delivered only through Secure Send	Medium
Approve user	Approve a user who is waiting for admin approval so they can log in and enroll devices	Medium
Block or unblock user	Block a user, signing them out and disconnecting every device they own, or restore their access	Medium
Invite user	Invite a person by email as a user or admin, with the groups their devices join on enrollment	Medium
Delete peer	Remove a device from the network, revoking its access immediately	High
Reject user	Remove a pending user's account	High
Revoke setup key	Stop a setup key from enrolling new devices; already enrolled devices are unaffected	High
EDR compliance bypass	Grant or revoke a bypass that lets a non-compliant device connect	High

All write actions require technician approval before execution. Read-only tools do not require approval. Deleting a peer, rejecting a user, revoking a setup key, and EDR bypass changes are high-risk and are never auto-approved.

Scope and Reporting

• Customer context: Every tool operates on one mapped customer at a time. The agent addresses customers by Junto company; it never takes a NetBird account as input.
• Finding records: Peers can be referenced by name, hostname, NetBird IP, or DNS label; users by email; groups, policies, networks, and setup keys by exact name. Peer names are not unique across users, so the agent confirms a match before changing or deleting a device and asks for clarification when a reference is ambiguous.
• Connection state: A peer that shows offline with a recent last-seen time just disconnected. A peer whose login has expired cannot connect until its owner re-authenticates the NetBird client. A user's last login is the dashboard sign-in, not the device connection; a user with an old login but a device seen today is active.
• User and peer report: Devices with no owning user were enrolled with a setup key, such as servers and routers, and are reported separately. Devices whose owner is missing from the user list, such as a removed user or a service user, are flagged as candidates for access review.
• Result limits: Lists return a limited selection of records. Ask for a narrower filter or more results when needed. The audit log covers the last 24 hours by default and up to 30 days.
• Read-only areas: The integration can inspect access policies, posture checks, networks, routes, and DNS. It does not create or change policies, routes, network resources, nameservers, or DNS records, and it does not delete users.
• EDR features: Bypass review and bypass changes are available only on accounts with a NetBird EDR integration. On other accounts, NetBird reports the feature as not available; that is not an error.

Approvals and Setup Keys

Each write shows the technician a summary of the proposed change for review before it runs. Disabling login expiration on a user's device weakens the zero-trust posture, and granting an EDR bypass is a security exception; the agent states this when proposing either change.

When the agent creates a setup key, the key value is delivered through Secure Send as a single-view link that expires after one hour. The value never appears in the chat or ticket. Share the link with the intended recipient, never the key. If Secure Send is disabled for your organization, the agent refuses to create the key and nothing is changed; enable Secure Send or create the key in the NetBird dashboard.

Example requests:

• "Is Acme's laptop ACME-042 connected to NetBird right now, and when was it last seen?"
• "Why can't ACME-042 reach Acme's file server? Show the policies involved."
• "List Acme's NetBird users who have not connected in 90 days."
• "Who changed Acme's NetBird policies in the last week?"
• "Approve the pending NetBird user jane@acme.com."
• "Create a one-off NetBird setup key for Acme's new office router and send it to Dana."
• "Block the NetBird user who left Acme and delete their laptop peer."

Managing the Connection

• Update the token: Click Edit, enter the replacement token, and click Update. Leave Personal access token blank to keep the stored token. Junto re-validates the credentials when the token or API URL changes.
• Change accounts: A token that belongs to a different NetBird account clears every company mapping, because tenant assignments belong to the previous account. Reopen Company mapping and map companies against the new account.
• Pause the integration: Click Edit, turn off Active, and click Update. The configuration and mappings remain saved.
• Remove the integration: Click Delete, then confirm Delete. This permanently removes the stored token and all NetBird company mappings from Junto.

Troubleshooting

• Token rejected: Recheck the token value and confirm it has not expired or been deleted in NetBird. Create a new token and update the configuration.
• Not permitted to read the account: Use a token from an admin or owner user. A token from a user with a lower role can authenticate without being able to read the account.
• Save fails on a self-hosted URL: Use the public HTTPS URL of your management server. An address that is only reachable inside your network is refused.
• No MSP tenants listed: Confirm the token owner is an admin in the MSP account and is a real user, not a service user. A Connected with a warning test result means the token belongs to a service user. Non-MSP accounts and some self-hosted deployments have no tenants to list.
• Customer is not mapped: Open Company mapping, select the correct NetBird account, and save. The agent cannot use NetBird for a company without a mapping.
• Mapping cannot be saved: Check that each NetBird account is selected only once. If the account list changed because the token was replaced, close and reopen the dialog to load the current accounts.
• A feature reports "not available": EDR bypass features need a NetBird EDR integration on the account, and some capabilities depend on the account's identity provider or plan. Check the account in the NetBird dashboard.
• Setup key cannot be created: Confirm Secure Send is enabled for your organization. If the key was created but delivery failed, ask the agent to revoke it and create another.
• Record not found: Confirm the exact name as the agent lists it, or ask the agent to list the records first. If the mapped tenant itself is reported missing, it may no longer exist under the MSP account; re-map the company.